When security-researcher/hornet-nest-kicker Brian Krebs outed Sergey “Flycracker” Vovnenko as administrator of a darknet crime site and botmaster of a 13,000-PC-strong botnet used to attack sites and launder stolen data, Vovnenko allegedly masterminded a plot to frame Krebs by mailing him heroin.
The plot failed. Krebs uncovered Vovnenko’s identity with the help of some of Vovnenko’s professional enemies, assisted by data that Vovnenko himself had aggregated by spying on his own girlfriend and saving the data to a compromised email account.
This led to Vovnenko’s arrest in Italy and eventual extradition to the USA. While Vovnenko was in Italy’s notorious Poggioreale Jail, he sent Krebs a series of heartfelt apologies and weird-ass letters, possibly as part of a “making amends” step in a 12-step program.
The envelope was clean. It contained only a hand-written letter. The opening paragraph was a friendly greeting written in English; the rest was penned in Ukrainian script. A professional translation of the letter revealed it to be a deeply personal and — I believe — heartfelt apology from Vovnenko for sending the heroin, for posting my credit report, and for otherwise terrorizing my family. I believe he was perhaps 12-stepping it, because he also used the occasion to say that he forgave me for posting his personal information and photo of him in my blog shortly after his arrest in Italy.
In December 2014, I received another missive from Fly, still awaiting extradition in Poggioreale. It was a postcard with a nice picture of Naples on the front, and simple holiday greetings on the back: “Happy New Year! And Merry Christmas!” the message read. “With Best Regrads [sic], From Fly!”
Cybercrooks have done some pretty crazy stuff to me in response to my reporting about them. But I don’t normally get this kind of closure. I look forward to meeting with Fly in person one day soon now that he will be just a short train ride away. And he may be here for some time: If convicted on all charges, Fly faces up to 30 years in U.S. federal prison.
Hacker Who Sent Me Heroin Faces Charges in U.S.
[Brian Krebs/Krebs on Security]