Russian intelligence agent at the heart of cybercriminal forum
One of Mazafaka forum’s most active members named “Djamix”, was identified as a member of GRU.
On February 7, 2024, US cybersecurity researcher Brian Krebs published an investigation into the Russian cybercriminal forum, Mazafaka. Between its launch in 2001 and the hack it suffered in 2021, the forum played a key role in Russian cybercrime. And it turns out one of its most influential members belongs to Russian military intelligence, the GRU.
The hack of Mazafaka indeed led to an internal data leak, which included a list of its members. The first name is not an administrator, or even its creator, the infamous “Stalker”, but someone named Djamix. Between 2001 and 2008, the latter was one of the forum’s most active members.
He presented himself as a lawyer offering legal advice to cybercriminals. He regularly commented the arrests and trials of computer hackers, particularly Russian ones, everywhere in the world. “To evade the law, you must know it. This is the most important part. Technical capacities cannot top intelligence and cunning,” he wrote in September 2007.
By crosschecking his email address and login details on various websites, Brian Krebs managed to identify Djamix as Aleksei Safronov. The Russian national, born in 1970 in Sotchi, wears a GRU patch on his fatigues in his public Facebook profile. The specific role he plays in Russian intelligence is however unclear.
The presence of a GRU agent in Mazafaka (and other, similar, forums) may be due to a willingness to recruit cybercriminals. An intelligence assignment is another possibility. Mark Rasch, former prosecutor in charge of the Computer Crime Unit at the US Department of Justice, believes Aleksei Safronov may have infiltrated “the Russian cybercriminal community” in order to “monitor it for the GRU.”