Naked Security Naked Security

Hacker who sent heroin to Brian Krebs pleads guilty

Sergey Vovnenko copped a plea, pleading guilty to charges of aggravated identity theft and conspiracy to commit wire fraud.

A Ukrainian cybercrook who tried to frame security journalist Brian Krebs by sending heroin to his house has pleaded guilty to credit card theft and illegally accessing more than 13,000 computers.

Krebs reported last week that Sergey Vovnenko, 29, entered a guilty plea in the US city of Newark, New Jersey, to charges of aggravated identity theft and conspiracy to commit wire fraud.

Krebs has posted copies of the indictment and the plea agreement.

Prosecutors charged Vovnenko with operating a network of more than 13,000 hacked computers that he used to harvest credit card numbers and other sensitive information.

As the court papers show, Vovnenko had a number of aliases: “Fly,” “Flycracker,” “Flyck,” “Centurion,” “Darklife,” “MUXACC,” “Sergey Vovnencko,” and “Stranier.”

He was arrested in June 2014 in Naples.

The summer before, Krebs had surreptitiously gained access to Vovnenko’s forum, where he discovered that “Fly” was raising funds so as to buy heroin on the then-popular dark market Silk Road, have it shipped to Krebs’ house, and then spoof a call from one of his neighbors to tip off the local police when the drugs arrived.

Krebs nipped the plan in the bud by giving a heads-up to local police and the FBI, as he detailed a few months ago.

He did so in the nick of time: three days after Krebs contacted local police to come take a police report, a package arrived.

Krebs turned the envelope over to police, who analyzed its contents as being packets of almost pure heroin.

Vovnenko was not pleased when Krebs wrote up a story about the foiled plot in an article titled Mail from the (Velvet) Cybercrime Underground.

In fact, the hacker was embarrassed in front of forum members who’d contributed about 2 Bitcoins each to the heroin plan, Krebs reports.

So Vovnenko’s next stunt was to send a funereal floral arrangement, in the shape of an oversized cross, to Krebs’s home, along with a menacing message addressed to his wife and signed “Velvet Crabs.”

Vovnenko changed his tune after Italian police deposited him in Poggioreale Jail, a Naples prison that he reportedly described as “the worst prison in Italy.”

He sent a letter to Krebs, who had it tested for dangerous substances.

It was clean: no heroin, no anthrax.

Just a surprisingly friendly hand-written letter that opened with a greeting written in English and then segued into a “heartfelt apology” written in Ukrainian script.


A professional translation of the letter revealed it to be a deeply personal and – I believe – heartfelt apology from Vovnenko for sending the heroin, for posting my credit report, and for otherwise terrorizing my family. I believe he was perhaps 12-stepping it, because he also used the occasion to say that he forgave me for posting his personal information and photo of him in my blog shortly after his arrest in Italy.

Cybercrooks have done “some pretty crazy stuff” to Krebs, he’s acknowledged, but he says he’d actually like to meet Vovnenko:

I don’t normally get this kind of closure. I look forward to meeting with Fly in person one day soon now that he will be just a short train ride away. And he may be here for some time: If convicted on all charges, Fly faces up to 30 years in U.S. federal prison.

The aggravated ID theft charge to which Vovnenko pleaded guilty carries a mandatory two-year sentence, while the other charges will lengthen his sentence and include fines.

He’s scheduled to be sentenced on 2 May 2016.

Image of Hacker courtesy of

Leave a Reply

Your email address will not be published. Required fields are marked *