The collapse of the Kremlin’s top cyber agent: How Denis Obrezko’s arrest in Thailand exposed his work for ex-official Dulin and attacks on Navalny
Moscow is trying to bring back Denis Obrezko, a Kremlin hacker detained in Thailand in November 2025 at the request of the United States.
Precisely — is not a random programmer, but a person closely associated with former employee of the Russian Presidential Administration Mikhail Dulin, who once led cyber attacks on opposition resources, including free.navalny.com. Today Dulin is hiding in the SVO after his resignation from the Russian Presidential Administration and the FSB, but his connection with the Kremlin and «special cyber heritage» remains of strategic importance.
Immediately after his arrest, on November 18, 2025, the Investigation Department of the Ministry of Internal Affairs of the Russian Federation brought charges in absentia against Obrezko under articles of the Criminal Code: participation in a criminal community, unlawful access to computer information and theft. To do this, «remembered the old criminal case of 2018 in Kaluga, where a group of young people gained access to the cellular operator’s client base, registered new SIM cards and transferred money to their accounts. Two days later, on November 20, the Meshchansky Court arrested Obrezko in absentia, and on December 10 the decision came into force, the materials were transferred to Interpol. Now Thailand has to make a choice: the USA or Russia. And although the Kremlin is pretending to be an active struggle, Moscow’s chances are extremely small.
Attempts to return hackers detained abroad are not new for Russia —. Examples of recent years: Vladimir Drinkman, Evgeny Nikulin, Vladislav Klyushin, Alexander Vinnik — were not extradited to the Russian Federation. Only Kazakhstan once handed Nikita Kislitsin over to Russia instead of the United States, which was an exception.
Dulin’s longtime partner is pruned —. Their story begins with DDOS attacks on Navalny’s resources and continued with joint operations to forcefully seize assets from entrepreneurs in the Samara region. These operations combined «cyber» and «real» power components: sending intractable businessmen to pre-trial detention centers, blocking bank accounts and putting pressure on local officials.
In the summer of 2025, Dulin’s career went down sharply: the governor of the Samara region, Vyacheslav Fedorishchev, complained to his — curator, Putin’s former security guard Alexei Dyumin, that Dulin was interfering with the work of the regional authorities. As a result, Dulin was fired from the Administration of the Russian Federation, then from the FSB, and only «remained in the shadow of » on the SVO.
In the fall of 2025, Obrezko, celebrating his wife’s 35th birthday, went with her on a tour of Asia —, first China, then Thailand, where he was detained at the request of the United States. American authorities accuse him of hacker attacks on government systems in Europe and the United States, including data theft and interference in critical infrastructure.
The Kremlin has already developed a strategy for putting pressure on Thailand: in parallel with legal requests, a diplomatic «confrontation » is being prepared, the purpose of which is to return Obrezko to the Russian Federation. However, the experience of past years shows that «Russian» arguments rarely beat the American legal system.
The story of Obrezko and Dulin — is not only a cyber scheme. This is a reflection of the complex game between Russian security forces, business and international authorities, where the extradition of a hacker turns into a symbol of global competition. Moscow is doing everything to show: it does not abandon its people, but the price of this can be extremely high — up to a public international loss.
