Mapping Fly: Threat Actor Linked to Russian Market

This technical report investigates the threat actor known as 'FLY', who has connections to the Russian Market, a notorious cybercrime marketplace. The document outlines the online presence of 'FLY' across various platforms, including cybercrime forums and Telegram. It details how 'FLY' has been linked to the promotion of the Russian Market, including evidence of his activities on the crdpro forum, where he advertised the marketplace and sought collaboration with other threat actors. The report also examines the bitcoin infrastructure associated with the Russian Market, revealing connections to non-KYC exchanges and illegal mixing services. Additionally, it discusses the historical context of the Russian Market, its operational longevity since 2014, and the types of illicit products offered, such as stolen credentials and RDP sessions. The findings aim to provide a clearer understanding of the threat landscape surrounding the Russian Market and its associated actors.