The Ghost in the Market: Unmasking “Fly,” the Secret Architect of the Infamous Russian Market

According to Intrinsec, the investigation into the Russian Market links its infrastructure to a persistent threat actor known as “Fly,” also known as “Flyded,” who was instrumental in the marketplace’s early promotion and has maintained a decade-long presence on cybercrime forums and Telegram channels. The report notes that the platform has persisted since 2014, with the marketplace reportedly moving around 60,000 units per week at its peak, and that leadership had remained a ghost until now.

For the historical trail, researchers queried Whois records for domains such as flyded[.]com and russianmarket[.]gs, uncovering email addresses TimeToHardWork[@]outlook[.]com and Verybigman[@]yahoo[.]com, which in turn connected to various data leaks and accounts tied to the operation.

A 2015 malware sample named SystemInfoUtility.exe was linked to these mail addresses, described as a prototype infostealer intended to harvest system information and enable multiple RDP sessions, with a possible real-world identity to include “Alex Aske.” On the financial side, on-chain analysis linked a wallet associated with Fly to payments from the marketplace, with funds reportedly washed through illegal mixing services like Bitzlato and non-KYC exchanges.