The fight for the drug market in the Russian darknet

The drug market in the Russian darknet has become a battleground, resembling a cyber war, ever since the closure of Hydra, the largest seller, in April 2022. In a major crackdown, German authorities have successfully shut down the server infrastructure of Hydra Market, the largest Russian-language darknet marketplace in the world. The Federal Criminal Police Department of Germany confirmed this significant operation, revealing that bitcoins worth approximately 23 million euros have been seized during the raid, directly linked to the activities of the trading platform.

The operators and administrators of Hydra Market are now facing a preliminary investigation, suspected of engaging in commercial activities related to criminal internet marketplaces, facilitating illegal drug trafficking, and participating in money laundering. These grave allegations against them have prompted a serious probe into their activities.

The actions leading to the takedown of Hydra Market were the result of extensive and wide-ranging investigations conducted jointly by the German Federal Criminal Police and the Frankfurt prosecutor's office. These investigations, which began in August 2021, involved collaboration with authorities from the United States. The scale of these joint efforts demonstrates the commitment to combatting illegal activities within the darknet.

Hydra Market, a Russian-language illicit trading platform accessible since 2015, had amassed an enormous user base of approximately 17 million users and boasted over 19,000 registered merchants. Notorious for facilitating the trade of drugs, stolen data, counterfeit documents, and digital services, Hydra Market had gained a notorious reputation within the criminal underground.

The German Federal Criminal Police estimated that Hydra Market was likely the world's busiest illegal marketplace. In 2020 alone, its sales reached a staggering figure of at least 1.23 billion euros, highlighting the scale and magnitude of its illicit operations. With this groundbreaking operation, German authorities strike a significant blow to the darknet's illegal activities, signaling a strong message against criminal marketplaces and the perpetrators involved. The international collaboration showcased in this operation demonstrates the determination to dismantle and disrupt illegal activities within the cyber realm.

The conflict primarily takes the form of reciprocal cyberattacks between websites and an aggressive advertising campaign. As a significant development, the servers of Hydra, the prominent Russian darknet drug market, were shut down in Germany. This action sparked a fierce competition among Russian darknet markets to claim the position of market leader as they engaged in cyberattacks against each other and flooded the streets of Moscow with aggressive advertisements.

In July 2022, both Kraken and Solaris, two leading marketplaces, warned their telegram channel subscribers to withdraw their cryptocurrency from the rival site RuTor. Shortly after, RuTor suffered a cyberattack, leading to its temporary shutdown. RuTor eventually recovered and retaliated by launching a cyberattack against the WayAway site, exposing screenshots of the breach and casting doubt on WayAway's security capabilities. This back-and-forth escalation continued throughout the fall of 2022.

During this intense period, an advertisement for Kraken made headlines when it appeared on an advertising cube in Moscow City,

causing a significant scandal within society. In October, the Solaris darknet marketplace, in association with the Russian hacker group Killnet, targeted Kraken, RuTor, Mega, BlackSprut, and other competitors. Interestingly, the money stolen from drug shops financed Killnet's support of the Russian army during the invasion of Ukraine.

December of the same year brought about further chaos when a bus covered in logos and a QR code from the Kraken darknet site obstructed traffic on Moscow's Arbat for several hours. Notably, a Moldovan streamer and TikToker named Nekoglai unknowingly promoted the Mega marketplace during a livestream by wearing a T-shirt with the Mega logo. Although he denied any involvement in advertising, his actions raised awareness of the market.

In January 2023, a mysterious YouTube channel named "Moriarty" emerged.

The channel featured an unknown man clad in a black suit and mask, who proclaimed himself as the creator of the Mega darknet market. He openly discussed drug cartels and vigorously advertised his site. Simultaneously, advertisements for the Mega site started appearing in the Moscow metro, enticing users with a QR code leading to the marketplace.

During the same month, the WayAway forum hacking team successfully breached the Solaris platform and merged it with Kraken. This integration resulted in the Solaris Darknet Marketplace site automatically redirecting users to Kraken, cementing their partnership. Additionally, in mid-January, personal android applications for various darknet markets emerged on Google Play. Although eventually removed, the sites resorted to sharing APK files for downloading the applications via their telegram channels and websites.

By February 2023, electronic billboards in Moscow showcased advertisements for the BlackSprut site. These eye-catching displays featured a woman wearing a futuristic mask, accompanied by the inviting text: "Come to me in search of the best." The intense competition among darknet marketplaces continued, with each entity employing various tactics to gain an advantage in attracting users and maintaining their position in the market.