U.S. v. Kirill Victorovich Firsov (Deer.io Dark Web Shop)
Key Facts
- Legal Status: SENTENCED in U.S. District Court for the Southern District of California.
- Primary Target Sector: Consumer Services, E-Commerce, Identity Providers.
- Documented Financial Loss: $17.0 million.
- 1 verified MITRE ATT&CK techniques substantiated with verbatim court excerpts.
Case Summary
Executive Summary for Board Members & Leadership
Plain-English Root Cause
Unauthorized intrusion originating from targeted infiltration directed against Consumer Services, E-Commerce, Identity Providers networks. Russian administrator of Deer.io, a decentralized cyber storefront platform hosting over 24,000 active automated shops selling hacked accounts, corporate credentials, and identity documents.
Operational & Financial Fallout
Deer.io stores generated at least $17 million in cryptocurrency sales of stolen accounts. Impacted Consumer Services, E-Commerce, Identity Providers infrastructure and associated victim operations.
3 Critical Boardroom Questions
- 1. Do 100% of our external portals enforce phishing-resistant hardware MFA?
- 2. Can compromised endpoint credentials traverse laterally to domain controllers or cloud storage?
- 3. Have our air-gapped immutable recovery backups been restored and tested within the last 90 days?
Attack Anatomy & Incident Execution
Forensic analysis of initial intrusion vector, step-by-step kill chain, operational blast radius, and defensive controls.
Unauthorized intrusion originating from targeted infiltration directed against Consumer Services, E-Commerce, Identity Providers networks. Russian administrator of Deer.io, a decentralized cyber storefront platform hosting over 24,000 active automated shops selling hacked accounts, corporate credentials, and identity documents.
Adversary Kill Chain Flow
1 Documented PhasesDeer.io functioned as an automated turn-key storefront allowing hackers to upload and sell stolen user account databases in bulk.
Deer.io stores generated at least $17 million in cryptocurrency sales of stolen accounts. Impacted Consumer Services, E-Commerce, Identity Providers infrastructure and associated victim operations.
Procedural & Incident Timeline
Firsov arrested by FBI agents at New York's John F. Kennedy International Airport.
Pleads guilty to trafficking in unauthorized access devices.
Sentenced to 30 months in federal prison.
Named Defendants & Operatives
| Defendant | Nationality | Status | Prison Term | Restitution | Notes |
|---|---|---|---|---|---|
| Kirill Victorovich Firsov | Russian Federation | sentenced | 30 mo | None | Administrator of Deer.io cybercrime marketplace; sentenced to 30 months. |
Substantiated MITRE ATT&CK Techniques
| Technique ID | Technique Name & Tactic | Primary Source Evidence Excerpt | Locator | Verification |
|---|---|---|---|---|
| T1078 | Valid Accounts Defense Evasion | "Deer.io functioned as an automated turn-key storefront allowing hackers to upload and sell stolen user account databases in bulk." | Indictment ¶ 8, Page 4 | reviewed |