Feds slay dark-web souk Hydra: Servers and $25m in crypto-coins seized
(2022/04/06)
- Reference: 1649200372
- News link: https://www.theregister.co.uk/2022/04/05/us_germany_hydra/
- Source link:
US and German federal agencies came down hard on Hydra, the longest-running known dark-web marketplace trafficking in illegal drugs and money-laundering services, with a multi-pronged attack that aimed to cut off multiple heads of the nefarious online beast.
First, German federal police in coordination with US law enforcement seized Hydra servers and cryptocurrency wallets containing $25 million in Bitcoin, thus shutting down the online souk.
Later on Tuesday, the US Justice Department [1]announced criminal charges against one of the alleged Hydra operators and system administrators, 30-year-old Dmitry Olegovich Pavlov of Russia.
[2]
Plus, the US Treasury Department sanctioned the dark-web monstrosity. The Treasury's Office of Foreign Assets Control identified more than [3]100 virtual currency addresses associated with its operations that were allegedly used to conduct illicit transactions.
[4]
[5]
Hydra, which is popular among Russian-speaking criminals looking to buy and sell illicit goods and services, accounted for about 80 percent of all dark-web market-related cryptocurrency transactions last year, according to the Justice Department. Since 2015, it has raked in about $5.2 billion in cryptocurrency.
And according to [6]German authorities , the market had 17 million users as of this month.
[7]US DoJ reveals Russian supply chain attack targeting energy sector
[8]US says Russian ran online marketplace of stolen logins
[9]Alleged REvil suspect extradited on ransomware spree charges
[10]National Security Agency employee indicted for 'leaking top secret info'
Hydra operates like any legitimate online marketplace with vendors creating accounts to advertise and selling their products and services, and buyers setting up accounts to view and purchase said products. However, we're not talking about buying and selling home goods and running shoes.
According to the [11]indictment , Hydra vendors offered a variety of illicit drugs for sale, including cocaine, methamphetamine, LSD, heroin, and other opioids.
[12]
In addition to drugs, customers could buy fake IDs including US passports and driver licenses, as well as ransomware, money laundering, and cash-out services, which allowed users to convert Bitcoin into various forms of currency.
Criminal charges against Pavlov, filed in a San Francisco court, include conspiracy to distribute narcotics and conspiracy to commit money laundering related to his involvement with Hydra
Since about November 2015, Pavlov ran a web hosting provider in Russia called Promservice that managed "dozens" of servers that formed the online infrastructure of Hydra, the court documents allege. These machines allowed drug dealers and other cyber criminals to sell their services and launder billions of dollars from illegal transactions.
[14]
During this time-frame, Pavlov received "repeated" cryptocurrency payments from Hydra wallets, according to the indictment.
By providing servers and networking infrastructure that "allowed Hydra to operate and thrive" on the dark web, Pavlov helped the illicit marketplace "reap commissions worth millions of dollars," it stated. ®
Get our [15]Tech Resources
[1] https://www.justice.gov/opa/pr/justice-department-investigation-leads-shutdown-largest-online-darknet-marketplace
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Yk0QcSWvuZl3bqddMESuoAAAAIM&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://home.treasury.gov/policy-issues/financial-sanctions/recent-actions/20220405
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Yk0QcSWvuZl3bqddMESuoAAAAIM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Yk0QcSWvuZl3bqddMESuoAAAAIM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.bka.de/DE/Presse/Listenseite_Pressemitteilungen/2022/Presse2022/220405_PM_IllegalerDarknetMarktplatz.html
[7] https://www.theregister.com/2022/03/25/us_indicts_russian_state_hackers/
[8] https://www.theregister.com/2022/03/23/russian_indicted_by_us/
[9] https://www.theregister.com/2022/03/10/revil_suspect_ukrainian_arraigned_us_court/
[10] https://www.theregister.com/2022/04/01/nsa_employee_secret_data_leak/
[11] https://www.justice.gov/opa/press-release/file/1490906/download
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Yk0QcSWvuZl3bqddMESuoAAAAIM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[13] https://www.justice.gov/opa/press-release/file/1490906/download
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Yk0QcSWvuZl3bqddMESuoAAAAIM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[15] https://whitepapers.theregister.com/
First, German federal police in coordination with US law enforcement seized Hydra servers and cryptocurrency wallets containing $25 million in Bitcoin, thus shutting down the online souk.
Later on Tuesday, the US Justice Department [1]announced criminal charges against one of the alleged Hydra operators and system administrators, 30-year-old Dmitry Olegovich Pavlov of Russia.
[2]
Plus, the US Treasury Department sanctioned the dark-web monstrosity. The Treasury's Office of Foreign Assets Control identified more than [3]100 virtual currency addresses associated with its operations that were allegedly used to conduct illicit transactions.
[4]
[5]
Hydra, which is popular among Russian-speaking criminals looking to buy and sell illicit goods and services, accounted for about 80 percent of all dark-web market-related cryptocurrency transactions last year, according to the Justice Department. Since 2015, it has raked in about $5.2 billion in cryptocurrency.
And according to [6]German authorities , the market had 17 million users as of this month.
[7]US DoJ reveals Russian supply chain attack targeting energy sector
[8]US says Russian ran online marketplace of stolen logins
[9]Alleged REvil suspect extradited on ransomware spree charges
[10]National Security Agency employee indicted for 'leaking top secret info'
Hydra operates like any legitimate online marketplace with vendors creating accounts to advertise and selling their products and services, and buyers setting up accounts to view and purchase said products. However, we're not talking about buying and selling home goods and running shoes.
According to the [11]indictment , Hydra vendors offered a variety of illicit drugs for sale, including cocaine, methamphetamine, LSD, heroin, and other opioids.
[12]
In addition to drugs, customers could buy fake IDs including US passports and driver licenses, as well as ransomware, money laundering, and cash-out services, which allowed users to convert Bitcoin into various forms of currency.
Criminal charges against Pavlov, filed in a San Francisco court, include conspiracy to distribute narcotics and conspiracy to commit money laundering related to his involvement with Hydra
[13]PDF
.Since about November 2015, Pavlov ran a web hosting provider in Russia called Promservice that managed "dozens" of servers that formed the online infrastructure of Hydra, the court documents allege. These machines allowed drug dealers and other cyber criminals to sell their services and launder billions of dollars from illegal transactions.
[14]
During this time-frame, Pavlov received "repeated" cryptocurrency payments from Hydra wallets, according to the indictment.
By providing servers and networking infrastructure that "allowed Hydra to operate and thrive" on the dark web, Pavlov helped the illicit marketplace "reap commissions worth millions of dollars," it stated. ®
Get our [15]Tech Resources
[1] https://www.justice.gov/opa/pr/justice-department-investigation-leads-shutdown-largest-online-darknet-marketplace
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Yk0QcSWvuZl3bqddMESuoAAAAIM&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://home.treasury.gov/policy-issues/financial-sanctions/recent-actions/20220405
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Yk0QcSWvuZl3bqddMESuoAAAAIM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Yk0QcSWvuZl3bqddMESuoAAAAIM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.bka.de/DE/Presse/Listenseite_Pressemitteilungen/2022/Presse2022/220405_PM_IllegalerDarknetMarktplatz.html
[7] https://www.theregister.com/2022/03/25/us_indicts_russian_state_hackers/
[8] https://www.theregister.com/2022/03/23/russian_indicted_by_us/
[9] https://www.theregister.com/2022/03/10/revil_suspect_ukrainian_arraigned_us_court/
[10] https://www.theregister.com/2022/04/01/nsa_employee_secret_data_leak/
[11] https://www.justice.gov/opa/press-release/file/1490906/download
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Yk0QcSWvuZl3bqddMESuoAAAAIM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[13] https://www.justice.gov/opa/press-release/file/1490906/download
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Yk0QcSWvuZl3bqddMESuoAAAAIM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[15] https://whitepapers.theregister.com/
Hydra hosting provider
Clausewitz 4.0
So, basically, feds got the prefered hosting provider of Hydra Market and seized servers.
Nothing else.
Re: Hydra hosting provider
mhoneywell
Well, apart from the other stuff, yes.
Re: Hydra hosting provider
doublelayer
What they have so far is:
1. Servers seized, possible source of more evidence.
2. Market is shut down. To move it, the admins will have to generate a new address and migrate users, and some users won't switch because it could always be an operation by law enforcement to find them.
3. If the summary is correct, some cryptocurrency previously controlled by the operators is now unavailable to them.
4. One person connected to it has been publicly identified. He's probably not going to court, but he would prefer to have remained anonymous.
What happens to the seizures?
I've always wondered what happens to the seized crypto in operations such as this. At least weekly you hear "Crooks get done, $x million/billion in crypto seized" or similar.
So where does it go? Restitution/returned to "victims"? Stored for infinity in some fed-held wallet as it's not a recognised asset in whatever jurisdiction it is? 80% gets forgotten about and the remaining 20% gets declared in the press release as a successful bust?
Icon for effect.