"Lenin" in the IT world: the rise and fall of the creator of the largest carding empire

[Man]

The story is about a hacker-namesake of the leader, who decided to shake capitalism.

In December 2023, KrebsOnSecurity managed to identify a cybercriminal known under the pseudonym Rescator, who in 2013-2014 organized the sale of more than 100 million stolen payment cards, including data from Target and Home Depot. It turned out to be Mikhail Shefel, who confirmed his nickname and participation in fraudulent activities in an interview.

Earlier, Shefel changed his last name to Lenin and was the central figure in last year's investigation into the data leak from Target. The documents revealed that the 38-year-old Shefel took the pseudonym Rescator while working for ChronoPay, a company that supported spam campaigns by promoting fake antiviruses and drugs.

Shefel also confirmed that he managed many sites from 2013 to 2015 through which payment card data stolen from large retail chains was sold. However, he claims that the true organizer of the attacks was hacker Dmitry Golubov, the founder of the Carderplanet forum. However, it was Shefel's team that developed the malware used to steal data at Target and Home Depot.

Shefel admits that in 2014 he was excluded from the business, and the team of programmers was replaced by Ukrainian specialists. Later, Schäfel tried to launch several new projects, but all of them were unsuccessful. Eventually, Schäfel returned to selling malware services.

In February 2024, Shefel, along with his partner Alexander Ermakov, was arrested on charges of running the SugarLocker ransomware. Earlier it became known that Yermakov was behind the attacks on Medibank Private, as a result of which the personal data of almost 10 million Australians were exposed. In response, the Australian government launched an offensive operation against cybercriminals for the first time.

Yermakov was given 2 years probation, and Shefel still needs to appear in court. Mikhail claims that the joint project did not bring any profit, and suggests that the persecution was initiated by Petr Vrublevsky, the son of his former boss at ChronoPay.

Interest in Shefel's activities has increased against the backdrop of the fact that Vrublevsky Sr. (Pavel) was under investigation for organizing fraudulent schemes and money laundering on the Hydra platform. Meanwhile, in July 2024, materials appeared in the media that Pyotr Vrublevsky, after the closure of Hydra, allegedly created a new platform for the sale of drugs and was hiding in Switzerland.

In his recent interviews, Shefel insists that he is now on the verge of bankruptcy and is forced to look for ways to make money. In an attempt to recover his name, he is offering a partnership to launch a variety of online businesses, including password recovery services and a number of online stores selling goods from China to the United States.

Mikhail Shefel is not the first to use the surnames of historical figures in his life. In August, the U.S. State Department announced a reward of up to $2.5 million for information leading to the arrest or conviction of Vladimir Kadaria. Kadaria, 38, known by the aliases "Stalin," "Eseb," and "baxus," is suspected of distributing the Angler Exploit Kit.

Source

 

[Man]

The trials of two defendants in the SugarLocker / Shtazi IT case have ended. A sentence was passed against Alexander Yermakov - the document has not yet been published, but presumably he received two years of probation. But the second defendant, Mikhail Lenin (formerly Shefel), judging by the information on the judicial portal of Moscow, was declared insane, and a decision was made against him to apply coercive measures of a medical nature.

By a surprising coincidence, last week Brian Krebs published an article based on an interview/correspondence with Schäfel/Lenin. It is from it that it is known about the suspended sentence for Yermakov. The interview took place before the trial with Shefel himself, so he does not comment on his sanity in any way.

Shefel confirms his involvement in the hacking of American stores Target and Home Depot ten years ago, while naming former Ukrainian carder and politician Dmitry Golubov as the organizer of these and other attacks. He also talks about some of his other businesses. In particular, he calls the SugarLocker affiliate program, for which Shefel and Yermakov were put on trial, a failure and claims that there was no profit from it. (In Australia, Yermakov was sanctioned for the first time in the country's history for a high-profile attack on local insurer Medibank.)

Schäfel's interview was prompted by the fact that, despite his rich biography, he is now broke and would like to promote his new projects thanks to cooperation with Krebs. Krebs did not name them: "[T]he fact that Schäfel is already using my article about him from December 2023 to advertise what looks like a [financial] pyramid scheme and to remind the Russian hacker community of his skills and achievements." Shefel even suggested that Krebs think about a joint business, for example, to recover lost passwords from crypto wallets or to sell Chinese goods with a large markup.