A Russian cyberspace platform known as DEER.IO was shut down by the FBI today, and its suspected administrator – Russian hacker Kirill Victorovich Firsov – was arrested and charged with crimes related to hacking American companies and stealing personal customer information.
DEER.IO was a Russian cyberspace platform that allowed criminals to purchase access to computer stores on the platform and sell their criminal products or services. DEER.IO had been operating since at least October 2013 and claimed to have over 24,000 active stores with sales of over $17 million. The platform was shut down pursuant to a seizure order issued by the Southern District of California Court.
FBI agents arrested Firsov, a Russian cyber-hacker, on March 7 in New York. Firsov not only managed to operate the DEER.IO platform, but also advertised it on other government forums that catered to hackers. Firsov is scheduled to go on trial on April 16, 2020.
According to a federal complaint, the DEER.IO virtual stores offered for sale a variety of financial and corporate data from the United States and international financial and corporate data, personally identifiable information (PII), and hacked user accounts from multiple U.S. companies. Individuals can also purchase computer files, financial information, PII, and usernames and passwords taken from computers infected with malware.No legitimate business advertising of services and/or products was found through the DEER.IO store. The store operators and customers access the store via the Internet. Specifically, in this case, the FBI made purchases from DEER.IO stores hosted on Russian servers.
The DEER.IO platform offered a web design and hosting platform from which cybercriminals could advertise and sell their products (such as harvested credentials and servers ) and services. The DEER.IO online stores were hosted on Russian-controlled infrastructure. The DEER.IO platform provided store owners with an easy-to-use interface that allowed for the automated purchase and delivery of criminal goods and services.
Once store access was purchased through the DEER.IO platform, the site guided the young store owner through an automated setup to upload the products and services offered through the store and configure cryptocurrency wallets to collect payments for purchased products and/or services.
In 2019, if a cybercriminal wanted to sell prohibited goods or offer illegal services through DEER.IO, they could purchase a store directly from the DEER.IO website for 800 rubles (about $12.50) per month. The monthly fee is paid in Bitcoin or a variety of electronic payment methods, such as WebMoney, a Russian-based money transfer system similar to PayPal.
On March 4, 2020, the FBI purchased approximately 1,100 gamer accounts from the DEER.IO ACCOUNTS-MARKET.DEER.IS store for less than $20 in Bitcoin. Once the payment was completed, the FBI received the gamer accounts, including the username and password for each account. Of the 1,100 gamer accounts, 249 accounts were hacked by a company called A. Company A confirmed that if a hacker gained access to a user’s account’s username and password, the hacker could use that account. A gamer account provides access to the user’s media library. Accounts often have payment methods linked to them, so the hacker could use the linked payment method to make additional purchases on the account. Some users also have subscription services linked to their gamer accounts.
On March 5, 2020, the FBI purchased approximately 999 individual PII accounts from the DEER.IO store SHIKISHOP.DEER.IS for approximately $170 in Bitcoin. On the same day, the FBI purchased approximately 2,650 individual PII accounts from the DEER.IO store SHIKISHOP.DEER.IS for approximately $522 in Bitcoin. From these identities, the FBI identified names, dates of birth, and U.S. Social Security numbers, specifically of several individuals residing in San Diego County.
“There is a robust underground market for stolen information that has been hacked, and this was a new way to try to trade with criminals in order to catch them,” said U.S. Attorney Robert Brewer. “Hackers pose a threat to our economy, our privacy and our national security.”
FBI Special Agent Omer Meisel said, “Deer.io was the largest centralized platform that promoted and facilitated the sale of compromised social media and financial accounts, personally identifiable information (PII), and compromised computers online. The seizure of this criminal website is an important step in reducing the amount of stolen data used to victimize individuals and businesses in the United States and abroad. The FBI will continue to be on the front lines of protecting Americans from foreign and domestic cybercriminals.”
