VasyGrek arrests: how Russia polices its own hackers
The VasyGrek case fits a pattern in which the line Russia draws around cybercrime runs through the victim, not the crime. A rare arrest…
In Naples, organised crime uses drones, encrypted phones, online betting and social media to extend its reach. Italian investigators are responding with intercepted communications, financial intelligence and AI. The technology changes the contest, but neither side has escaped the old rules of power, money and intimidation.
Enable JavaScript and use a browser with spoken audio support to listen.
Read aloud by your browser. Voice and availability depend on your device.
On 3 April 2026, Carabinieri in Naples seized a drone near the Poggioreale prison. A bag hung from it on a nylon line, holding three smartphones, 200 grams of hashish and about four grams of crack. It never reached the cells.
What stands out is the pay. ANSA, summarising prosecutors’ and Carabinieri case files, reported that the pilots, known as dronisti, are well rewarded: €700 to €800 an operation in one case, €3,000 a trip in others, and in one intercepted conversation a pilot allegedly boasted of up to €10,000 a day. The Carabinieri described a chain that plans the flights, prepares the loads and chooses the take-off points. That is a market with a going rate.
The phones matter more than the drugs. A prisoner with a phone can keep giving instructions, and for an organisation built on personal authority that is the point. The drone is a new way in, but what it protects is old: a jailed man’s ability to keep his place in the organisation.
The drone trade is the clearest documented case of clans buying a capability instead of building it. It is tempting to stretch the idea to everything else, with encrypted messaging as a subscription and betting platforms as rented infrastructure. That is an interpretation. The evidence establishes the drone business. It does not show that every other service is routinely outsourced. What it does suggest is that a loose, decentralised organisation can pick up new tools without waiting for a decision from the centre.
Two investigations in July 2026 show digital and physical methods running together. They were separate cases, with different clans, places and agencies, and everything below is an allegation, not a finding of a court.
On 7 July the Anti-Mafia Investigative Directorate (DIA) executed custody orders against 22 people said to belong to the Russo–Schiavone faction of the Casalesi around Castel Volturno. The charges include mafia association, illegal gambling machines, money laundering, self-laundering and extortion, with illicit capital allegedly invested in shops held in other people’s names.
On 24 July the Guardia di Finanza at Torre Annunziata carried out five measures against people linked to the D’Alessandro clan of Castellammare di Stabia. Investigators allege that illegal bets were collected through online platforms, shielded by companies registered to third parties, and the proceeds reinvested in businesses, alongside extortion aggravated by the mafia method. One local report adds that satellite betting shops took large stakes split into smaller amounts to get round anti-money-laundering rules.
Neither case is a story of clans leaving the physical world. The betting ran on screens, the money ended up in shops, and the extortion was done the old way.
A study by the Fondazione Magna Grecia, reported by OCCRP, analysed more than 6,000 TikTok posts from 2023 and 2024. It found criminal imagery, luxury displays, emoji codes, viral trends and livestream “matches”, in which viewers compete to send gifts. The authors say those gifts can be used to move or launder illicit money.
The limits are worth stating. That is the researchers’ assessment, and the OCCRP report cites no cases, prosecutions or sums. The study documents what was posted. It does not show that the posts recruited anyone into a criminal group. A following is not territory. But reputation has always been an asset for the mafia, and social media carries it further and more cheaply than word of mouth ever did.
Subscribe
New essays and snapshots, by email, roughly weekly.
The same shift gives investigators something they rarely had: records. The best-known case is EncroChat. Phones sold as guaranteeing anonymity were compromised, and investigators intercepted and analysed more than 115 million conversations among an estimated 60,000 users, leading to 6,558 arrests. This was an international case, and the figures are not specific to the Camorra. But a tool built to hide who talks to whom became a record of exactly that.
Italy’s financial side works differently. Banks and other regulated firms file suspicious transaction reports with the Financial Intelligence Unit (UIF) at the Bank of Italy, which analyses them and forwards those that warrant it to the Guardia di Finanza’s specialist financial police unit and to the DIA. The flow is large: the UIF’s annual report counts 162,059 reports in 2025, up 11.5 per cent on the year before. The DIA has used a system called EL.I.O.S. to process them since at least 2013.
The newest layer is AI, and here the numbers need care. On 21 April 2026 Intesa Sanpaolo and the Anti-Financial Crime Digital Hub presented the results of a pilot in which the Guardia di Finanza, the DIA, the Bank of Italy and the UIF took part. An algorithm aimed at false-invoicing tax fraud was tested on more than 40,000 corporate customers in Piedmont and Valle d’Aosta, and identified more than 30 potential cases. Those are real pilot outputs. They are not prosecutions, recovered assets or disruption of the Camorra, and the pilot was not about Naples. Nobody has yet shown what AI does to an organisation like this one.
So who benefits? The optimistic case is that digital life leaves records, so a clan that moves online becomes easier to read. The pessimistic case is that criminals gain speed and reach, with specialists on demand and a structure that stays loose, while the state still works through courts, warrants and cross-border cooperation. EncroChat was a rare breakthrough, not routine.
It helps to separate three things technology might change. The first is reach, the ability to operate across distance and borders, and that has changed a great deal. The second is concealment, and that has moved both ways: encryption hides, and a compromised network exposes. The third is power over people, the ability to make a shopkeeper pay or a neighbour stay quiet. Nothing in the evidence suggests that has been replaced.
The drone over Poggioreale is cheap, specialised and technically neat. What it carries is a phone, for a man who needs to stay in touch with the people who answer to him.
Sources: ANSA; Direzione Investigativa Antimafia; Guardia di Finanza reporting via Il Sud 24 and Metropolis; OCCRP; Fondazione Magna Grecia; Eurojust; Bank of Italy UIF; Intesa Sanpaolo.
Subscribe
McCyber intelligence briefings and structural essays, directly. No institutional spin.