Russian cyber expert arrested in Kazakhstan, triggering a showdown between US and Moscow

A notable Russian cybersecurity expert was detained in Kazakhstan last week at the request of the U.S., prompting authorities in Moscow on Wednesday to also seek his extradition.

Although the details and reasoning for the arrest are unclear, Nikita Kislitsin was charged with selling usernames and passwords belonging to American customers of the social media company Formspring in 2012. Kislitsin worked as the head of network security at Group-IB, as well as its Russia-based spinoff company known as F.A.C.C.T. after Group-IB exited the country earlier this year.

Kislitsin's arrest is not related to his work at Group-IB, the company said in a statement on Telegram. F.A.C.C.T. said that the charges against Kislitsin stemmed from his time “as a journalist and independent researcher,” but didn’t provide further details. Kislitsin is a former editor-in-chief of the Russian magazine “Hacker,” which focuses on information security and cyberattacks.

On Wednesday, in a separate case, a Moscow court issued an arrest warrant for Kislitsin on charges related to the unauthorized access of protected computer information. Russia said it will also seek his extradition from Kazakhstan.

Once in Russia, Kislitsin could potentially evade extradition to the U.S. — a tactic the country has employed in the past.

In 2012, for example, Moscow launched a criminal probe against Russian national Dmitry Zubakha following his arrest in Cyprus. The U.S. requested Zubakha’s extradition for his role in cyberattacks against Amazon. Zubakha, however, was ultimately extradited to Russia. In 2021, he became a co-founder of a company owned by the son of a former Russian deputy prime minister.

Wanted hackers often choose to flee to former Soviet countries such as Armenia, Georgia, and Kazakhstan, believing they will be safe from foreign prosecution there, according to Dmitry Smilyanets, director of product management at Recorded Future.

"Kislitsin's arrest is a clear indication of the shift in Kazakhstan geopolitics,” said Smilyanets, who became involved in Russia’s cybercrime scene around the fall of the Soviet Union. "Some hackers called it ‘betrayal’ and ‘backstabbing’ in the private chats on Telegram." The Record is an editorially independent unit of Recorded Future.

Kislitsin traveled abroad frequently in recent years, including to Kazakhstan, for both business and personal reasons, F.A.С.С.T. told Russian state news agency RIA Novosti. He had no problems crossing the border, according to the company.

“We are convinced that there are no legal grounds for his detention in Kazakhstan,” F.A.С.С.T. said in a statement. “We support Nikita and his family.”

Law enforcement hasn’t alleged any wrongdoing by F.A.С.С.T., the company said.