A Ukrainian hacker accused of trying to frame security reporter Brian Krebs for heroin possession has pleaded guilty to credit card fraud and illegally accessing more than 13,000 computers.
Sergey Vovnenko, 29, entered guilty pleas earlier this week to charges of aggravated identity theft and conspiracy to commit wire fraud. He was accused of operating a botnet of more than 13,000 computers, which he used to harvest users’ credit card data and other sensitive information. He used aliases including “Flycracker,” “Centurion,” and “Darklife.”
In a blog post, KrebsOnSecurity’s namesake wrote:
When I first became acquainted with Vovnenko in 2013, I knew him only by his many hacker names, including “Fly” and “Flycracker,” among others. At the time, Fly was the administrator of the fraud forum “thecc[dot]bz,” an exclusive and closely guarded Russian language board dedicated to financial fraud and identity theft.
After I secretly gained access to his forum, I learned he’d hatched a plot to have heroin sent to my home and to have one of his forum lackeys call the police when the drugs arrived.
I explained this whole ordeal in great detail last fall, when Vovnenko initially was extradited from Italy to face charges here in the United States. In short, the antics didn’t end when I foiled his plot to get me arrested for drug possession, and those antics likely contributed to his arrest and to this guilty plea.
In the previous articles, Krebs explained that Vovnenko established a bitcoin fund so that members of his hacking forum could donate money. Once it reached a balance of $200, the hacker bought heroin through the then-bustling Silk Road online drug emporium. By then, Krebs had already alerted the FBI and local police to the plot, so charges were never filed against Krebs.
Federal prosecutors said that from September 2010 to August 2012, Vovnenko was part of a conspiracy to hack computers, steal user names and passwords for bank accounts and other online services and to steal debit and credit card numbers. Prosecutors said he infected computers with the “ZeuS” malware to steal banking information and record keystrokes of users.
Vovnenko fought extradition after he was detained by Italian authorities in June 2014. He faces a mandatory minimum two-year prison term for identity theft and faces additional time and a fine for conspiracy. Sentencing is scheduled for May 2.
SOURCE: Dan Goodin | Ars Technica