- Статьи
- Society
- Stoglavaya Hydra: the owner of the servers of the "online drug cartel" appeared in court
Stoglavaya Hydra: the owner of the servers of the "online drug cartel" appeared in court
Dmitry Pavlov, an ordinary teenager from Cherepovets, started with a small legal Internet business at the age of 17, but over the next 14 years he turned into one of the key figures in a criminal community with a turnover of $ 5 billion. He was arrested in April 2022 during the debacle of Hydra, the largest darknet resource for drug trafficking. Only 649 million rubles worth of cryptocurrencies were stored on his personal wallets at that time. For three years, nothing was reported about his fate. But Izvestia found out: he made a deal with the investigation, was sentenced to six years in prison, and in exchange gave detailed testimony about how the network "drug cartel" functioned, how it was created, and who led it. The other day, these statements were announced at the trial of his alleged accomplice. The details of the high—profile case and how the investigation into the top of Hydra is now moving are described in the Izvestia article.
From IT specialists to defendants
Back in 2008, 17-year-old Dmitry Pavlov moved to St. Petersburg from Cherepovets. And he began to earn a modest living by providing hosting services for Internet sites: he rented a place in the server rack from an IT company for equipment purchased on eBay and advertised his services under the 4x4host brand.
Hydra Server
And 14 years later, in April 2022, several operations took place in Russia, Germany, and the United States to defeat the world's largest darknet drug trafficking site, Hydra. The US Department of Justice has publicly brought charges against Dmitry Pavlov. In the Northern District of California court, prosecutors named him as the man who had been providing critical Hydra infrastructure for several years in a row. This meant that he paid the rent of all the servers hosting the darknet platform, provided their technical support and normal functioning.
It turned out that in a decade and a half, a modest St. Petersburg entrepreneur had worked his way up to an important figure in one of the largest drug trafficking structures in history.
In the same April 2022, Pavlov was detained by the Russian police while trying to leave the Vologda region — he became the first person involved in a large investigation, which is still ongoing and has already resulted in several criminal cases and lawsuits.
At the end of 2024, some media outlets, talking about one of these courts, mistakenly named Stanislav Moiseev, the life—long convicted owner of one of the large stores on the site, as the co-founder of Hydra. In reality, the accused had nothing to do with the management of the marketplace itself.
And in fact, the only Hydra co—organizer who has appeared in court at the moment is 35-year-old Pavlov.
Three years after his arrest, he appeared in public for the first time — in the last days of May 2025, he testified as a witness for the prosecution in the Dzerzhinsky Court of Yaroslavl.
As Izvestia found out, he had previously been convicted there in a special order as part of a deal with the investigation. Pavlov was found guilty of participating in a criminal community and complicity in the illegal sale of drugs on an especially large scale. The verdict was not published, but according to Izvestia's law enforcement sources, the owner of the Hydra servers was sentenced to six years in prison.
Hydra Server
Now the case against Pavlov's contractor, freelance programmer Boris Gubko, is being heard in a separate proceeding. A correspondent of Izvestia was present at the meetings where the case materials were read out, the testimony of witnesses, experts and participants in the investigation was heard.
The idea for a "drug startup"
Pavlov spoke via video link from the Lefortovo pre-trial detention center in Moscow. It followed from his testimony: as his business developed under the 4x4host brand, he acquired the status of a local Internet registrar for his father's Promservice company. This gave him the opportunity to independently distribute IP addresses among clients. In 2011, Pavlov decided that it was expensive to maintain his own hosting servers. It was much more profitable to sublet the foreign ones. Pavlov used the large German company Hetzner for this purpose.
In 2012, through the contacts listed on the 4x4host website, Pavlov was contacted by a man who had the nickname Startup_team in the ICQ messenger. He suggested hosting a Legal RC forum on the company's servers dedicated to "legal" psychoactive substances, the then-popular "spice". The money for the services was transferred directly to Pavlov's bank card.
After some time, users with the nicknames NoName and "Zhenya Bach" contacted the hosting owner on behalf of Legal RC. The latter explained that he was the senior programmer of the project. No Name acted as the customer.
According to Pavlov, in 2013, this character founded his own hosting company, Big Mama. Under its banner, the services of the 4x4host company were resold. While Pavlov's company continued to operate as a "white" hosting service, the Big Mama website openly offered special conditions for creators of illegal Internet resources.
In total, through the Big Mama project, No Name placed more than a hundred dubious Internet resources on Pavlov's servers. These were various cryptocurrency services, websites dedicated to drug topics and other illegal content.
At some point, the partners decided to bring together all the popular services on the darknet on one platform. To do this, it was necessary to combine the payment and marketing infrastructure on an anonymous resource. It took the Big Mama team about two years to create the special software. Finally, in March 2015, they launched the Hydra project.
Buyers and sellers of illegal services were offered a wide range of functionality, a user-friendly interface, marketing tools, a clear system of rules and technical support. In exchange, Hydra received a commission on transactions and payments for a variety of additional services, such as paid store promotions on the homepage.
Bags with cash and a "factory" in the Moscow region
The Legal RC forums and other initial projects of the partners quickly faded into the background, Pavlov noted in his testimony.
The goal of the new marketplace was to monopolize the sale of drugs on the Internet. In order to lock in the audience, the owners of Hydra began to buy out competing sites. The uncooperative were subjected to hacker attacks.
The strategy paid off. From 2015 to the defeat of Hydra in 2022, the number of servers leased in Germany increased from 10 to 50, Pavlov said.
The annual turnover of the marketplace at the time of closure was up to $ 1.7 billion, and for all five years of the site's existence, the volume of transactions on it amounted to about $ 5 billion. A fairly accurate amount is usually referred to with reference to detailed calculations of cryptocurrency transactions from the New York-based company Chainalysis. Similar assessments are shared by Russian experts questioned in the case.
An employee of Rosfinmonitoring estimated the direct income of the site in the amount of 2 to 5% of the transactions. In turn, a participant in the investigation, who spoke in the Dzerzhinsky court of Yaroslavl, insisted that only the net profit of the creators of Hydra, taking into account related services, amounted to about 100 billion rubles per year.
Pavlov, according to his confession, was paid about 15 million rubles a year for participating in a criminal organization. Most of the money came in cryptocurrencies to four wallets seized from him during his arrest. The man did not cash out these funds, hoping for an increase in the value of assets. In 2022, the value of the cryptocurrency seized on Pavlov's wallets was 649 million rubles, according to the case materials announced in court.
Pavlov also received money in cash to pay for the maintenance of the service. It took 1.5–2 million rubles per month to rent and maintain the servers of a German company. Hydra's top managers periodically sent couriers with cash to Pavlov.
In one of these meetings, his girlfriend went with Pavlov in an Audi car to an industrial area near Moscow. "I didn't see the transfer process itself, because Dima got out of the car, and I stayed inside," the witness told the investigation. — It was around 2013. The money was received for the administration of the Legal RC website, approximately in the amount of 8 million rubles in five thousand bills in a leather bag."
According to Pavlov's girlfriend, he sometimes shared business details with her. In particular, he said that he had a certain acquaintance in law enforcement agencies. "Pavlov went to see him once or twice a month in St. Petersburg to resolve some issues," the witness said. According to her, the convict also claimed that those for whom he works had their own drug production plants in the Moscow region.
Pavlov invested his income in the construction of a data center in the Vsevolozhsky district of the Leningrad region. At the time of his detention, an object with an area of 2 thousand square meters with its own electrical substation was being built there, on an area of 10 hectares.
The characters
"The same individuals were involved in the activities of Legal RC, Hydra and the Big Mama hosting company," Pavlov emphasized in his testimony. In the course of online communication with various representatives of the project, he concluded that the key decisions are made by the character under the nickname No Name. Subsequently, this interlocutor also used nicknames in messengers: Big Mama, "Privalov" and "Pasternak".
The main programmer of the project is known to Pavlov as the person who initially subscribed to the messengers "Zhenya Bach", and then - ZOG. The alleged owner of Hydra also called him Zhenya. In communication with Pavlov, the main IT specialist of the project confirmed that he uses the nickname admin on the Hydra website.
Another key character, according to Pavlov, used the nickname Fat Cat. He supervised the placement of specific stores on the site. "He can also be called the Hydra admin," Pavlov clarified.
The total number of participants in the criminal community, according to estimates by the operational staff of the Russian police, reached 300 people. The investigation divided them into 15 structural divisions: accountants, IT specialists (including Pavlov and Gubko), marketers, security service, HR department, lawyers, consultants for the creation of laboratories, etc.
"Most of them are anonymous infantry," said an Izvestia source familiar with the investigation. The main beneficiaries and top managers of Hydra have been just a few people all this time. Thanks to Pavlov's testimony, the examination of evidence, and "technical measures," some of them have been identified, but the investigation is ongoing.
How the Germans and Americans attributed the defeat of Hydra to themselves
Serious operational development of Hydra began in 2019. As a result of the investigation of domain names, nicknames and other data, the police managed to establish a connection between one of the "mirrors" of the 4x4 hosting site. Then the police became convinced of the involvement of the same company in the Legal RC forum. It was then that the collection of information about Pavlov began. By 2021, it was established that the servers used by the criminals belong to the German company Hetzner and are located in Germany.
The Russian police initiated a working meeting with colleagues from Germany. It took place in November 2021. The server data was transferred to the German side to clarify the information.
The second meeting took place in February 2022. The Germans reported on it: as a result of the inspection, a total of about 300 Hetzner servers rented by Pavlov were installed. "It became clear that the entire Hydra was located on them," a participant in the investigation told the court. But after February 24, 2022, "due to the geopolitical situation, contacts with the German police ceased," the policeman said.
On April 5, the German police unilaterally seized the servers without warning their Russian colleagues and announced their major success. "The seizures were preceded by large-scale investigations that the Central Directorate for Combating Internet Crime and the Federal Criminal Police Department have been conducting since August 2021, involving several US authorities," the official press release said. The participation of Russian colleagues was kept silent.
The next day, the US Treasury Department imposed sanctions on Hydra, and the US Department of Justice publicly put Pavlov on the wanted list on charges of administering the servers of the darknet platform. Their jurisdiction over Hydra in the United States was justified by the fact that fake passports of US citizens could be purchased on the resource, and cryptocurrency was also laundered. In addition, back in 2020, one of the undercover agents managed to order five grams of methamphetamine through the site, which was sent to him by mail from the territory of Ukraine to San Francisco. However, the sanctions press release focused on the resource's connection with Russia.
How the Russian investigation against Hydra continued
As a result, Russian operatives had to detain Pavlov after press releases from colleagues from the United States and Germany appeared. Due to the failure of the Germans and Americans to coordinate their actions, Pavlov managed to clear out a significant part of the digital traces of his connections with the criminal community. A huge amount of data from German servers was also unavailable to the Russian investigation.
After interrogating Pavlov himself and examining computer equipment, it turned out that he periodically used freelance specialists to maintain servers. So he found a programmer named Boris Gubko with the nickname Gremlin, who was assigned technical work about once a month for a fee of 1 to 10 thousand rubles.
Back in 2013, Gubko warned Pavlov that he had noticed drug-related websites on the servers. "I didn't react to that. And he continued to make adjustments without asking any more such questions," Pavlov said. To the surprise of the operatives, after that Gubko continued to provide services for a small fee.
Now the accused, along with the defense, insists that this is evidence of his innocence. Gubko had no information about whose interests he was working for, insists the lawyer, who calls his client a "switchman."
In turn, an interlocutor of Izvestia, familiar with the investigation, draws attention to the fact that Gubko himself confirmed in his initial testimony that he was aware of the content on the servers being serviced. The defendant later retracted these words. "But even if we proceed from them, it's the same as bringing in a car mechanic for drug trafficking who was repairing a car and saw what was being transported inside," Gubko's defender believes.
However, the investigation into the Hydra case is not limited to the prosecution of Pavlov and Gubko. In April 2024, the third person involved in the case was detained. His name was not disclosed, but Izvestia's source in law enforcement agencies assured that the accused stood much higher than Pavlov in the hierarchy of the organization.
The Interior Ministry then stressed that the searches in the Hydra case took place in Moscow, the Moscow Region, the Khabarovsk and Krasnodar Territories and the Republic of Belarus. Cash totaling over 350 million rubles and digital wallets with cryptocurrency were seized, and a large number of real estate, luxury cars and other luxury items purchased with criminal proceeds were found.
The work on collecting evidence against the remaining top managers continues. In addition, the connection between Hydra and one of the major marketplaces founded after its liquidation was confirmed. Izvestia previously wrote about his aggressive marketing campaign in the fight for the drug market in Russia. In one of the criminal cases about the advertising of the new service, the police called its creators people with "unlimited financial resources and corrupt connections in law enforcement agencies."
Hydra successor promotional event in the center of Moscow
In his testimony, Pavlov clarified that people from the former Hydra team were involved in the creation of the new site, and similar software was also used.
The Russian-Belarusian investigation team is investigating the main Hydra case.
Other cases are being investigated in parallel. So, in May 2025, it also became known about the detention of seven people — employees of one of the IT companies and a cryptocurrency exchange service that provided the activities of Hydra's successor. Searches took place in eight regions.
According to Izvestia's interlocutors familiar with the course of the investigations, the Hydra participants were trapped — sooner or later serious charges could be brought against them, both in Russian and American jurisdictions, which severely limits their ability to escape.
The key to identifying all those involved in Hydra is cryptocurrency, according to Sergey Pelikh, former head of the investigative departments for combating organized crime in the field of drug trafficking in the central offices of the Federal Drug Control Service and the Ministry of Internal Affairs.
— In cases of organized drug crime, the most reliable traces are financial. Money is the evidence that criminals are least willing to get rid of,— says Pelich. — And cryptocurrency allows you to track its origin more reliably than any banking regulators. And volumes like Hydra's are clearly visible even on large exchanges and crypto exchangers.
Переведено сервисом «Яндекс Переводчик»
