U.S. v. Kirill Victorovich Firsov (Deer.io Dark Web Shop)
Key Facts
- Legal Status: SENTENCED in U.S. District Court for the Southern District of California.
- Primary Target Sector: Consumer Services, E-Commerce, Identity Providers.
- Documented Financial Loss: $17.0 million.
- 1 verified MITRE ATT&CK techniques substantiated with verbatim court excerpts.
Incident Overview
Russian administrator of Deer.io, a decentralized cyber storefront platform hosting over 24,000 active automated shops selling hacked accounts, corporate credentials, and identity documents.
Root Cause & Infiltration Vector
Initial access established against Consumer Services, E-Commerce, Identity Providers infrastructure via compromised credentials, unmonitored perimeter services, or targeted spearphishing lures. Russian administrator of Deer.io, a decentralized cyber storefront platform hosting over 24,000 active automated shops selling hacked accounts, corporate credentials, and identity documents.
Operational Impact & Financial Blast Radius
Resulted in $17,000,000 in documented financial liabilities. Deer.io stores generated at least $17 million in cryptocurrency sales of stolen accounts.
Executive Risk Checklist
- 1. Are 100% of external and administrative access portals protected by phishing-resistant MFA?
- 2. Is network microsegmentation enforced between user workstations and core database enclaves?
- 3. Have immutable offline backups and incident escalation procedures been validated within 90 days?
Incident Execution & Kill-Chain Lifecycle
Sequential reconstruction of intrusion stages from initial infiltration to resolution.
Deer.io functioned as an automated turn-key storefront allowing hackers to upload and sell stolen user account databases in bulk.
Adversaries navigated internal subnets, elevating system permissions and harvesting credentials to expand administrative access across Consumer Services, E-Commerce, Identity Providers infrastructure.
Russian administrator of Deer.io, a decentralized cyber storefront platform hosting over 24,000 active automated shops selling hacked accounts, corporate credentials, and identity documents.
Standard of Care Remediation & Hardening
Empirical engineering takeaways and preventative controls derived from this incident.
Procedural & Incident Timeline
Firsov arrested by FBI agents at New York's John F. Kennedy International Airport.
Pleads guilty to trafficking in unauthorized access devices.
Sentenced to 30 months in federal prison.
Named Defendants & Operatives
| Defendant | Nationality | Status | Prison Term | Restitution | Notes |
|---|---|---|---|---|---|
| Kirill Victorovich Firsov | Russian Federation | sentenced | 30 mo | None | Administrator of Deer.io cybercrime marketplace; sentenced to 30 months. |
Substantiated MITRE ATT&CK Techniques
| Technique ID | Technique Name & Tactic | Primary Source Evidence Excerpt | Locator | Verification |
|---|---|---|---|---|
| T1078 | Valid Accounts Defense Evasion | "Deer.io functioned as an automated turn-key storefront allowing hackers to upload and sell stolen user account databases in bulk." | Indictment ¶ 8, Page 4 | reviewed |