Rublevka Team

Rublevka Team is a Russian cybercriminal cryptocurrency-theft operation active since 2023 that runs an affiliate-driven wallet-draining service model. The group is commonly described as a traffer team focused on social engineering and traffic acquisition rather than traditional network intrusion or infostealer deployment. It provides low-skill affiliates with turnkey tooling to create spoofed cryptocurrency-themed landing pages, lure victims with airdrops, giveaways, and token-purchase themes, and induce them to connect wallets and sign malicious transactions that transfer assets to the operators. The operation has been associated with the aliases Rublevka and rublevka_team. It has operated primarily through Russian-language cybercrime communities including LolzTeam, with additional presence on Exploit and XSS, and uses Telegram extensively for affiliate recruitment, automation, support, profit tracking, and operational coordination. Its platform includes landing-page generators, cloaking and evasion features, automated notifications, payout automation, and support for a large number of wallet types. Rublevka Team initially focused on The Open Network ecosystem and later pivoted heavily to Solana, with Solana-focused campaigns accounting for most of its reported revenue. Rublevka Team’s core tradecraft centers on spoofing trusted cryptocurrency brands and services, embedding custom obfuscated JavaScript drainer logic in phishing pages, and using wallet-specific social-engineering flows to maximize transaction approval by victims. The group has used infrastructure rotation, cloaking, benign fallback pages, and anti-scanner measures to reduce detection and disruption. Its model resembles broader crime-as-a-service and ransomware-affiliate ecosystems in that administrators supply tooling, infrastructure, and revenue-sharing arrangements while affiliates handle victim acquisition. Reported proceeds exceed $10 million in stolen cryptocurrency, making Rublevka Team a notable example of industrialized, service-based crypto theft.