In 2021, the unique Russian cybercrime discussion board Mazafaka was hacked. The leaked consumer database reveals one of many discussion board’s founders was an legal professional who suggested Russia’s prime hackers on the authorized dangers of their work, and what to do in the event that they received caught. A evaluation of this consumer’s hacker identities reveals that in his time on the boards he served as an officer within the particular forces of the GRU, the international army intelligence company of the Russian Federation.
Launched in 2001 below the tagline “Community terrorism,” Mazafaka would evolve into some of the guarded Russian-language cybercrime communities. The discussion board’s member roster features a Who’s Who of prime Russian cybercriminals, and it featured sub-forums for a variety of cybercrime specialities, together with malware, spam, coding and identification theft.
One illustration of the leaked Mazafaka database.
In virtually any database leak, the primary accounts listed are often the directors and early core members. However the Mazafaka consumer info posted on-line was not a database file per se, and it was clearly edited, redacted and restructured by whoever launched it. Because of this, it may be tough to inform which members are the earliest customers.
The unique Mazafaka is understood to have been launched by a hacker utilizing the nickname “Stalker.” Nonetheless, the bottom numbered (non-admin) consumer ID within the Mazafaka database belongs to a different particular person who used the deal with “Djamix,” and the e-mail tackle djamix@mazafaka[.]ru.
From the discussion board’s inception till round 2008, Djamix was one in every of its most lively and eloquent contributors. Djamix informed discussion board members he was a lawyer, and almost all of his posts included authorized analyses of varied public circumstances involving hackers arrested and charged with cybercrimes in Russia and overseas.
“Hiding with purely technical parameters won’t assist in a severe matter,” Djamix suggested Maza members in September 2007. “With the intention to ESCAPE the regulation, you might want to KNOW the regulation. That is a very powerful factor. Technical capabilities can’t overcome intelligence and crafty.”
Stalker himself credited Djamix with maintaining Mazafaka on-line for therefore a few years. In a retrospective put up revealed to Livejournal in 2014 titled, “Mazafaka, from conception to the current day,” Stalker stated Djamix had grow to be a core member of the neighborhood.
“This man is in all places,” Stalker stated of Djamix. “There’s not a factor on [Mazafaka] that he doesn’t participate in. For me, he’s a stimulus-irritant and due to him, Maza remains to be alive. Our rallying drive!”
Djamix informed different discussion board denizens he was a licensed legal professional who may very well be employed for distant or in-person consultations, and his posts on Mazafaka and different Russian boards present a number of hackers going through authorized jeopardy probably took him up on this supply.
“I’ve the suitable to symbolize your pursuits in courtroom,” Djamix stated on the Russian-language cybercrime discussion board Verified in Jan. 2011. “Remotely (within the type of fixed help and consultations), or in particular person – that is mentioned individually. In addition to the price of my providers.”
WHO IS DJAMIX?
A search on djamix@mazafaka[.]ru at DomainTools.com reveals this tackle has been used to register at the least 10 domains since 2008. These embody a number of web sites about life in and round Sochi, Russia, the location of the 2014 Winter Olympics, in addition to a close-by coastal city known as Adler. All of these websites say they had been registered to an Aleksei Safronov from Sochi who additionally lists Adler as a hometown.
The breach monitoring service Constella Intelligence finds that the telephone quantity related to these domains — +7.9676442212 — is tied to a Fb account for an Aleksei Valerievich Safronov from Sochi. Mr. Safronov’s Fb profile, which was final up to date in October 2022, says his ICQ instantaneous messenger quantity is 53765. This is identical ICQ quantity assigned to Djamix within the Mazafaka consumer database.
The Fb account for Aleksey Safronov.
A “Djamix” account on the discussion board privetsochi[.]ru (“Hey Sochi”) says this consumer was born Oct. 2, 1970, and that his web site is uposter[.]ru. This Russian language information website’s tagline is, “We Create Communication,” and it focuses closely on information about Sochi, Adler, Russia and the conflict in Ukraine, with a powerful pro-Kremlin bent.
Safronov’s Fb profile additionally offers his Skype username as “Djamixadler,” and it contains dozens of images of him wearing army fatigues together with a regiment of troopers deploying in pretty distant areas of Russia. A few of these images date again to 2008.
In a number of of the pictures, we are able to see a patch on the arm of Safronov’s jacket that bears the brand of the Spetsnaz GRU, a particular forces unit of the Russian army. In keeping with a 2020 report from the Congressional Analysis Service, the GRU operates each as an intelligence company — gathering human, cyber, and alerts intelligence — and as a army group answerable for battlefield reconnaissance and the operation of Russia’s Spetsnaz army commando models.
Mr. Safronov posted this picture of himself on Fb in 2016. The insignia of the GRU will be seen on his sleeve.
“In recent times, reviews have linked the GRU to a few of Russia’s most aggressive and public intelligence operations,” the CRS report explains. “Reportedly, the GRU performed a key position in Russia’s occupation of Ukraine’s Crimea area and invasion of jap Ukraine, the tried assassination of former Russian intelligence officer Sergei Skripal in the UK, interference within the 2016 U.S. presidential elections, disinformation and propaganda operations, and among the world’s most damaging cyberattacks.”
In keeping with the Russia-focused investigative information outlet Meduza, in 2014 the Russian Protection Ministry created its “information-operation troops” for motion in “cyber-confrontations with potential adversaries.”
“Later, sources within the Protection Ministry defined that these new troops had been meant to ‘disrupt the potential adversary’s info networks,’” Meduza reported in 2018. “Recruiters reportedly went in search of ‘hackers who’ve had issues with the regulation.’”
Mr. Safronov didn’t reply to a number of requests for remark. A 2018 treatise written by Aleksei Valerievich Safronov titled “One Hundred Years of GRU Army Intelligence” explains the importance of the bat within the seal of the GRU.
“A method or one other, the bat is an emblem that unites all lively and retired intelligence officers; it’s a image of unity and exclusivity,” Safronov wrote. “And, generally, it doesn’t matter who we’re speaking about – a secret GRU agent someplace within the military or a sniper in any of the particular forces brigades. All of them did and are doing one essential and accountable factor.”
It’s unclear what position Mr. Safronov performs or performed within the GRU, however it appears probably the army intelligence company would have exploited his appreciable technical expertise, information and connections on the Russian cybercrime boards.
Looking on Safronov’s area uposter[.]ru in Constella Intelligence reveals that this area was utilized in 2022 to register an account at a preferred Spanish-language dialogue discussion board devoted to serving to candidates put together for a profession within the Guardia Civil, one in every of Spain’s two nationwide police forces. Pivoting on that Russian IP in Constella reveals three different accounts had been created on the similar Spanish consumer discussion board across the similar date.
Mark Rasch, a former cybercrime prosecutor for the U.S. Division of Justice, stated there has all the time been an in depth relationship between the GRU and the Russian hacker neighborhood. Rasch famous that within the early 2000s, the GRU was soliciting hackers with the abilities essential to hack US banks in an effort to procure funds to assist finance Russia’s conflict in Chechnya.
“The man is closely hooked into the Russian cyber neighborhood, and that’s helpful for intelligence providers,” Rasch stated. “He may have been infiltrating the neighborhood to observe it for the GRU. Or he may simply be a man carrying a army uniform.”
