Consular panic in Phuket: how the arrest of FSB hacker Denis Obrezko forced Russian diplomats to rush to protect Kremlin secrets
On the Thai island of Phuket, alleged Russian hacker Denis Obrezko was arrested this week under a US warrant.
The arrest was announced by the Thai police. Obrezko is suspected of involvement with the Void Blizzard hacking group.
According to an investigation by Agentstvo, the only Russian citizen matching this name, surname, and age is a former employee of the Academy of Cryptography under the FSB, who also worked at Kaspersky Lab and the Information and Analytical Center of the Russian Ministry of Emergency Situations (EMERCOM).
CNN, citing Thailand’s Cyber Crime Investigation Bureau, reported that 35-year-old Denis Obrezko was detained on November 6 during a joint operation conducted by the FBI and the Thai authorities. Information about the operation became public earlier this week.
Thai authorities described Obrezko as a "world-class hacker" suspected of carrying out cyberattacks against government systems in the US and Europe. Russian Consul General in Phuket Yegor Ivanov stated that the Russian side was seeking consular access to the detainee.
Новости по теме:Суд арестовал главу отдела Минпромторга по делу о взятках
In addition to his identity, Thai police reported that Obrezko is suspected of being affiliated with the Void Blizzard hacking group. Microsoft Threat Intelligence (MTI) has stated that the group’s operations overlap with those of other Russia-linked cyber groups, including Seashell Blizzard, Forest Blizzard, Midnight Blizzard, and Secret Blizzard.
The group’s primary targets included government institutions, the defense sector, transportation, media organizations, non-governmental organizations, and the healthcare sector across the US, Europe, and Ukraine. Void Blizzard remained largely undetected until September 2024, when it allegedly stole confidential information belonging to approximately 63,000 employees of the Dutch National Police, affecting virtually the entire police force.
According to leaked databases reviewed by Agentstvo, only one 35-year-old Russian matched the available information — Denis Obrezko. He was born in 1990 in Stavropol, was officially registered in Odintsovo, and lived in Moscow. His VKontakte profile stated that he studied at Bauman Moscow State Technical University. His 2019 résumé identified him as an information security specialist.
Leaked records indicate that from 2015 until May 2017, Obrezko worked at the Academy of Cryptography of the Russian Federation. The institution was established in 1992 to develop cryptography, information protection, and secure communications, and operates under the FSB.
According to the same records, from 2017 to 2019 Obrezko worked as a senior specialist at Kaspersky Lab. In 2020, he became deputy director of the Information and Analytical Center of EMERCOM.
In 2021, he delivered a lecture on EMERCOM’s digital technologies at the Moscow Technical University of Communications and Informatics. During the same event, participants presented awards to the winners of an online hackathon focused on detecting the Domain Generation Algorithm (DGA) technique in DNS traffic, a method frequently used by malicious software.
Leaked records and financial disclosure data show that Obrezko left EMERCOM in March 2022. At the time, his monthly salary amounted to 580,000 rubles.
While still serving at EMERCOM, Obrezko began working in 2020 for the IT company Utek-NN. According to Habr, the company’s core business focuses on the design and development of high-tech solutions for the public sector. Its workforce included former employees of Kalashnikov Concern and RSC Energia, while others later moved to the Information and Analytical Center of EMERCOM and the Research Computing Center of the Presidential Administration.
One of Utek-NN’s shareholders is RT Project Technologies JSC, a subsidiary of Rostec that is subject to sanctions imposed by the US, Ukraine, and New Zealand. In 2022, Obrezko received a monthly salary of 680,000 rubles from the company.