Financial services’ Amanda Lerner, Ph.D. on Why Russian Is Still the Lingua Franca of Cybercrime

Early cybercrime forums operated almost entirely in Russian, creating a barrier to entry that kept most analysts out. Amanda Lerner, Ph.D., Lead Cyber Threat Intelligence Analyst in financial services, broke through with a Yale PhD in Russian literature and the cultural fluency to decode dark web “Ringlish.”

Amanda tells Eli how she went from investigating bitcoin mixing services at the Manhattan DA’s Cyber Intelligence Unit to leading CTI in the financial sector, and why LLMs lower the language barrier but cannot replace the cultural context real threat intelligence requires.

Topics discussed:

• How Russian became the lingua franca of cybercrime
• Decoding “Ringlish” slang on dark web criminal forums
• From Yale Russian literature PhD to cyber threat intelligence
• Investigating bitcoin mixing services at the Manhattan DA’s Office
• Why cultural context still outweighs LLM translation in CTI
• Cybercrime-as-a-service operations that mirror legitimate businesses
• Evaluating forum credibility through reputation and thread history
• How the shrinking Runet shapes adversary worldviews

Key Takeaways: 

• Learn Russian or invest in native-speaking analysts to access cybercrime forums where cultural fluency reveals what translation alone misses.
• Study the history of CarderPlanet and early Odessa-based carding forums to understand how Russian became the default language of the cybercriminal underground.
• Recognize “Ringlish” as the true working language of cybercrime forums, a blend of Russian grammar with English technical terms that LLMs still struggle to parse accurately.
• Use LLMs as a starting point for translating forum content, but always layer in human cultural context to catch slang, sarcasm, and coded language.
• Treat cybercrime-as-a-service vendors like business competitors by mapping their offerings, pricing, reputation scores, and customer feedback across forums.
• Verify breach claims on forums by checking the poster’s account age, reputation score, transaction history, and thread responses before escalating internally.
• Monitor the shrinking Runet to understand how restricted information access shapes Russian-speaking threat actors’ worldviews and operational motivations.
• Apply academic research methods like source triangulation, fact-checking, and critical reading directly to threat intelligence analysis workflows.
• Spend dedicated time reading cybercrime forum threads end to end to build intuition for how threat actors communicate and operate.
• Trace cryptocurrency transactions back to dark web forum advertisements to connect financial flows with specific threat actor personas and campaigns.

Listen to More Episodes:  YouTube  •  Apple  •  Spotify  •  Website