That is literally what RU CW do. I'm saying that, like most RU cyber criminals, he will be recruited to act for the state of he isn't already doing so.
Why redirect though? He's causing pain to people who refused friendship with the top bully, that might very well be considered good enough. Some baron in the system might be allowed to take a cut.
The latter might actually be related to the "how?": someone could have leaked something to make the guy require more protection.
