Fyodor Yarochkin and The Grugq - From Russia With Love.exe FULL

### Overview In this presentation, Fyodor Yarochkin and the Grugq share findings from over a year of open-source intelligence gathering focused on Russian underground hacking forums. Originally conceived as an automated monitoring project and commercial threat intelligence service tracking Russian and Chinese underground web boards, the project encountered severe hurdles due to the specialized natural language used by forum participants. Consequently, the research relied heavily on manual parsing and translation by Fyodor. The speakers walk through the operational realities, economic structure, and cultural dynamics of these forums, challenging mainstream perceptions of sophisticated cyber syndicates.

### Key Topics - **Automated OSINT Challenges and Hacker Slang:** Monitoring these trade boards automatically proved exceptionally difficult because automated tools like Google Translate fail completely on the forum lingo. The language is an erratic blend of Russian, English loanwords, deliberately misspelled Russian leet-speak, and elements of Fenya (Russian prison slang). Words like *traf* (traffic), *dedic* (dedicated server), and *milo* (literally soap, used for email due to phonetic resemblance) frustrate automated parsing. - **Forum Structure and Commercial Offerings:** The monitored forums function primarily as trade boards with sections for buyers, sellers, white lists, blacklists, and 'rippers' (scammers). Most forums are standard web boards (such as vBulletin) accessible without passwords, though attachments and direct download links may require registration. The lifespan of these boards is short, often surviving only a month or two because hosting is bought with stolen credentials. - **Commodities and Services Traded:** Offerings include botnet rental and builders with guaranteed antivirus evasion, malware loaders, traffic redirection and clicks with infection ratios, ddos-for-hire services, stolen credentials, Steam and Skype accounts, fake antivirus extortion tools, SMS extortion ransomware, and identity documents (passport scans, fake banking accounts with ATM cards, and Photoshop document alteration services). - **Monetization and Financial Infrastructure:** Transactions predominantly rely on WebMoney (WMZ, roughly pegged 1:1 to USD), alongside domestic banking networks like Alfa-Bank and Yandex.Money (slang-termed 'poison'). Money laundering services ('trash can for dirt') take roughly 40% cuts. Partnership programs ('partnerka') represent the more organized side of the underground, offering compliant payment gateway infrastructure, affiliate recruitment, and 30% revenue cuts for web traffic or money-mule activities.

### Technical Details - **DDoS Services:** Distributed denial-of-service attacks were advertised for around $80 per day, featuring 24/7 support and free 5-minute proof-of-concept tests. The speakers highlighted that taking down Twitter (driven by targeting a Georgian blogger on LiveJournal) cost around $160 for a multi-day disruption. - **Botnet Packages:** Full botnet setups, builders, and loaders were observed selling for as low as 440 WMZ, offering pools of several thousand bots (e.g., 5,000 total bots fluctuating in online availability), clean binary rebuilds to evade signature antivirus, and prepaid hosting. - **Communication & Identity Verification:** ICQ numbers remain the primary contact and trust mechanism. Highly sought-after 'clean' or vintage 6-digit ICQ numbers are bought and sold as status symbols and indicators of forum seniority. Endorsements from reputable forum handles are essential for closed-door deals.

### Takeaways The speakers conclude that participants in these Russian forums are primarily 'geeks, not gangsters'—young students, hobbyists, and system administrators with spare time rather than organized mafia enforcers. While highly opportunistic and profit-motivated, many operate amateurish schemes and fail to understand basic commerce or access lucrative Western consumer markets, frequently attempting to sell stolen accounts and discount goods back to fellow hackers. However, affiliate networks ('partnerkas') are steadily driving greater organization, monetization efficiency, and integration into payment systems.