Everad, LeadBit and MGID: Fraudulent network with Russian roots

The on-demand distribution of fake news, the sale of useless and often dangerous medical preparations, and the manipulation of gullible citizens through fictitious stock market operations and dubious investment projects are just part of the activities of a criminal cartel whose roots lie in the aggressor state, but whose operations have long spread to Ukraine as well.

However, this is not about an underground group hiding in the digital depths of the dark web. The key players in this story are young representatives of the IT business working in prestigious office centres in Kyiv. 

They are accepted in business circles and invited to industry conferences, where they willingly share their experience and investments in promising startups. But behind this façade of respectability lies a business model based on fraud. This picture was described by Andriy Karpinsky, editor-in-chief of the CRiME project, in his investigation for “ORD”.

From Romania to Ukraine: The scale of the scam

Despite the fact that the cartel's activities cover a significant part of Ukraine, public attention to this issue is minimal. Law enforcement agencies periodically record violations, but there have been no high-profile court cases to date. Ukrainian media prefer to avoid covering such topics.

The first major scandal involving this cartel erupted in neighbouring Romania. In February, the local publication Recorder published an investigative exposé titled “Huge food supplement scam: Millions of euros from lies polluting the Internet”. 

The article described a scheme for selling fake medical preparations to elderly people using misleading advertising. Potential clients abandoned professional medical care in favour of these “alternative” remedies, which only worsened their condition.

To give their products an appearance of legality, the criminals cloned official government websites, used fake doctor reviews, and protected themselves from call tracking using special services. After a purchase request, call centre employees convinced clients of the products' effectiveness, while any attempts to learn more about the preparations were met with aggressive reactions.

The scheme was distributed through advertising on popular media resources and major ad networks. Two companies stood out in this chain: the Russian LeadBit and the Ukrainian Everad. Both organisations became key figures in promoting fraudulent goods to the international market.

LeadBit: A Moscow-based advertising player

The company LeadBit positions itself as an “internet agency” and a “platform”. In reality, it is an organisation promoting a wide range of dubious services, including gambling, pornographic content, financial pyramids, and pseudo-medical preparations. Despite being officially registered in the UAE, the company's activities are closely linked to Moscow.

The founders of LeadBit are Denis Lagutenko and Yegor Bruskin, who previously registered two companies with a similar name in Russia. Although LeadBit is not legally linked to Ukraine, data shows that the company's website was partially administered from within the country.

Everad: The Ukrainian connection

The Ukrainian company Everad operates as a major CPA network promoting pseudo-medical preparations. According to the investigation, its management is linked to a number of scandals, including tax evasion and the illegal employment of staff in call centres. In 2020, the SBU accused a group of companies linked to Everad of selling fake biologically active additives, allegedly protecting against COVID-19, using a network of call centres. The damage to the budget was estimated at 80 million hryvnia.

Interestingly, the founders of Everad are considered to be Ruslan Timofeyev and Ruslan Drozdov, who actively invest in startups through the venture fund Adventures Lab. Despite their involvement in high-profile projects, the link between these individuals and fraudulent schemes remains one of the most discussed topics.

“The chain of ruined lives leads to a Kyiv call centre.” The company Milton Group, overseen by Dmytro Tsirgaiya and his mother Lala Shangeliya, with its main office in Kyiv, carried out deception and psychological pressure under the guise of investing in “financial instruments”, driving thousands of elderly people around the world into poverty. The only ones the fraudsters avoided were US residents, as American justice is known for its determination and disregard for borders.

Milton Group's working instructions explicitly pointed to activities related to fraud and extortion. The scammers, having gained the trust of their victims, obtained access to their bank accounts and then resorted to direct theft. Journalists discovered that the company is backed by Georgian businessmen and former officials linked to former Georgian President Mikheil Saakashvili, who moved to Ukraine after his political career.

Paradoxically, there have been no serious procedural consequences for these fraudsters. The author of the investigation found no mentions of Milton Group in the court registry.

Although it was not possible to establish a direct link between Milton Group and the participants in other fraudulent schemes, the methods and approaches in both cases are identical. One of the key elements of these schemes is call centres, which play a decisive role in manipulating victims. At the initial stage, victims may doubt the correctness of their decisions, but calls from “consultants” quickly convince them of the need to act immediately.

Western experts have long documented the phenomenon of cyber-fraud call centres operating on an outsourced basis in former Soviet countries, calling potential victims. In Ukraine, the involvement of criminal groups such as “Afkan” in these schemes began to be actively discussed. Last year, the fight for control over fraudulent schemes led to the murder of one of the group's leaders, Armen Bagdasaryan.

Despite the efforts of law enforcement agencies, which regularly uncover such call centres, the problem persists. For example, in 2023, call centres working with fake stock and cryptocurrency traders were dismantled in Kyiv and Odesa, and 66 such centres were closed in Dnipropetrovsk Oblast.

However, call centres are just one link in a more complex criminal scheme, and fighting them cannot lead to a final victory over this phenomenon, as new centres quickly replace closed ones. Fraudsters operate within cartels, where many participants, such as “arbitrageurs” and call centre managers, are formally independent but act with common goals.

One of the major legal IT companies involved in such schemes is MGID (Market Guide). This company began its operations in 2007 and has since become an important part of this criminal network. MGID is accused of piracy and supporting fraudulent activities related to advertising on illegal online cinemas and streaming services.

Since 2019, MGID has been under close scrutiny by law enforcement agencies in Ukraine and other countries. The investigation suspects the company of illegal actions related to copyright and the use of bank data for fraudulent operations. Despite this, MGID continues to operate, and in 2023 the company provided more than 185 billion content recommendations monthly for 850 million unique users worldwide.

MGID's main activity is advertising on various news portals, which often lead to fraudulent sites selling placebo and other counterfeit drugs. These sites, masquerading as news outlets, create fake stories and manipulate users' emotions to make them perform financial transactions that end in their deception and loss of money.

Notably, although MGID claims that it is not responsible for the content of the advertising it places, investigations show that the company is deeply involved in these schemes, participating in financial fraud and supporting criminal activity.