PHUKET, THAILAND – Thai authorities detained a Russian man in a coordinated cybercrime raid conducted with the FBI, identifying him as the suspected GRU officer Aleksey Lukashev.
The arrest on 12 November 2025 took place after the Cyber Crime Investigation Bureau (CCIB), Phuket Immigration, and FBI agents executed a search warrant at a hotel in Thalang District. The 35-year-old suspect entered Thailand via Phuket International Airport on 30 October and checked into a local hotel before being tracked by investigators.
Joint Thai-FBI operation confirmed
According to Pol Lt Gen Surapol Prembut, Commissioner of the CCIB, the operation followed intelligence received from the FBI that a “world-class hacker” previously implicated in cyberattacks in Europe and the United States was hiding in Phuket. The search uncovered laptops, mobile devices, and digital wallets, which were seized for forensic analysis.
“The CCIB confirms the arrest was made under Thailand’s 2008 Extradition Act in coordination with the FBI.”
said Pol Lt Gen Surapol Prembut, CCIB Commissioner
The suspect was formally charged as a person wanted by the United States for extradition to face federal computer crime indictments. The case materials were handed to the Office of the Attorney General.
Link to GRU-led cyber operations
International media, including The Sun US, reported that the detained man strongly resembles Aleksey Viktorovich Lukashev, an officer of Russia’s GRU Unit 26165, also known as Fancy Bear or APT28. The U.S. Federal Bureau of Investigation lists Lukashev among its Most Wanted Cyber Fugitives.
Reports connect Lukashev to the 2016 Hillary Clinton campaign hack and to the Skripal Novichok poisoning operations coordinated by GRU units 26165 and 74455. He was indicted in the United States in 2018 alongside eleven other GRU operatives for cyber intrusions, identity theft, and conspiracy.
Digital assets linked to Thai victims seized
As part of Operation 293, CCIB investigators also recovered 14 million baht (about 365,000 euros) in stolen cryptocurrency traced to malware associated with the suspect. The funds were reclaimed with support from Tether and Thailand’s Bitkub Exchange.
• More than 100,000 USDT in total victim losses were confirmed across six Thai individuals.
• Forensic experts determined authentication keys and crypto credentials had been extracted from compromised systems.
Continuing extradition process
The Thai Attorney General’s Office began formal extradition proceedings following the arrest. Lukashev remains in custody in Phuket pending judicial review. Authorities emphasized that the detention was not linked to immigration violations, but to an active extradition request.
Broader global impact
The CCIB described the case as a milestone in expanding joint cyber enforcement with the FBI to combat transnational hacking networks. The arrest demonstrates the reach of international cyber policing and signals that high-ranking intelligence operatives may face prosecution when operating abroad.