The Influence-Cybercrime Nexus: How Cybercriminal Infrastructure Is Reshaping Authoritarian Operations Against Democracies

Ben-Am and Michlin-Shapir's paper addresses one of the most significant structural developments in the contemporary threat landscape: the convergence of cybercriminal infrastructure and state-directed influence operations. The argument is that authoritarian actors — Russia in particular — have moved beyond maintaining a clear operational distinction between their intelligence services' information operations and the commercially motivated cybercriminal ecosystem. Instead, criminal infrastructure — botnets, bulletproof hosting, money-laundering networks, and access brokers — is increasingly being leveraged, whether through direction, co-optation, or tacit tolerance, to support state information operations at a scale and with a deniability that purely state-run apparatus cannot achieve.

The analytical implications are significant. If the infrastructure underpinning influence operations is criminal rather than solely governmental, standard attribution frameworks — which tend to map observed activity onto known state actor tradecraft — may systematically underestimate the scope of operations and misidentify the organisational actors responsible. Ben-Am and Michlin-Shapir's contribution is to surface this blind spot and to sketch what a revised analytical framework would need to incorporate. For practitioners working on attribution, threat assessment, or the design of counter-FIMI institutional architecture, this paper offers a conceptual challenge that warrants serious engagement.