FBI Cracks Down on Dark Web Marketplace Managed by Russian and Kazakh Nationals

Two individuals have been charged in the U.S. for their alleged role in maintaining a dark web marketplace called WWH Club that specialized in the selling of sensitive personal and financial information.

Alex Khodyrev, a 35-year-old Kazakhstan citizen, and Pavel Kublitskii, a 37-year-old Russian national, have been charged with conspiracy to conduct access device fraud and conspiracy to commit wire fraud.

Khodyrev and Kublitskii, between 2014 and 2024, acted as the main administrators of WWH Club (wwh-club[.]ws) and various other sister sites – wwh-club[.]net, center-club[.]pw, opencard[.]pw, skynetzone[.]org – that functioned as dark web marketplaces, forums, and training centers to enable cybercrime.

The indictment follows an investigation launched by the U.S. Federal Bureau of Investigation (FBI) in July 2020 after determining that WWH Club's primary domain (www-club[.]ws]) resolved to an IP address belonging to DigitalOcean, allowing them to issue a federal search warrant to the infrastructure company.

"WWH Club and sister site members used the marketplaces to buy and sell stolen personal identifying information (PII), credit card and bank account information, and computer passwords, among other sensitive information," the U.S. Department of Justice (DoJ) stated.

The forums, on the other hand, functioned as a hotspot for debates on best practices for perpetrating fraud, conducting cyber assaults, and dodging law authorities.

Furthermore, the darknet marketplace provided online training for aspiring and existing cyber thieves on how to perpetrate scams. The claimed cost of the course varied from 10,000 rubles to 60,000 rubles (approximately $110 to $664 as of September 7, 2024) plus an extra $200 for training supplies.

Court documents show that undercover FBI agents signed up for the site and paid approximately $1,000 in bitcoin to attend a training course offered by the platform that included topics such as the sale of sensitive information, DDoS and hacking services, credit card skimmers, and brute-force programs.

"The training was conducted through a chat function on the forum to a class of approximately 50 students; the various instructors provided training in text format rather than audible instruction," the criminal complaint states. "It was apparent the purpose of the training was to educate individuals on how to obtain and use stolen credit card data and PII to generate fraudulent proceeds."

WWH Club is predicted to have had 353,000 subscribers globally end of March 2023, up from 170,000 registered users in July 2020. Both Khodyrev and Kublitskii are alleged to have benefitted from the membership fees, tuition costs, and advertising money.

Flashpoint, in a report released last month, stated WWH Club remained active despite the law enforcement activity, and that "its other administrators are attempting to distance themselves from Kublitskii and Khodyrev."

Khodyrev and Kublitskii "had been living in Miami for the past two years, while secretly continuing to administer WWH Club and its sister dark web marketplaces, forums, and schools," the DoJ claimed.

If convicted on all charges, they may each face up to 20 years in federal prison. The indictment also requests the confiscation of Khodyrev's 2023 Mercedes-Benz G63 AMG sport utility vehicle and Kublitskii's 2020 Cadillac CT5 Sport car, which are believed to have been acquired using revenues from their illegal activity.