Free Spam Nation by Brian Krebs Page A

named Nooder Tovreance to break into Gusev’s SpamIt and steal the organization’s payment and customer records. In one email exchange between the two, which begins April 8, 2010, and ends at the beginning of June, Tovreance offered to sell the database to Vrublevsky for $20,000, but said that he needed to break the file transfers up into multiple smaller chunks due to the size of the database.
    The two ultimately settled on a price of $15,000, to be paid in WebMoney, a virtual currency that is popular in Russia and Eastern Europe. The first payment of $7,500 was to be made to a WebMoney purse specified by Tovreance in exchange for half of the files, with the remaining amount payable upon Vrublevsky’s receipt of the entire database. Follow-up emails indicate that Vrublevsky paid the first $7,500, but welched on the second payment after receiving the database as promised. When I interviewed Tovreance, he confirmed that Vrublevsky had hired him to produce the GlavMed and SpamIt data, and that indeed Vrublevsky had stiffed him on half of the promised price.
    ♦    ♦    ♦
    Roughly one week after miscreants leaked that ChronoPay compromat, Drake called with the news that Despduck had sent him a copy of the SpamIt and GlavMed database. By this time, I began to believe that just as Vrublevsky hid behind his “Despduck” identity in leaking the GlavMed-SpamIt customer database, Gusev was using the “Boris” identity to feed me the information stolen from ChronoPay.
    The GlavMed-SpamIt database landed in my lap the day after I published on my blog the first breaking story about a new, exceedingly complex computer worm that appeared to have been weaponized for espionage. That blog post was the first widely read story about a piece of malware of unprecedented sophistication that would become known as “Stuxnet”—a computer worm that experts later discoveredwas a cyberweapon created by Israeli and U.S. intelligence agencies in a successful bid to delay Iran’s nuclear ambitions.
    But I filed the Stuxnet post just as I was leaving for a week-long vacation with my wife and mother in York, Maine, and I’d promised to give work a rest. While follow-up reporting on Stuxnet would take dozens of telephone interviews, delving into the scoop that my anti-spam source was handing me could be done without letting my family know I was back on the clock.
    Drake set up an account for me on his web server and placed a copy of the SpamIt archive there. The file contained almost ten gigabytes worth of data. (To put that into perspective, if the SpamIt database was compiled into paperback books three inches wide, it would take a bookshelf roughly the length of a football field to hold them all.)
    I was already overwhelmed with gigabytes of fascinating internal material from ChronoPay, and had to delete data from my Macbook’s hard drive to accommodate the SpamIt archive. As I sat on the back deck of a coastal Maine vacation property with my laptop propped up on my knees, while listening to the roar of the ocean surf, I began to see the enormity of the task before me. I would need to make sense of raw intelligence from two of the largest sponsors of spam on the planet, in the process potentially incurring the wrath of the most powerful and vengeful cybercriminals on earth.
----
    6. Vrublevsky claimed the charges were trumped up and nothing more than a legal shakedown orchestrated by his enemies, but the company that was being “shaken down” operated a virtual currency he created to help his webmasters and spammers get paid without leaving an official money trail through the Russian banking networks.
    7. While Vrublevsky acted as if he had nothing to do with RBN, the pharmacy spam websites and fake antivirus affiliate programs he ran took full advantage of hosting arrangements managed under the RBN banner.

Chapter 4

MEET THE BUYERS
    Though my ultimate goal was to unmask the botmasters who were getting paid to send most of the