Criminal Forums Ban Hacker Linked to Myspace, LinkedIn Breaches

Several hackers and data traders have gained notoriety recently because of so-called "mega-breaches"—data dumps of hundreds of millions of users from high-profile sites such as LinkedIn and Myspace.

But along with that kind of attention comes more opportunities to make cash, and greed can get the better of anyone. Tessa88, the hacker who was one of the primary sources for several recent dumps, has now been banned from multiple Russian crime forums for scamming other users.

On June 8, Tessa88 agreed to sell the Myspace, VK.com, and LinkedIn databases for 10 bitcoins (worth just under $6,000 at the time) on a Russian forum, according to a user called InstallsBuyer. The deal turned sour, however, when Tessa88 didn't deliver the goods, but instead allegedly provided tampered or false versions. InstallsBuyer wrote a long post laying out their complaint, complete with apparent chat logs between them and one of Tessa88's alternate handles.

According to those logs, which are in Russian, InstallsBuyer wanted to check the legitimacy of the dumps beforehand, so Tessa88 provided links to three databases. But InstallsBuyer claims many of the VK.com user records were missing passwords, a load of the password hashes from the LinkedIn dump had been removed, and certain individuals were missing from the data. According to InstallsBuyer, Tessa88 kept making excuses for the shoddy customer service, and for not dealing with the problem.

"He rides in a car, he had a bad Internet, it is on the phone and so on," InstallsBuyer wrote, according to a Google translation.

"Fell asleep or something :-)," InstallBuyers wrote in a chat message when Tessa88 did not reply for several hours.

Summing up, InstallsBuyer writes that since none of the databases were as advertised, they want a refund of 80 percent.

Tessa88's account has since been banned on that forum, and given the label of "RIPPER," meaning that they have a history of scamming people. Tessa88 has been kicked off two more Russian crime sites too. On another Romanian forum, a further user has accused him of being a cheater.

The name Tessa88 first appeared in early 2016, when whoever was behind it started advertising a slew of databases on various crime forums, as well as a dedicated online shop. Andrei Barysevich, director of Eastern European research and analysis for security firm Flashpoint Intel, previously told Motherboard that Tessa88 had made between $50,000 and $60,000 worth of bitcoin.

Barysevich thought it was "very likely" that there were two people behind the Tessa88 moniker, and only one of those was a native Russian speaker, judging by how they speak.

Scamming is perhaps not much of a surprise in the digital underworld, but customer service does play a significant role in modern cybercrime. Customers leave ratings and reviews for vendors of data and drugs on dark web marketplaces; hacking forum users often "vouch" for one another, so potential buyers have a better sense of whether the seller is legitimate or not; and those who spread ransomware have to deliver on their promise of unlocking victims' files, otherwise future targets will be less likely to pay up.

And when someone does decide to not play by the rules, those who are ripped off will write detailed posts about what exactly happened.

For Tessa88, it looks like being at the centre of a whirlwind of data breaches was just too much of a good opportunity to pass up.