Darknet drug market BlackSprut openly advertises on billboards in Moscow

Over the weekend in Moscow, electronic billboards caught the attention of residents and the Russian media. The huge signs featured a woman in a futuristic mask and the words "Come to me if you're looking for the best."

The brand? Russia-linked darknet drug trading platform BlackSprut, which mainly serves clients in Eastern Europe. It’s one of the leading illicit marketplaces in Russia, along with OMG, Kraken and Mega. 

The fact that BlackSprut was openly advertising its services in the Russian capital could mean several things: Either the billboard owners did not know about the platform's illegal activity, or the billboards were hacked, or no one in a position of authority simply cared. At least one publication pondered whether it’s the first time such a campaign was so public.

1/ #Russia #Moscow

Filmed banners advertising the Blacksprut marketplace in Moscow.

The marketplace is where thousands of trades take place every day. The market place is filled with all prohibited goods and mostly buyers come from the CIS countries. pic.twitter.com/U7eu28JnnN— David Kime (@CyberRealms1) February 4, 2023

Although it’s not clear why the advertisements were permitted, BlackSprut is known for backing the Kremlin. The group supports Russia’s invasion of Ukraine. Its administrators allegedly donated cryptocurrency to pro-Russian paramilitary fighters who could use it to buy equipment and body armor.

Those kinds of positions aren’t unique. Another Russia-linked drug marketplace, Solaris, hacked by its rival Kraken in January, allegedly donated money to the pro-Kremlin group Killnet, which is known for launching distributed denial-of-service attacks on Ukraine and its allies. 

In a broad sense, the billboards speak to a certain level of permissiveness in Russia. The country is considered “a safe haven” for illegal drugs and “a fertile ground” for darknet platforms that supply illegal drugs to tens of thousands of users, according to a report by Hold Security.

Интересно каааак…Глядишь такими темпами наркоту легализуют) В Москве показывают рекламу blacksprut… во дела….pic.twitter.com/92uB7VLmsi— Mihali (@Mihali_Mow) February 4, 2023

The money tends to stay close to home, too. Last year, funds received by the sanctioned Russian crypto exchange Garantex accounted for most of the illicit cryptocurrency use worldwide — a record $20 billion, according to blockchain analytics firm Chainalysis. The researchers said that much of this activity is "likely Russian users using a Russian exchange."

Rising in plain sight

Compared to other marketplaces, which can be difficult to find in the darknet for new users, BlackSprut has one advantage — an entry point on the public web, making the platform more visible.

The marketplace uses the U.S.-sanctioned crypto exchange Bitzlato to process illegal transactions. Bitzlato was previously accused of laundering hundreds of millions of dollars and facilitating purchases on Hydra, once the world’s largest darknet marketplace. 

BlackSprut is considered one of Hydra's successors  —  it has 28% of the global darknet market share, followed by Mega with 22% and OMG with 17%, according to blockchain intelligence company TRM Labs.

It has always been difficult for law enforcement to capture darknet marketplaces because they are anonymous and can easily migrate to new infrastructure, according to TRM Labs. Besides, Russia often refuses to extradite its cybercriminals abroad, where they would face harsher punishment than at home.

In Russia, cybercrimes are usually investigated slowly and not very efficiently. For example, after completing the investigation into the notorious REvil ransomware gang this February, the Russian government was only able to charge the eight suspects with payment card fraud, but not with their involvement in the ransomware attacks that earned more than $200 million.