Russia claims to bust global scam network linked to Georgian ex-defense minister

Avatar

Russia’s security service said it had detained a dozen members of an international criminal group with links to a former Georgian defense minister.

Known as Milton Group, the network allegedly operated call centers that defrauded over 100,000 people, including those from the European Union, the U.K., Canada, Brazil, India and Japan. In a statement earlier this week, Russia’s Federal Security Service (FSB) said the group’s illegal profits reached $1 million a day, mainly through fake investment scams. 

Russian law enforcement claimed to have arrested 11 managers and employees of the group, including an Israeli-Ukrainian citizen who was said to be one of the company’s executives. Moscow also issued an arrest warrant for an Israeli-Georgian citizen, adding that, in addition to their involvement in the group, both individuals had also been instructed by Ukraine’s SBU security service in 2022 to send out scam warnings about terrorist acts in several Russian regions.

The FSB’s statement couldn’t be independently verified.

A video shared by the FSB with local media showed masked law enforcement raiding a call center’s office in an unidentified location in Russia. In the footage, dozens of people are seen sitting on the floor or standing, facing the wall with their hands behind their heads while police inspect their computers. According to the footage, the call center likely had different teams operating in English, French, Arabic, Portuguese and Japanese, among other languages.

The FSB said the call centers “operated in the interests of the former Georgian Defense Minister and the alleged founder of Milton Group, David Kezerashvili, who is currently hiding in London.” Kezerashvili is charged in Russia in absentia with alleged large-scale fraud and was placed by local authorities on an international wanted list earlier in November.

Kezerashvili is wanted in connection with two cases, including one related to Russia’s investigation of alleged war crimes by Georgia in the Tskhinvali region in 2008. Kezerashvili has called Russia’s accusations against him a smear campaign and an attempt to discredit him.

He didn’t publicly comment on the latest Milton Group operation but, earlier in 2020, when the first investigation into the group was published by the Organized Crime and Corruption Reporting Project (OCCRP), he told reporters that he had never heard of Milton Group. He did, however, confirm that he was a business partner of the Israeli-Georgian citizen David Todua, who is wanted by the FSB.

OCCRP’s investigation into Milton Group is based on evidence provided by a whistleblower and describes the operation of the organization’s call center in Ukraine’s capital, Kyiv. The research stated that the group mostly reached out to victims through Facebook ads promising remarkable financial returns. The victims would then make a small “investment” that yielded them profits on paper. However, they couldn’t later withdraw the funds.

According to OCCRP’s investigation, the alleged head of the group, Jacob Keselman, claimed that the group hadn’t defrauded anyone — its clients lost money because “they don’t understand” investment and forex brands.

On Wednesday, the FSB said that it raided three more call centers in Moscow and detained alleged criminals who stole “tens of millions of dollars” from victims in 20 countries also using fake investment deals. Russian security services didn’t publicly link these arrests to Milton Group.

According to local media reports, the newly identified call centers were controlled by the leader of the criminal group Khimprom, Yegor Burkin, who is currently wanted in Russia. Khimprom was involved in the production and distribution of synthetic drugs, including in Russia and Ukraine.

Earlier in September, Georgia said it arrested four people for their alleged involvement in the call center linked to Kezerashvili. They were charged with fraud and money laundering, while Kezerashvili denied the allegations.

“The Georgian government, using state bodies and institutions, is continuing a campaign of slander against me,” he said at that time.

CybercrimeGovernmentNews
Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Daryna Antoniuk

is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.

 

Total
0
Shares
Previous Post

Chinese provincial security teams used spyware to collect texts, audio recordings

Next Post

Dozens of popular DDoS sites raided ahead of potential Christmas attacks

Related Posts

Critical Windows Server 2025 dMSA Vulnerability Enables Active Directory Compromise

A privilege escalation flaw has been demonstrated in Windows Server 2025 that makes it possible for attackers to compromise any user in Active Directory (AD). "The attack exploits the delegated Managed Service Account (dMSA) feature that was introduced in Windows Server 2025, works with the default configuration, and is trivial to implement," Akamai security researcher Yuval Gordon said in a
Avatar
Read More

North Korean Hackers Spread Malware via Fake Crypto Firms and Job Interview Lures

North Korea-linked threat actors behind the Contagious Interview have set up front companies as a way to distribute malware during the fake hiring process. "In this new campaign, the threat actor group is using three front companies in the cryptocurrency consulting industry—BlockNovas LLC (blocknovas[.] com), Angeloper Agency (angeloper[.]com), and SoftGlide LLC (softglide[.]co)—to spread
Avatar
Read More

100+ Fake Chrome Extensions Found Hijacking Sessions, Stealing Credentials, Injecting Ads

An unknown threat actor has been attributed to creating several malicious Chrome Browser extensions since February 2024 that masquerade as seemingly benign utilities but incorporate covert functionality to exfiltrate data, receive commands, and execute arbitrary code. "The actor creates websites that masquerade as legitimate services, productivity tools, ad and media creation or analysis
Avatar
Read More