RELEASE NAME: A.NOTE.ON.A.RUSSIAN.PUBLIC.WEB.GROUP.TEAM.TSRh.AND.LEADER-progopis
RELEASE DATE: 29 July 2009
RELEASE SECTION: 0DAY
REGARDING GROUP: TSRh
REGARDING PERSON: progopis
SUBJECT: web group
Theres a new team started preing on 28th of July 2009 (/0728/). Called TSRh.
They for some reason havent introduced themselves, so let us do it for them, shall we? ]
THE HISTORY
TSRh is a web team that has been around for years. It was founded in 1999, named The Sabotage Rebellion
hackers. Theyre been many in numbers at first (around 20 at peak). And theyre been less numbered recently
(2 active). The team itself comes wholly from Russia and thus runet (russian part of the internet, as in
all sites in .ru zone), except for a couple of cracks and cases here and there maybe. The team itself has
released more than 10 000 releases to the general public, over the course of more than 7 years.
THE WEBSITE(S)
They operate and spread their cracks through their website, which had various names before, but the most
known ones are tsrh.cracks.ws (down long ago) and tsrh.org.ua (most recent one, went down around 2 months
ago).
THE DISTRIBUTION
They distribute their cracks as it was said about through their main web site and mirrors (of it). Also
however, the members are active in both cracking AND recruiting their members on various russian warez
forums and cracking communities (mainly the one ending in ab). There, they fill requests (crack whatever
people ask for), explain how to crack what, what to do, what the protection is, how to bypass it, etc
(you get the idea). As for the warez forums, every russian internet user knows the 2 biggest
warez-spreading forums around. We wont name any names, but one has a board word in it, the other is a
4-letter name. Anyhow, they are active there and they stuff is widely used and distributed.
THE LEADER
At the moment the acting leader (a guy named B-hep is the real head, away atm) of TSRh is basically its
most active cracker and actually one of very few people left active on the team. He does the cracking, he
does the recruiting, his idea was to start activity in The Scene.
TSRhs leader is - progopis, let us repeat again: PROGOPIS
Public blog: yes (found)
Public ICQ: yes (found)
Public mail: yes (found)
This guy does not have a slightest clue of how The Scene actually works. We have several sources telling
us he went around asking how exactly the system works, why, how certain things are done, etc.
Going 0day was progopiss little initiative. He really is a little thinker, isnt he? ]
THE MEANS
According to our informarion TSRh does NOT have site access yet, they pre through someone. Now, read this
very carefully.

TO EVERYONE WHO MIGHT SEE TSRh PRE ON THEIR SITE: REPORT TO YOUR SITEOP, SHOW HIM THIS NOTICE AND MAKE
HIM PAY ATTENTION. HE MIGHT DISREGARD THIS, BUT HE MUST SEE AND INVESTIGATE. DO YOU REALLY WANT TO BE ON
A SITE WITH SOMEONE WHO PRES FOR A WEB GROUP?!

It is almost certain that the person who pres for them is 1) Russian 2) gadmin of an 0day group. We
suspect that this also might be a gadmin of one particular retired 0day group. Teams name starts with an
-E, gadmins nick with an h. Keep an eye...
THE PRES
2 releases on 0728 of 2009 so far. Nukers did the right thing:
[NUKED] [GameGain.2.7.20.2009.Incl.Keygen.and.Serv.Check.Patch-TSRh] [0DAY] [web.group] [2009-07-28 18:16
GMT] [1F/2MB]
[NUKED] [PS.Tray.Factory.3.0.WinAll.Cracked-TSRh] [0DAY] [web.group] [2009-07-28 18:15 GMT] [1F/1.7MB]
THE OTHER HAPPY FACES
As of 30.11.2008 there was only 2 ACTIVE people on the team: progopis and Rigel. Also Vepergen, SupaSta,
BoOMBoX and St@rIX are active from time to time. St@rIX is a pda cracker active on big warez forums,
fulfilling requests.
THE PROOF
The purpose of this notice is not to lay blame on anyone or anything, but simply connect a few dots here
and there and to let everyone know that we have yet another wannabe sceners around. So, well just name a
few facts we discovered by the simplest possible means: googling. Again, MOST of the stuff was acquired
though simple looking around using a search site. Yes, it is THAT simple!
1
FACT: An announcement about recruiting new people into the team, saying that they only have 2 active
people left and a few time-to-time guys. This is followed by a discussion between him, other active and
non-active (Funbit) team members. Note the topic name: Want to join TSRh?. Huh, could that be the same
TSRh team that started preing?! Ohhh noes!!!
CONCLUSION: progopis is the leader of TSRh, he recruits for TSRh in open forums, team right now probably
very few (2) people in it
LINK: http://tinyurl.com/ndm7um ---- original: http://tinyurl.com/mjgl25
2
FACT: We went ahead to the biggest warez forum in runet. And looked up TSRh leaders (progopis) profile.
OMG its there!!!! But wait!, maybe its some other progopis, maybe its some other guy by the same nick who
got tsrh.org.ua set as homepage! So lets look at this guys latest post, maybe hes not the one. What do we
see there? An interesting phrase Already started patching the new version. Huh, looks like hes into
cracking too! What a coincidence!
Lets have a look at the topics header/original post. There, we see Full pack from TSRh. Say thanks to
progopis, BoOMBoX...... (see - THE OTHER HAPPY FACES)
CONCLUSION: progopis posts on the biggest russian PUBLIC warez-spreading website, makes cracks for it
(user requests), shares the cracks (obviosly)
LINK: Proof1 - 03
3
FACT: Just for the hell of it we checked a few names of the crackers that are known to us on that same
biggest public warez forum and we did got some stuff too! (wow!) A little fella called starix for
example, made a crack for MyLife Organized and promised one for the new v3 as well (hes also active in
PDA-releated software). What a sweetie-pie!
Member called SupaSta got an account on the forum.
A member called Lice admins another public cracking forum where reversers crack programs requested by
people.
CONSLUSION: other members of TSRh are actively participating in warez forums making cracks and sharing
them
LINK: Proof4 - 08
4
FACT: We went and had a look at a version of TSRh website listed by the internet archive. Its old, but
none the less has some info on members. It wasnt properly archived, (why?) because of the very specific
org.ua domain. But as it was mentioned the tsrh.org.ua went down only a few months ago.
CONSLUSION: TSRh have always had a public web page with mirrors of it, to distribute cracks, which has
been active up very recent history
LINK: http://tinyurl.com/kq4sta (notice that links on the cracks are downloadable in free access)
5
FACT: The leader (progopis) has a public/open blog, wheres hes talking about how to join TSRh as a trial
member (recruiting), his experiences as a cracker, overall cracking.
CONCLUSION: :
LINK: Proof9
6
FACT: One of high-ranking TSRh members (B-hep aka BiSHEP) even gave an interview to a mainstream magazine
for wannabe hackers called (duh!) Hacker (Xakep,Xaker,][aker), back in 2005.
CONCLUSION: Hmmm... Dont know what to write here really. This goes beyound definition of public.
LINK: http://tinyurl.com/lhlrjc (in Russian, auto-translate if interested)
7
FACT: Stop! Maybe we badmouthing a perfectly good, new 0day, team, maybe the public TSRh weve been
telling you about is just a coincidence?
OK then. Lets have a look at their current nfo and a random nfo taken off the internet by simple
googling. Huh! Interesting: they look 100 identical, except for the bottom part - it was cut in the new
nfo, because it listed ALL their members (nicks,status,specialisation) and the groups contact details
(where to get the cracks from, irc). Needless to say that email and member contacts can be obtained by
simple googling, since they all were on most of the big forums :)
Also, have a look at .diz files, they too are almost identical, with exception of a few cut parts.
Also notice that nfo was updated on 27th of July, a day before their first pre.
CONSLUSION: TSRh that pred on 0728, is the SAME public TSRh Team, using the SAME nfo and run by the SAME
leader and members
LINK: Proof10 - 13
8
FACT: The releases pred on 0728 have a file called tsrh_relcheck.exe. Get any release from the web, most
of them have the very same file. If they dont, that means the releases has been messed with/repacked. So
the point of this file is to check authenticity
CONCLUSION: Another pointer that this is the very same public web team
LINK: Proof14
9
FACT: TSRhs acting leader, progopis, is still active on biggest russian cracking forum, name ending with
ab. His latest post there: July 27.
CONSLUSION: yet another public forum where the leader actively participates in cracking/reversing-related
discussions
LINK: not that important. find it if interested.
10
FACT: Our fearless leader progopis was kind enough to even contribute a file_id.diz from his group to
Wikipedia
CONSLUSION: yet another public display of his assosiation with cracking/reversing
LINK: Proof15 + http://tinyurl.com/mo4w7s
11
FACT: progopis is also a very keen on shring his cracking experience with everyone he possibly can. Look
at his nice little crackto! And he even gives us a link to the crackto itself:
geeworks.trialmaster.2.0.keygening.rus.tutorial-tsrh.zip :) By the way, notice the same avatar as on his
blog (see #9, above)
CONCLUSION: huh?
LINK: Proof16
12
FACT: progopis participates in tsrh-owned cracking forum. Watch him take a request :D This is the same
forum that a TSRh member by name of Lice admins. Actually, look at progopiss staus: Administration :)
CONSLUSION: do we need to say more?
LINK: Proof17
THE CONCLUSION
We could go on and on and on and on with the proof thing. But why bother?
Try googling (especially google.ru with search in pages in russian option on) for: tsrh,
The+Sabotage+Rebellion+hackers, tsrh+progopis, progopis, tsrh+crack, tsrh+keygen, tsrh+starix,
tsrh+progopis+crack, tsrh+progopis+keygen, and so on and so forth. OR you could try to go to any site
that spreads keygens/cracks and dig around a bit: you will find that a lot of cracks are by TSRh (since
they got 10k+ releases). Anyhow, suit yourself, its all over the place.
WHAT WE THINK
We think that a team with THIS huge level of publicity (actually, ANY publicity) and history (1999+) of
releasing and spreading cracks to the public is:
1) against the whole idea of The Scene being a closed community AND being a community only for people who
contribute as well
2) puts in danger whoever will be (since they dont have site access yet) on site with them
3) people who pre for them are INsecure and must be purged from all sites, because they KNOW what TSRh
stands for and STILL they pre for them
4) nukers who hesiate nuking their releases should NOT do so: this is a 100 web team, and its been so
since 1999, so web.grp IS a reason that ABSOLUTELY valid in this case!!!!!!!!!!!!!!
TSRh people blog, fill requests on public forums, spread cracks on public forums, recruit members on
public forums and their blogs. And now they cut off a part of their old public nfo and think that this is
the only thing they need to do in order to get in?! Its up to you whether you want to belive this or not,
or whether you decide to report the person who pres for them if you see it. BUT ask yourself this:
- Are you ready to risk being on site with a group whose members are STILL do what theyve been doing
since 1999?
- Are you ready to take even the SMALLEST risk of being caught because of THOSE people?
- Do you really want allow people who gave a goddamn interview in a mainstream magazine to be on site
with you?
Because if not, Im telling you:
- LOOKOUT FOR THE SITE WHERE SOMEONE PRES FOR THEM!
- FIND OUT THE GROUP WHICH HELPS THEM PRE!
- MAKE THE SITEOP PAY ATTENTION TO THE FACT THAT SOMEONE PRES FOR THEM!
- WE NEED TO FIND WHO AND OF WHICH GROUP HELP THEM PRE -
but most importantly: !!!RELEASE A NOTICE!!! if you have ANY information about WHO or WHAT GROUP pres
releases for TSRh! Why? Simple: the person who pres for them, KNOWS (and thats a fact) that TSRh is a
public group (and everything else), BUT STILL this person pres for them. Now, would you like to be on
site with this person/group? Id think twice before answering.
THE TASK:
-NUKE NETS: nuke ALL their releases, until they stop preing. This is the only proper course of action in
such cases. We got enought people leaking stuff to torrents, lets at least not allow a CLEAR AND PRESENT
danger to be around us!
-EVERYONE: lookout for any TSRh preing on your site, if you see TSRh release pred on your site you
can/must: 1) RELEASE A NOTICE, LET EVERYONE KNOW (which group pres for them)! 2) contact your siteop and
show THIS notice, while pointing that someone pres their releases. MAKE the siteop look into this! 3)
contact someone from any major nuke net 4) contact us
+ Keep an eye for any new 0day teams, they might resurface.
MESSAGE FOR TSRh
Stay the fuck away from The Scene. Youre NOT welcomed here, and never will be.
Youve been public since forver: stay that way. You do no belong here, because you are insecure to your
very very core, and it will always stay this way. Cutting the bottom of your nfo is NOT what it takes to
be a part of this extended family, security and integrity - are.
Im saying this, NOT because Im jelous of 2 public wannabe sceners, Im saying this, because The Scene is
NOT A FUCKIN GAME (unlike it says in your nfo): people get caught and arrested. We do this for fun, but
people DO get choked up over this fun. It might be joke to you in Russia, but not to everyone else (in
countries where law actually works).
So STAY THE FUCK AWAY, and let us keep whatever little security we got as it is.
THE END and GOD BLESS THE SCENE.
We Scare, Because We Care (c) Monsters Inc.
P.S. They say ignorance is a bliss: you might choose to ignore it, choose not to believe it. But YOUR own
eyes wont lie, googole: tsrh. Itll show you more than any words can.
P.P.S. And people, get off your asses: START WRITING NOTICES, even if its a simple message/sentence. Do
you want to say something? Do you want to ask us/anyone something? Do you have helpful information? PRE A
SHORT NOTICE, TELL EVERYONE! It aint a crime to communicate with each other, for cryin out loud!!!