Russian Business Network study - bizeul.org

Version 1.0.1
RBN study – before and after
David Bizeul
• Alexei Bakhtiarov: As Vladimir Kuznetsov, Alexei Bakhtiarov is one of the two most important members
of Infobox. Alexei is also very involved in whois registration because we can find 100 domains where he
is registrant. Whole Datapoint address range has been registered by Alexei Bakhtiarov. This guy may be
the Datapoint CTO as we can see an interview from him about a DDOS attack [ 46 ].
• Stepan Kucherenko : Stepan Kucherenko is supposed to be the technical guy. He may lead the IT staff.
He has also be mentioned in the network whois of TwoCoinsSoftware (81.95.144.0/22). He may be one
of the RBN leaders. Stepan Kucherenko may also have some personal relations into Peterstar that are
used to get easier Internet access.
• Flyman: According to iDefense/Verisign [ 47 ], flyman is the main RBN leader. He could be the real brain of
this complex organization. He is well known by law enforcement because of child pornography. Although
pursues have already been attempted against him, he has very strong political protection that can offer
him to continue to develop its traffic without being worried by polices.
Multiple skills
RBN has been created by people strongly involved in cybercrime activities and used to counterfeit data. As it has been
explained above, many people can be blamed for participating in RBN but some of them have special skills or relations.
All together, they form an organized and efficient team:
• Network skills: some people master BGP routing and network architecture.
• System skills: some RBN employees have good IT skills. They manage the IT infrastructure and offer
boxes to customers that can be configured remotely.
• Internet understanding: The best RBN strength may be the understanding they’ve acquired on the
whole Internet organization and processes. They have succeeded in counterfeiting most of RBN public
related data while getting official support from trusted companies or internet regulators.
UPDATE : for sure, RBN will be able to come back on the Internet soon because of this skill.
• Cybercrime relations: RBN would not exist if cybercrime was unprofitable. Indeed, some people
involved are supposed to be closely related with cybercrime activities and they may have worked together
to offer an adapted hosting service.
• Legitimate companies relations: RBN may have trusted contacts in several legitimate companies. This
contact points allow them to route IP address ranges or get internet connectivity.
• Law enforcement corruption: It is hard to believe that RBN could not have been worried without having
paid or corrupt local law enforcement authorities to prevent pursues.
46 http://www.spiegel.de/international/world/0,1518,497841,00.html
47
http://www.theage.com.au/news/business/from-russia-with-malice-a-criminal-isp/2007/07/23/1185043032049.html
40