FLY▊
The admin of an invitation-only Russian-language fraud forum decided to destroy the reporter who covered his world. He topped a blog post with a photoshopped image of Brian Krebs's bloodied severed head, published his credit report, then crowdfunded a plot to mail heroin to Krebs's house and have a spoofed neighbor call the police. What he didn't know: Krebs was on his forum, reading the plan in real time, and had already briefed the cops. The frame-up failed, the keylogger he'd planted on his own fiancée's computer helped unmask him, and the menace ended his run writing apology letters from the worst prison in Italy. Signed, "With Best Regrads, From Fly!"
After watching movies and reading books about hackers, I really wanted to become a sort of virtual bandit who robs banks without leaving home.
Sergei Vovnenko, on how he chose the life — from the post-prison interview excerpted by the man he tried to frame
- WHO
- Sergei Vovnenko — "Fly," "Flycracker," "MUXACC1," "Centurion"; b. ~1988, Ukrainian national, then living in Naples, Italy FACT
- SCENE
- Founder-administrator of thecc[dot]bz, an exclusive Russian-language financial-fraud forum; trusted moderator on the venerable carding forum Mazafaka
- THE DRAMA
- A 2013 vendetta against journalist Brian Krebs: severed-head art, a published credit report — and a crowdfunded plot to mail heroin to Krebs's home and frame him for possession, foiled because Krebs was reading the plot on Fly's own forum
- RECORD
- Pleaded guilty (2016) to aggravated identity theft and conspiracy to commit wire fraud — a 13,000-machine botnet harvesting card data. Sentenced Feb 2017 to 41 months, 3 years' supervised release, $83,368 restitution. The heroin plot itself was never a charge FACT
- STATUS
- SERVED & DEPORTED — did his time, was deported, gave one interview, and reached an odd détente with his target
Brian Krebs has been swatted, doxed, credit-bombed, and mailed things no journalist should have to sign for — a running series in which Fly is the most theatrical installment (Mir Islam's swatting crew and the vDOS and Mirai DDoS kids are other episodes in the same thread). This file is the ego-and-comeuppance one: a forum boss who cosplayed menace at a reporter, narrated the whole plot on a board the reporter had already infiltrated, and unmasked himself with his own spyware. Every beat below is from Krebs's contemporaneous reporting and the federal court record.
the drama timeline
ACT I — THE FORUM BOSS (2000s–2012)
A drifting kid in Naples teaches himself to code, decides crime is his vocation, and builds a fraud empire with a boss's throne.
-
MID-2000s
Naples, by way of the den
By his own telling, Vovnenko settles with his mother in Naples, can't hold a job, and ends up as lookout at a wine shop that is actually a hash-and-crack outlet. He saves for a computer, teaches himself to program, writes an SMS bomber, and gets his first 2,000 euros from a fraudster who found it useful. He decides "virtual bandit" is the career.
-
2010–12
The botnet years
Per federal prosecutors, from September 2010 through August 2012 Vovnenko and co-conspirators run an international operation that hacks individuals and companies, harvesting usernames, passwords, and payment-card data with a botnet of more than 13,000 infected computers. He rises to admin of thecc[dot]bz — an invitation-only Russian-language fraud forum where, as Krebs put it, the scene's heavy-hitters ran a soup-to-nuts network for turning stolen card data into cash.
ACT II — THE VENDETTA (2013)
Fly declares war on a reporter. The reporter is already inside his forum, taking notes.
-
2013
Severed-head season
Fly's accounts begin sending Krebs profane, taunting tweets. A blog post leads with a photoshopped image of Krebs's bloodied, severed head; his Twitter avatar becomes an action figure holding it up. Fly posts Krebs's credit report, identification documents, directions to his house, and photos of his front door, inviting his forum to ruin Krebs's financial identity — and his family's.
-
JUL 14, 2013
The "Krebs Fund"
Fly opens a forum thread soliciting bitcoin for a plan: buy heroin on the Silk Road, have it mailed to Krebs's Virginia home, then spoof a call to police from a "neighbor" reporting drugs being sold out of the house. His pitch to the members: "It became known recently that Brian Krebs is a heroin addict and he desperately needs the smack... let's join forces to help the guy!" The forum kicks in roughly two bitcoins. What Fly doesn't know: Krebs has been quietly given access to the forum and is reading the thread — tracking number included — as it unfolds.
-
JUL 29, 2013
The delivery that framed nobody
Krebs alerts the FBI and has a Fairfax County police officer take a report before the package ships. When thirteen packets of nearly pure heroin arrive taped to the back of a Chicago lifestyle magazine, Krebs hands them straight to the police and writes the whole caper up. The frame-up is dead on arrival — pre-empted by its own target.
-
SUMMER 2013
Flowers for the funeral that wasn't
Furious at being humiliated in front of the donors, Fly has a local florist deliver a gaudy floral arrangement in the shape of a giant cross to the Krebs home, with a menacing message addressed to Krebs's wife, signed "Velvet Crabs." Menace as theater — and another receipt for the file.
ACT III — THE FALL (2014–2017)
The man who doxed a journalist is undone by his own spyware, and starts sending his victim Christmas cards from an Italian prison.
-
2013–14
Unmasked by his own keylogger
Krebs, now intensely curious who Fly is, mines hacked-forum databases with help from researchers. The break: Fly had planted a keylogger on his own fiancée's computer, forwarding her email to an account whose password he reused on a forum that got hacked. Her wedding-planning messages — full names, shipping addresses — put "28-year-old Sergei Vovnenko" and family in Naples. The paranoid surveillance he aimed at his bride identified him.
-
JUN 13, 2014
"The Fly has been swatted"
After a joint U.S.-Italian investigation led by the Secret Service, Vovnenko is arrested in Naples — reportedly carrying identity documents under an assumed name. A U.S. law-enforcement source phones Krebs with the headline: "The Fly has been swatted."
-
JUL–DEC 2014
Pen pals, involuntarily
From Poggioreale prison in Naples — which Vovnenko calls "the worst prison in Italy" — he writes Krebs three times: a handwritten letter Krebs describes as a deeply personal, apparently heartfelt apology for the heroin, the credit report, and the terrorizing of his family (in which Fly also announces that he forgives Krebs for doxing him), then two friendly postcards. One reads: "Happy New Year! And Merry Christmas! With Best Regrads [sic], From Fly!" Krebs has the first letter tested for dangerous substances before touching it. Fair, given the mail history.
-
OCT 13, 2015
Extradited
After contesting extradition for some 15 months, Vovnenko loses and lands in a Newark federal courtroom, charged over the botnet, the stolen card data, and the emptied bank accounts. If convicted on everything, he faces up to 30 years.
-
2016–FEB 2017
Plea and sentence
Vovnenko pleads guilty to aggravated identity theft and conspiracy to commit wire fraud. On February 16, 2017, U.S. District Judge Esther Salas in Newark sentences him to 41 months, three years' supervised release, and $83,368 restitution. The charges are the botnet and the fraud — the heroin plot was never prosecuted; it just made him famous enough to catch.
ACT IV — THE DÉTENTE (2019–)
Time served, deported, and one last exchange: the villain gives an interview, and the target publishes it.
-
SEP 25, 2019
The interview
After serving his 41 months and being deported, Vovnenko gives his first interview, on a Russian-language security blog (translated by Flashpoint, excerpted by Krebs). Asked about the packages sent to Krebs, he shrugs it onto the membership: "That ain't me... Forty or so guys would send. By the way, Krebs wanted to see me. But the lawyer suggested this was a bad idea. Maybe he wanted to look into my eyes." He talks prison food, mulls going back to school — maybe in information security. Krebs, who never got his face-to-face, closes with a mock letter wishing his old pen pal well.
both sides, on the record
The record: a federal guilty plea to aggravated identity theft and wire-fraud conspiracy, a 13,000-machine botnet harvesting card data, and a court-ordered $83,368 in restitution. The harassment campaign is documented beat by beat in contemporaneous reporting: the severed-head image, the published credit report, the "Krebs Fund" thread Fly opened himself, the tracking number posted to his own forum, the cross-shaped flowers addressed to the target's wife.
The plot wasn't alleged after the fact — it was watched live. Krebs read the plan on Fly's forum as it formed, filed a police report before the package arrived, and handed the heroin to officers on delivery. There is no version of this story where the frame-up was someone else's idea.
He says the packages weren't him: in his one interview, Vovnenko insists the mailed harassment came from forum members — "forty or so guys would send" — not his own hands [7].
He was never charged over the plot: the conviction is for the botnet and fraud conspiracy. The heroin scheme, however well documented, was not among the counts [5].
He apologized — apparently sincerely: from Italian prison he sent Krebs a handwritten apology Krebs himself called deeply personal and heartfelt, plus friendly postcards; after release he said he was considering school and even information security as a study. The target, notably, wished him luck [3] [7].
YOU DECIDE
The fraud is adjudicated; he pleaded to it and did the time. The vendetta is documented from inside his own forum, in his own posts, in real time, by the man it targeted. What remains open is only how much of the menace was ever real: the severed head was photoshop, the frame-up died before delivery, the funeral flowers were the closest he got to a body — and the campaign ended in apology letters and holiday postcards to the victim. He cosplayed a killer at a reporter, and the reporter out-reported him.
The archive does not gloat. The archive keeps the tracking number, the docket — and the Christmas card.
evidence locker
PRIMARY / CONTEMPORANEOUS REPORTING
COURT RECORD
U.S. Dept. of Justice, District of New Jersey — sentencing release (Feb 2017) FACT — 41 months, Judge Esther Salas, Newark; the 13,000-computer botnet, Sept 2010–Aug 2012 conspiracy; aliases including "Fly," "Flycracker," and "Centurion"; the June 13, 2014 arrest and contested extradition.
justice.gov/usao-nj/pr/ukrainian-citizen-sentenced-41-months-prison...
FIRST-PARTY & CROSS-LINKS
troll.fan — The Timeline CROSS-LINK — where the 2013–2017 Krebs-vendetta beats sit in the scene's larger chronology.
troll.fan/timeline.html troll.fan — Crew Rivalries CROSS-LINK — the scene's feuds and vendettas; Fly's one-man war on a reporter belongs to the same tradition, minus the crew.
troll.fan/crew-rivalries.html
The standard. Sergei Vovnenko's conviction, sentence, and restitution are federal court record; the harassment campaign and heroin plot are documented in Brian Krebs's contemporaneous reporting, written while the plot was underway on Vovnenko's own forum. The conviction was for the botnet and fraud conspiracy, not the plot, and that distinction is stated plainly. His denial that he personally mailed anything, and his apology, are carried at full strength in his own words. No motive beyond the record is asserted, and no operational detail of the dark-web purchase is reproduced — only that it happened, and failed. If a line here couldn't survive scrutiny, it wouldn't be on the page.