I don’t have any insights, but from the artiicles I’ve read earlier I’d guess it’s more about taking him as a hostage to silence his son, a journalist writing about infosec and a person non-grata in Russia.
The SU tld is equal to what other countries know under the CC domain. No legitimate site uses that and I can’t say I’ve seen any SU link in ten+ years browsing ru-net. If that’s what they pinned on him, well, the level of fabrication is laughable. Unlike the fate of an old guy put into a joint over these stupid accusations.