An investigation by Jan Drömer, independent researcher,
and Dirk Kollberg, SophosLabs.
With a picture of Svyatoslav P. and his wife from the vkontake.ru photo albums, it was possible to identify them on pictures as having participated in the AWM (Adult Web-Master) Open 2009 conference in Cyprus.
The website “FUBAR Webmaster” contains archived photo sets from various adult industry events on which the couple was identified.
Svyatoslav P. was pictured using the nickname “PsycoMan” on his badge.
The porn industry, especially in Russia, is a frequently appearing linkpin when investigating cybercrime, as suspects are often found to be involved in the “adult entertainment” business.
There are likely several reasons for this, and it should by no means imply that the adult webmaster scene as a whole is involved in malicious activities.
As it is highly unlikely that cybercriminals start their criminal careers just out of the box, a more commonly observed pattern is individuals entering and getting involved in the internet porn industry, getting to know affiliate models, traffic trading, etc.
The somewhat shady nature of the scene, and the criminals’ desire to make even more money fast, might be what makes some slowly cross the line and get involved in more malicious activities.
Additionally one should not forget that trust is equally important to the underground market as it is in legitimate business. Several porn industry events throughout the year are providing an excellent platform to establish such trust and business relationships in person, which might be another reason that the porn industry repeatedly shows up during the investigation of cybercriminals.Follow @SophosLabs