The shadow market in Russia has shifted its priorities: instead of selling massive databases stolen from corporations, criminals now trade active, short-term access to user accounts. The cost of information intercepted by malware directly from infected computers and phones has increased by almost 13% over the past year. This was reported by BI.ZONE experts in mid-August 2026. The share of Russian users in this segment reaches 14–18%.
Unlike outdated archives, new packages contain tools for instant penetration into a person's digital environment. Such packages are found to contain:
- active session tokens allowing login to the system without entering a password;
- current passwords and direct access to email;
- credentials for VPN services and cloud storage;
- administrative access to corporate networks.
A retail archive with outdated information is valued at just $10–15. However, a subscription to a private channel with daily uploads of fresh data costs attackers $250–300 per month. The market is willing to pay for relevance, not volume.
Official statistics create an illusion of full control over the situation. In 2024, Roskomnadzor recorded 135 cases of database distribution containing over 710 million records about Russians. After the introduction of strict sanctions, the number of new large arrays indeed decreased. According to researchers from Smart Business Alert, as published by Kommersant on July 13, 2026, only 54 relevant databases with approximately 24.3 million records were discovered in the first half of 2026.
The state successfully punishes companies for leaks from centralized storage. Since May 2025, a turnover-based fine is provided for a repeat incident. Over a year and a half, starting January 1, 2025, the agency conducted 52 administrative investigations and imposed fines totaling 2.6 million rubles, without identifying any repeated violations. This was stated by Deputy Head of Roskomnadzor Milosh Wagner on August 14, 2026. However, this measure is powerless against the new threat model. Malicious software steals data after it has already left the company's secure perimeter and ended up on a person's personal device. Formally, the organization's database is not compromised, and the regulatory mechanism simply does not trigger.
Vulnerability of Corporate Infrastructure
Intercepting data on the end device allows bypassing multi-level protection. A stolen active session token often enables login to the system without re-authentication and bypassing two-factor verification. In the first half of 2026, 6 out of 10 web attacks studied by specialists were aimed precisely at obtaining keys to penetrate companies' internal infrastructure. One infected employee computer can turn a secure network into an open resource, explaining the high demand for fresh data.
A similar gap between regulator intentions and reality is observed in the field of telephone communication. Since September 1, 2025, organizational calls must be accompanied by the sender's name and category. However, already on January 27, 2026, the operators of the "big four" stopped displaying the "bank" label on calls from Sberbank, VTB, and Alfa-Bank due to the absence of contracts for the labeling service. This was reported by RBC. Later, these credit organizations, together with Sovcombank, proposed changing the rules for mass calls, deeming some requirements excessively difficult to implement.
This situation does not indicate a connection between legal marketing and cybercrime. It demonstrates that even the largest market players, interested in customer trust, face the inconvenience of new infrastructure rules. The user is forced to independently navigate the flow of commercial offers, warnings, and fraudulent attempts arriving through the same channels.
Russian regulators have made the mass dumping of databases economically unprofitable for companies. Criminal groups have adapted by switching to the targeted extraction of active access keys. Such an attack exists in the gap between the corporate perimeter and the personal device, where administrative responsibility mechanisms do not apply. As operations move to remote formats, the value of a short-lived token providing access to several services simultaneously will only grow, leaving this vulnerability zone outside the scope of existing protection norms.
AI Opinion
From the perspective of machine data analysis, the current turn of the shadow market in Russia repeats a scenario already experienced by global cybercrime several years ago. A similar model was offered by the darknet marketplace Genesis Market: session tokens, browser "fingerprints," and bypassing two-factor verification—this platform was shut down in April 2023 by Europol and law enforcement from 17 countries, detaining over a hundred buyers. International experience shows: such operations shift the point of sale but do not eliminate the source—device infection by info-stealers continues regardless of the fate of a specific platform, and new channels quickly replace closed ones.
The situation also highlights a structural risk left outside the article's scope: demand for "fresh" data creates an incentive for botnet operators to keep an infected machine operational for as long as possible, turning it into a source of constant income rather than a one-time asset for sale. Will regulators manage to develop a tool to influence this intermediate layer between the personal device and the corporate perimeter, or will it remain outside the control zone?
end-content
