The ‘monster’ behind Russia’s global effort to evade Western sanctions

A7 has “no particular problems transferring funds anywhere in the world”, Shor said in an interview this month with Kommersant, a Russian newspaper. Last year, he said he got “personal satisfaction” from evading sanctions.

Before founding A7, Shor was probably best known as the mastermind convicted of stealing $US1 billion from Moldova’s banking system in 2014. The scandal, known in Moldova as the “theft of the century”, led to his exile.

He now lives in Russia with his two young children and wife, Sara Shor, the pop singer and social media influencer known as Jasmin. Instagram photos document a life of lavish parties and luxury vacations, including recent Alpine skiing trips and a stay at the Waldorf Astoria Maldives.

According to three Western intelligence officials, Ilan Shor reports to Sergei V. Kiriyenko, a member of Russian President Vladimir Putin’s administration who oversees influence operations across former Soviet republics that include Moldova and Kyrgyzstan.

Shor and his wife were placed under US sanctions in 2022 for working with Russian security services to interfere in Moldovan elections, but those restrictions did little to slow him. In 2024, the Russian government funnelled hundreds of millions of dollars through a non-profit, where Shor is a director, to pay Moldovans to vote against joining the European Union in a referendum. (The effort failed; Moldova voted to join the bloc.)

In Kyrgyzstan, Shor’s influence grew as economic restrictions pushed Russia closer to it. Russia came to depend on Kyrgyzstan to import restricted goods, while Kyrgyzstan profited on the trade.

After the invasion of Ukraine, bank profits in Kyrgyzstan ballooned to $US354 million in 2024 from $US42 million in 2021, according to government data. Over that same period, shipments from Chinese and European businesses to Kyrgyzstan increased to nearly $US23 billion from about $US8 billion, United Nations data shows.

Experts have concluded that many of those shipments ultimately went to Russia. The boom was too large and abrupt to reflect real demand from within Kyrgyzstan, wrote Robin Brooks, an economist at the Brookings Institution, in a 2024 article. He assessed that Kyrgyzstan, a country of only 7 million people, was merely a pit stop for goods on their way to Russia.

In September that year, Shor created A7 with Promsvyazbank, a state-owned Russian bank tied to the military. Less than two weeks earlier, Kyrgyzstan’s economy minister at the time, Daniyar Amangeldiev, who was also involved with the non-profit tied to the Moldovan influence campaign, helped establish the Trading Co of the Kyrgyz Republic. A state entity, it was created to “monitor trade and financial transactions” and “reduce the risks of sanctions evasion and illegal payments”.

But from the start, documents show, the Trading Co had the opposite effect.

Within weeks, Shor’s systems administrators were discussing how to install their own software on the official Kyrgyz website and use it to process orders, according to A7 chat logs. Within months, A7 was generating doctored invoices that made shipments of sensitive goods bound for Russia appear to be routine purchases for Kyrgyzstan.

“The Trading Co of the Kyrgyz Republic was established to regulate and enhance the transparency of foreign trade operations,” Amangeldiev said in a statement. “To the best of my knowledge, its creation was not linked to the interests of A7 or Ilan Shor.”

A case in point is the purchase last year of advanced American electronics critical for building electronic warfare systems.

The buyer was VPK Techno Systems, a distributor based in Moscow that has publicly promoted its ties to important Russian defence companies.

The seller was Ceyuan Electronic Technology Co, a Chinese supplier that, trade records show, regularly shipped sensitive electronics to Russia.

Invoices and trade records are the “breadcrumbs that governments use to track shipments to Russia”, said Nick Grothaus, the vice president of research at Kharon, a trade data and analytics firm. Banks and distributors all over the world have cut business ties to Russia because “there’s always the possibility that sort of stuff ends up on the front lines”, he said.

On March 10, 2025, VPK sent A7 an invoice for nearly $US46,000 for signal measurement sensors – advanced electronics with industrial and military applications that are among the most sensitive goods the United States has sought to keep out of Russia.

A7 employees uploaded it to their invoicing program, which used OpenAI’s ChatGPT to read the document and generate a falsified version for the same amount and date, according to an analysis of the source code. Employees then selected one of more than 6000 stamps from a database and added it to the falsified invoice to make it appear authentic. In place of sensitive electronics bound for Russia, the new invoice listed LED light boxes used for advertising, purchased by the Trading Co of the Kyrgyz Republic.

The credentials found in the A7 app were not in use now, a spokesperson for OpenAI said, adding that the company did not allow access to its technology from Russia.

The strategy worked: Ceyuan’s bank did not raise any compliance issues, according to a document that confirmed the transaction.

A7 processed an additional $US300,000 in purchases from the Chinese supplier. The Times analysed more than 4000 similar bank transactions from 40 different accounts tied to A7 shell companies. The firm was able to send payments from shell companies to banks in more than 80 countries over the five months covered by the documents.

Ceyuan and VPK did not respond to a request for comment.

Shell companies that disguise payments solve only half of A7’s problem. To buy goods abroad, A7 also needs foreign currency, which US and European sanctions made harder for Russian businesses to obtain.

But A7 found a way to tap some of the remaining sources of foreign revenue generated by real Russian companies, according to A7’s internal accounting records and documents, and a person familiar with the effort.

To stabilise energy markets, many countries, including members of the European Union and NATO, have continued buying Russian energy and nuclear material. Gazprom, Russia’s energy giant, still sells to several Western countries, generating payments in various currencies.

Those exports created opportunities for intermediaries to divert money, said Craig Kennedy, an associate at Harvard University’s Davis Centre for Russian and Eurasian Studies. Russian companies often had employees “feeding off little bits of money flows that they can get their hands on”, Kennedy said.

An internal A7 document diagrams one such effort to siphon small amounts of Russian offshore gas proceeds. In this case, proceeds from some Gazprom sales, in Emirati dirhams, were routed to A7 through a subsidiary, rather than returned to Gazprom’s accounts in Russia.

Gazprom did not respond to a request for comment.

Nearly 400 million dirhams, roughly $US100 million, were deposited at regular instalments over the first five weeks of 2025 into accounts at First Abu Dhabi Bank belonging to A7 shell companies in the UAE, documents show.

The offshore funds were then converted into other currencies and tether, a cryptocurrency pegged to the US dollar, that would allow A7 clients to make purchases without sanctions-related restrictions. In January 2025, the companies converted more than half of the deposits into dollars, euros and tether.

At least two Emirati companies were connected to A7, according to records reviewed by the Times. The companies were registered by Shaheem Musthafa, a Dubai-based employee of Evocargo, a Russian autonomous-trucking company that does business with Gazprom, according to digital forensics, corporate records and news releases. The companies handled payments on A7’s behalf.

Evocargo and Musthafa did not respond to a request for comment. In a statement, First Abu Dhabi said it did not comment on specific matters but maintained “robust governance and compliance standards across all jurisdictions in which it operates”.

During the Biden administration, the US Treasury Department made cracking down on sanctions evasion a centrepiece of its effort to punish Russia. The department imposed thousands of additional sanctions, targeting companies and networks designed to move money around financial restrictions.

The pressure has largely disappeared. Since US President Donald Trump returned to office, the administration has removed more restrictions than it has added, according to a Times analysis of Treasury data.

That has made it harder for banks to screen for illicit activity, in part because new actors and organisations can spring up without fresh information. A7 shell companies, for example, had facilitated payments to companies that banked at major American and European banks, the Times found.

“The activity of one company may fly under the radar, or even once it’s caught, they’ll just close the account and move to a new one,” said Claire O’Neill McCleskey, a sanctions consultant and former Treasury official.

A Treasury spokesperson said that under Trump, the department had taken significant steps to disrupt Russia’s ability to fund its war, including imposing sanctions on the country’s two largest oil companies and A7.

Internal records show that A7 has a team dedicated to creating new shell companies when operational issues arise. New shell companies include Teracoretrade, in Qatar, which specialises in advanced industrial machinery. Vaydora, a general-purpose wholesaler, is based Kyrgyzstan. Nuvotra, in Bahrain, deals primarily in the oil-and-gas sector.

Teracoretrade, Vaydora and Nuvotra did not respond to requests for comment.

That ability to absorb a blow and re-form elsewhere is so central to A7’s DNA that the company has made it a symbol.

Its mascot is a nevalyashka, a children’s toy with a weighted base that rights itself whenever it is pushed over. “The nevalyashka symbolises that, no matter which direction various restrictions try to push us, the company remains stable,” A7 told a Russian lifestyle magazine in June.

The New York Times reviewed tens of thousands of documents from A7, some of them posted online by hackers around August 2025 and others left by the company in publicly accessible cloud storage folders. A small number of documents were provided to the Times by people close to A7 under the condition of anonymity.

The materials included tens of thousands of internal chat messages, presentation slides, memos, accounting records and source code, as well as databases containing customer lists and other details. Among the documents were copies of genuine and falsified invoices, along with bank transactions that confirm that some of the transactions described in the documents had taken place. Using company source code, the Times was able to reproduce internal A7 software without connecting to A7’s servers, allowing reporters to examine the software’s features. After the Times contacted the developer of the software, who had posted some of the materials online, they were taken down.

The Times used independent methods to verify the authenticity of the documents. The Times contacted companies that had unwittingly sold goods to A7 and confirmed that invoices in the files were genuine. The Times also verified a bank transaction with a financial institution on the condition of anonymity and confirmed cryptocurrency trades with public blockchain data.

Reporters independently checked phone numbers, email addresses, social media posts and physical addresses, and cross-referenced details with people familiar with the inner workings of A7. The Times also consulted current and former intelligence officials who were familiar with A7’s operations.

This article originally appeared in The New York Times.

Get a note directly from our foreign correspondents on what’s making headlines around the world. Sign up for our weekly What in the World newsletter.