A Russian spammer suspected of maintaining the infamous Rustock spam botnet earned millions of dollars blasting junk email for counterfeit Internet pharmacies. Those ill-gotten riches let him buy flashy sports cars, but new information suggests that this attracted the attention of common street thugs who targeted and ultimately mugged the spammer, stealing two of his prized rides.
In March, I published a story linking the Rustock botnet to a spammer who used the nickname Cosma2k. This individual was consistently one of the top five moneymakers for SpamIt, which, until its closure last fall, paid spammers millions of dollars a year and was the world’s largest distributor of junk mail.
Earlier this month, someone leaked thousands of online chat logs taken from Dmitry “SaintD” Stupin, a Russian who allegedly ran the day-to-day operations of SpamIt. Those records include numerous chat conversations allegedly between Stupin and a SpamIt affiliate named Cosma.
In several chats, Cosma muses on what he should do with tens of thousands of compromised but otherwise idle PCs under his control. Throughout the discussions between Stupin and Cosma, it is clear Cosma had access to internal SpamIt resources that other spammers did not, and that he had at least some say in the direction of the business.
In one conversation, dated Oct. 14, 2008, Cosma allegedly tells Stupin that he’s dialed back his public image a few notches, after attracting unwanted attention from other crooks. The conversation below, translated from Russian into English, begins with a request from Cosma to withdraw funds from a SpamIt operating account.
Cosma: Hey. May I withdraw some money from the account?
Stupin: Surely you may.
Stupin: Sorry, I was picking up my car from the service shop.
Cosma: What got broken?
Stupin: Someone threw a stone, when the car was parked near home.
Cosma: Damn. What kind of car?
Cosma: Fond of safety?
Stupin: Yes, and I am at ease when I am driving it. It’s a huge difference after Honda
Cosma: I also had enough of expensive rigs. =) They are getting stolen all the time and everyone is looking at you, estimating the score, and then rob you =) I have had such experience =)
Cosma: I am driving BMW 530Xi.
Cosma: A calm car. Not glaring. It only has a 3 liter engine with 272 HP. I used to have BMW 650, then after that a turbo-charged [Porsche] Cayenne. Much faster cars.
Stupin: ааh, it’s understandable now what you meant by “calm”; ))))
Cosma: Cayenne was stolen in 1.5 month after it was bought and I was robbed because of the 650 =). So to hell with them. It’s better when it’s not flashy.
Stupin: Damn! How unlucky!!!
Cosma: Horrible experience: I was gagged, tied up… badly beaten.. uhhh… I am shivering from those memories =) I gave them everything. Life is more precious =)
Cosma: It looks like pharmacy is moving forward slowly but surely =)
Stupin: Sure, what else can happen to it
Cosma: Last time something else had happened =)
Microsoft has offered a $250,000 reward for information leading to the arrest and conviction of the Rustock author(s). On Aug. 5, Microsoft filed an update (PDF) to its legal case to unearth the identity of the Rustock botnet author. That document contains many clues as to who might be responsible for the once-mighty botnet. But one thing seems clear: If Cosma really was in control of Rustock, the world now knows the makes and models of three of the cars that he has owned.