On the evening of December 19, a black bus decorated with white tentacles blocked two lanes on Kutuzovsky Prospekt in Moscow, near the White House. The bus had the Kraken marketplace logo on its body and a QR code leading to its website.

This is the main "government highway" that Putin uses to travel to the Kremlin from his residence in Novo-Ogarevo.

The bus was driven to the track by three young men aged 18-19. None of them had a driver's license. They parked the bus across the road, took the ignition keys, scattered lit firecrackers around the bus, and ran away. The bus with the "drug propaganda" stood in the very center of the capital for about 20 minutes, according to our data, the guys were promised 800 thousand rubles for three for this action. Now they are waiting for the trial: all are charged with Article 267 of the Criminal Code ("rendering vehicles or means of communication unusable").

In April 2022, German police raided the server room where Hydra, the then-monopoly of the Russian drug market and the largest darknet marketplace in the world in terms of cryptocurrency revenue, stored its data. German security forces had known about the Hydra servers for more than a year. They were forced to act in April when bank sanctions prevented them from processing another payment from a Russian card, and the hosting provider threatened to shut down the servers. The search was conducted before the Hydra administrators had time to transfer the data.

Hydra's websites never went live. In the following months, the Russian dark web was embroiled in its own war. The main prize was the vacant position of the deceased monopoly. In 2020 alone, Hydra's crypto wallets processed \$1.37 billion, making it a significant contender.

Similar to regular marketplaces (such as Ozon or Wildberries), darknet marketplaces are online shopping sites that sell third-party products. Hydra and all the marketplaces that aspire to replace it are the same online commerce sites, but instead of selling regular products, they sell drugs. The sellers are the stores, each with its own name and branding. Thousands of such stores were registered on Hydra.

The Kraken is still available via links in both the public area and the Tor browser:

slon2.kr

kraken2tfbggpw6zlkpytr7obsnhlmjl6tw5mz7nkw2xvgro6lpnhhid.onion

The marketplace acts as a conduit for their products — it connects with customers through its website, provides all the infrastructure for sales. Often, such stores buy goods for sale directly on the marketplace from wholesale suppliers. In this case, marketplaces receive money from commissions at all levels of the drug trade.

Drugs (from retail to wholesale) are sold using bookmark caches. Payment is in cryptocurrency, it is converted by exchangers — often individual players in the drug market, as well as stores.

Another part of the Russian drug trade structure is forums where market participants and buyers communicate. These sites can earn money from advertising (for example, on the Rutor forum, users are greeted by a huge wall of advertisements, ranging from drugs to cryptocurrency cash-outs). Hydra had its own forum (not counting the separate LegalRC forum controlled by the same team), where dealers communicated in a private section, consumers chatted in the open section, contests were held, and addiction specialists were employed by the platform.

Currently, there is no main forum or main marketplace on the Russian dark web. Users and stores are spread across various websites, and it is often necessary to use multiple resources to conduct business, for example, the Godnotaba darknet link aggregator

The interim result of the market redivision is a boom in street advertising of drugs. If earlier it was reduced to sloppy inscriptions “salt” and “spice” with a spray can on fences or stencils on the asphalt with an offer to work as a drug courier, now the name Kraken was even on a chic four-sided advertising cube in Moscow-City. And after all, Kraken is only one of the contenders for the title of the main marketplace with drugs in Russia.

Our analysis showed that after the closure of Hydra, four new marketplaces were advertised at least 13 times on the streets of Moscow, St. Petersburg, and Krasnodar. Over the course of a year, Russians saw a huge banner with firecrackers on the balcony of a high-rise building, branded vehicles, and billboards with video ads.

This is not counting the endless graffiti, stickers with QR codes, and two individuals with tattoos linking to dark web markets.

«It need a hype»

The Russian darknet has changed a lot. In 2014, the administrator of RAMP, Russia's leading darknet drug marketplace at the time, avoided giving interviews to Russian journalists to avoid attracting the attention of law enforcement agencies (although he did speak with the American magazine Wired). During the time of the successor site, Hydra, individual administrators could be pulled into personal correspondence. The administration of this site was not afraid of publicity: Hydra began its operations with a mass WhatsApp message, and later even organized its own YouTube ads.

Hydra was such a recognizable brand in Russia that the name of the platform became a household name. Therefore, new market participants had to invest in promotion.

Now, drug markets have their own PR departments, and conversations with the administration turn into communication with the press service, almost according to the rules of corporate correspondence (a representative of one of the markets even admitted that he still needed to coordinate the responses, but he never sent them). In 2022, accessibility became more important than security — now all marketplaces have websites not only on the dark web, but also on the internet, and all you need to log in is a VPN.

“If selling ads on the channel used to be a celebration, it became impossible to buy ads after Hydra collapsed. Everyone had their ads bought out for the next month,” says the administrator of one of the channels. Often, the ads on these channels are not even individual posts, but rather hyperlinks under news or memes.

"Hydra was promoted [on Telegram] only for the first few months after its launch, and while it was active, most of the ads were purchased by stores," the administrator of another grid wrote in a voice message on Telegram. "At that time, stores usually included a link in their ads that led to their monopoly website. Everyone who is currently involved in the PAV industry (here — Telegram channels about psychoactive substances. — Editor's note) is moving forward and earning very good money. Many admins have already bought apartments, not in Moscow, of course, but it's a sign." According to him, a channel with 15,000 subscribers can earn half a million rubles per month from advertising for marketplaces and stores.

One of the interviewees provides a detailed account of how the advertising market was reshaped by the RuTor darknet forum in the spring:

— They offered ten times more than the market. For example, a channel earns 200,000 rubles per month. Its administrators are offered two million, without even discussing the number of posts. You publish them whenever RuTor wants. You become a slave. It's a questionable partnership, but the money is insane, and many people agreed.

Soon, the money began to flow outside the closed segment of thematic channels: ads appeared on Instagram, Yandex pages, and video hosting services. Major Telegram channels with bloggers also joined in.

Perhaps the most notable of these is the TikToker Nekoglay. After being beaten in a police department and deported from Russia, he appeared on a stream wearing a T-shirt with the Mega marketplace logo.

Now this marketplace is the leader in YouTube promotion. There, Mega has more than 415,000 subscribers and more than thirty-five million views. In addition to the identity, there is no direct advertising of drugs or links to the darknet mirrors of the site in the video — perhaps that is why the channel is blocked only for users from Russia.

In the videos, an actor wearing a recognizable black skull mask plays Moriarty, a character who represents the administrator of the marketplace. He criticizes the former monopoly, reads letters from viewers, and even addresses Ekaterina Mizulina. In early December, the senator's daughter and the head of the Safe Internet League published a selection of bloggers and Telegram channels promoting marketplaces and drug stores.

During the preparation of this text, even a correspondent from Novaya-Europa was tried to involve in the promotion of marketplaces. So, the PR specialist of one of the platforms suggested that the newspaper's YouTube channel should feature investigative videos about the drug market:

— Our benefit is from the mentions. Even if it's about drug dealers, death dealers, and so on, we need to generate hype. Your benefit is the promotion of your publication, and we will make efforts to promote the videos and allocate budgets for top-notch productions.

He estimated the budget for shooting one video and its promotion at two million rubles.

Russia Today, the Ukrainian trace and the drugstore-patriot

On October 9, RT published an interview with the “founder of the Killnet hacker group” under the nickname Killmilk. Since the beginning of the war, these hacktivists have regularly carried out DDoS attacks (in simple terms, they overload websites so that it is impossible to access them) against “enemies of Russia.” For example, in January, they took down the websites of hospitals in the Netherlands and the United States. Killnet has denied any connection with Russian security forces. In their Telegram channels, they regularly collect donations for their work and money for equipment for the Russian army.

Killnet appeared on the dark web shortly before the war, selling DDoS attacks on Russian-language forums. The group is now regularly mentioned in the news by Russian news agencies. This is not surprising, as experts note that Killnet is more interested in publicity. It is hard to imagine that a DDoS attack on the White House website, which was only unavailable for half an hour, actually caused any harm, but the news headline about a Russian hacker attack is convincing.

The RT interview would not have been unexpected if it hadn't been for the sudden mention of the Solaris marketplace - Killmilk thanked them for their support and referred to them as "friends," but he didn't mention that his comrades were involved in drug trafficking. In the same month, Solaris sent Killnet approximately \$50,000 in cryptocurrency, but the details of the collaboration between the hackers and the drug dealers remain unknown..

In the spring, this forum became a center of attraction on the dark web, when, after the closure of Hydra, the administrators of drug stores suddenly lost contact with their employees. They were looking for each other on RuTor, which was once one of the main resources on the Russian dark web, but has lost its importance over the years. Soon, the forum changed ownership and began to gain popularity again. The new owner is likely to be associated with the OMG marketplace, which was one of the first to enter the free market.

RuTor and OMG threatened to become a new monopoly, so they were almost immediately subjected to a powerful information attack by their competitors. In paid articles on specialized Telegram channels, the forum owners were accused of working with Russian intelligence agencies. In the summer, competing marketplaces began accusing RuTor of working with the Security Service of Ukraine.

Under the same pretext, Killnet hackers declared war on the forum in August, and through them, information about RuTor's ties to Ukrainian security forces was leaked to Russian media outlets (such as Tsargrad). Killnet still occasionally expresses its opposition to RuTor and occasionally to other participants in the drug market..

Drug traffickers have adopted the narrative about the Ukrainian special services from the propagandists. In early June, RIA Novosti released a special project about how the SBU supplies synthetics to Russia. One of the articles in the series is titled "Drowning Russians in Drugs," and the journalists even created an infographic showing where the SBU's handlers are located in the distribution chain. This was followed by a statement from Zakharova, the spokesperson for the Russian Ministry of Foreign Affairs.

Both the drug markets and the hackers were talking about the same story at the same time: the KhimProm cartel. In the dark web, this group was linked to RuTor and OMG back in the spring. It wasn't until the official press referred to the drug cartel as part of a hybrid war against Russia that the connection with the SBU was mentioned. Initially, KhimProm was the username of a wholesale synthetic drug supplier on the dark web, active since 2014. It turned out to be a drug cartel that operated throughout Russia until 2016.

Of the 67 people detained in this case in Russia, 47 were Ukrainian citizens. This fall, the members of the group were sentenced to up to 20 years in prison. According to the Ministry of Internal Affairs, the three dismantled laboratories of KhimProm produced between 150 and 500 kilograms of synthetic drugs each week. The drugs were synthesized by Ukrainians who had come to Russia to work. Old job ads for chemists with a trip to Russia can still be found on Ukrainian darknet forums.

Only Khimprom also worked on the territory of Ukraine — the SBU reported on the last raid against the drug cartel in 2020. Ukrainian security officials say that the main members of the group are Russian citizens. There is no concrete evidence of the SBU's connection with Khimprom, and even the pro-government Russian portal Life calls the head of the drug cartel a citizen of the Russian Federation (although it still accuses him of collaborating with the SBU).

In fact, Russians themselves can "drown" their country in drugs, as evidenced by the wartime prices.

The Salt of the Russian Land

In the year since the start of the war, drug prices in Russia have remained virtually unchanged. This was reported to us by two organizers of drug stores, and the same conclusion was reached by economist and PhD student at the University of Pennsylvania, Artem Kuriksha, who studies darknet marketplaces. He compares current prices with data collected from Hydra:

“Since 2021, there has been no significant change in prices that cannot be attributed to inflation and fluctuations in the ruble exchange rate,” says Kuriksha..

The fact is that the most popular substances on the Russian darknet — stimulants such as amphetamine and alpha-PVP (commonly known as “salt”), and the euphoric drug mephedrone — are mass-produced in underground laboratories across Russia. They have been synthesized from Chinese reagents for many years, so the majority of the Russian drug market is not affected by sanctions.

If you try hard enough, you can still find a gram of mephedrone in Moscow for up to 2,500 rubles (not including cryptocurrency purchase fees).

Only drugs imported from the European Union were affected: prices for LSD and MDMA rose, according to the organizer of a store that operates in Moscow and St. Petersburg. "Prices for cocaine did not increase, as almost everything is shipped by sea," he added. The owner of another store reported that wholesale prices for hashish actually decreased in July, when the euro approached 50 rubles.

Moreover, for some, the war has become an opportunity to expand their sphere of influence. In September, we wrote about two stores from the “people's republics of the LDNR” that started operating in the occupied cities of Mariupol and Kherson (the separatist drug dealers left Kherson with the Russian army).

The centers of Russian emigration are no exception. For example, a Russian drug store operating at the federal level has been selling amphetamines and mephedrone in Armenia since the summer, at the same prices as in major Russian cities (and sometimes even cheaper). The store's bot regularly posts deals in every major city in Armenia, and they are quickly sold out.

The Russians are engaging in price dumping, sometimes offering prices that are more than twice as low as those offered by Yerevan-based pushers.

Is Hydra coming back?

The Kraken marketplace, whose advertising bus blocked Kutuzovsky Prospekt, positions itself as a successor to Hydra. Even the marketplace's logo intentionally references the Hydra logo.

This marketplace only opened in December: they were late to the market redivision, but they were heating up interest in themselves all year. First, with the help of the turbo.me file-sharing service, which was linked to Hydra, the entire anonymous internet was following the loading bar that heralded the launch of the new marketplace. Later, the same team opened the Wayaway forum, which was one of the forums that Hydra's administrators had previously launched.

It is unknown whether Kraken is really connected to Hydra, but many former Hydra moderators have at least switched to the new resource. In the user list, you can even find an online addiction specialist who has been working for Hydra since 2019.

The Wayaway and Kraken team quickly joined the cyber wars: in July, together with Solaris, they temporarily took down the RuTor forum. Now the balance of power is completely different: Kraken is playing against everyone. Mega, BlackSprut, and even the once-allied Solaris have imposed a ban on double listings with Kraken, clearly fearing a new player in the market.

This means that these three marketplaces are forcing stores to choose a side: either they sell their products on these marketplaces or on Kraken. Similarly, Hydra has been keeping the market under control for many years by prohibiting stores from trading on the side.

At the same time, OMG, which was accused of having ties with the SBU in the spring and summer, along with RuTor, was not affected by the boycott, as were several smaller sites.

Some stores expressed their dissatisfaction on forums, while others circumvented the ban by operating under multiple names.

“Marketplaces are AHOY! THEY TELL ME WHERE TO PLACE. AND THEY DON’T GIVE TRAFFIC. Fuck them,” laments the organizer of the store in the correspondence. He says that over the past year, he has been making more money from sales in his own bot than through marketplaces.

The war continues to interfere with the redistribution of the drug market: in December, a Ukrainian-American hacker hacked Solaris. He stole \$25,000 from the marketplace and sent it to the needs of Ukrainian refugees. He punished them for their friendship with the pro-Russian Killnet. Then, he released the website's source code and correspondence into the public domain. After that, Solaris was hacked by Kraken, and the marketplace's website remained offline for several days, while its owners lost profits and the trust of the community.

In response, in February, Solaris announced the deanonymization of the Kraken and Wayaway administrator, a 25-year-old programmer from Yekaterinburg who drives a BMW with license plate number 228 (the number of the "drug" article in the Criminal Code). However, they have not published any evidence of the young man's direct connection to Kraken.

Currently, mutual hacking, domain hijacking, and information leaks from marketplaces are ongoing. Researchers from TRM Labs (who study cybercrime and cryptocurrencies) note that Russian drug markets are vying for the right to become the new market monopoly. This is something that their European and American counterparts avoid, as operating in the shadows reduces the risk of being targeted by law enforcement agencies.

Russian marketplaces are “less concerned about law enforcement than their Western counterparts,” TRM writes. This is understandable: Hydra has been operating for seven years. Since April, two people have been arrested in Russia in connection with the U.S. Department of the Treasury’s leak, most likely not at the top but as system administrators. Perhaps this is the key to their success: according to TRM, Russian marketplaces accounted for more than 80% of all cryptocurrency revenue generated by drug marketplaces worldwide in 2022.