A note on a Russian public web group team TSRh and leader progopis   for Independent (IND)   by The Sabotage Rebellion Hackers (tSRH)

RELEASE NAME: A.NOTE.ON.A.RUSSIAN.PUBLIC.WEB.GROUP.TEAM.TSRh.AND.LEADER-progopis RELEASE DATE: 29 July 2009 RELEASE SECTION: 0DAY REGARDING GROUP: TSRh REGARDING PERSON: progopis SUBJECT: web group Theres a new team started preing on 28th of July 2009 (/0728/). Called TSRh. They for some reason havent introduced themselves, so let us do it for them, shall we? ] THE HISTORY TSRh is a web team that has been around for years. It was founded in 1999, named The Sabotage Rebellion hackers. Theyre been many in numbers at first (around 20 at peak). And theyre been less numbered recently (2 active). The team itself comes wholly from Russia and thus runet (russian part of the internet, as in all sites in .ru zone), except for a couple of cracks and cases here and there maybe. The team itself has released more than 10 000 releases to the general public, over the course of more than 7 years. THE WEBSITE(S) They operate and spread their cracks through their website, which had various names before, but the most known ones are tsrh.cracks.ws (down long ago) and tsrh.org.ua (most recent one, went down around 2 months ago). THE DISTRIBUTION They distribute their cracks as it was said about through their main web site and mirrors (of it). Also however, the members are active in both cracking AND recruiting their members on various russian warez forums and cracking communities (mainly the one ending in ab). There, they fill requests (crack whatever people ask for), explain how to crack what, what to do, what the protection is, how to bypass it, etc (you get the idea). As for the warez forums, every russian internet user knows the 2 biggest warez-spreading forums around. We wont name any names, but one has a board word in it, the other is a 4-letter name. Anyhow, they are active there and they stuff is widely used and distributed. THE LEADER At the moment the acting leader (a guy named B-hep is the real head, away atm) of TSRh is basically its most active cracker and actually one of very few people left active on the team. He does the cracking, he does the recruiting, his idea was to start activity in The Scene. TSRhs leader is - progopis, let us repeat again: PROGOPIS Public blog: yes (found) Public ICQ: yes (found) Public mail: yes (found) This guy does not have a slightest clue of how The Scene actually works. We have several sources telling us he went around asking how exactly the system works, why, how certain things are done, etc. Going 0day was progopiss little initiative. He really is a little thinker, isnt he? ] THE MEANS According to our informarion TSRh does NOT have site access yet, they pre through someone. Now, read this very carefully. ----------------------------- TO EVERYONE WHO MIGHT SEE TSRh PRE ON THEIR SITE: REPORT TO YOUR SITEOP, SHOW HIM THIS NOTICE AND MAKE HIM PAY ATTENTION. HE MIGHT DISREGARD THIS, BUT HE MUST SEE AND INVESTIGATE. DO YOU REALLY WANT TO BE ON A SITE WITH SOMEONE WHO PRES FOR A WEB GROUP?! ----------------------------- It is almost certain that the person who pres for them is 1) Russian 2) gadmin of an 0day group. We suspect that this also might be a gadmin of one particular retired 0day group. Teams name starts with an -E, gadmins nick with an h. Keep an eye... THE PRES 2 releases on 0728 of 2009 so far. Nukers did the right thing: [NUKED] [GameGain.2.7.20.2009.Incl.Keygen.and.Serv.Check.Patch-TSRh] [0DAY] [web.group] [2009-07-28 18:16 GMT] [1F/2MB] [NUKED] [PS.Tray.Factory.3.0.WinAll.Cracked-TSRh] [0DAY] [web.group] [2009-07-28 18:15 GMT] [1F/1.7MB] THE OTHER HAPPY FACES As of 30.11.2008 there was only 2 ACTIVE people on the team: progopis and Rigel. Also Vepergen, SupaSta, BoOMBoX and St@rIX are active from time to time. St@rIX is a pda cracker active on big warez forums, fulfilling requests. THE PROOF The purpose of this notice is not to lay blame on anyone or anything, but simply connect a few dots here and there and to let everyone know that we have yet another wannabe sceners around. So, well just name a few facts we discovered by the simplest possible means: googling. Again, MOST of the stuff was acquired though simple looking around using a search site. Yes, it is THAT simple! 1 FACT: An announcement about recruiting new people into the team, saying that they only have 2 active people left and a few time-to-time guys. This is followed by a discussion between him, other active and non-active (Funbit) team members. Note the topic name: Want to join TSRh?. Huh, could that be the same TSRh team that started preing?! Ohhh noes!!! CONCLUSION: progopis is the leader of TSRh, he recruits for TSRh in open forums, team right now probably very few (2) people in it LINK: http://tinyurl.com/ndm7um ---- original: http://tinyurl.com/mjgl25 2 FACT: We went ahead to the biggest warez forum in runet. And looked up TSRh leaders (progopis) profile. OMG its there!!!! But wait!, maybe its some other progopis, maybe its some other guy by the same nick who got tsrh.org.ua set as homepage! So lets look at this guys latest post, maybe hes not the one. What do we see there? An interesting phrase Already started patching the new version. Huh, looks like hes into cracking too! What a coincidence! Lets have a look at the topics header/original post. There, we see Full pack from TSRh. Say thanks to progopis, BoOMBoX...... (see - THE OTHER HAPPY FACES) CONCLUSION: progopis posts on the biggest russian PUBLIC warez-spreading website, makes cracks for it (user requests), shares the cracks (obviosly) LINK: Proof1 - 03 3 FACT: Just for the hell of it we checked a few names of the crackers that are known to us on that same biggest public warez forum and we did got some stuff too! (wow!) A little fella called starix for example, made a crack for MyLife Organized and promised one for the new v3 as well (hes also active in PDA-releated software). What a sweetie-pie! Member called SupaSta got an account on the forum. A member called Lice admins another public cracking forum where reversers crack programs requested by people. CONSLUSION: other members of TSRh are actively participating in warez forums making cracks and sharing them LINK: Proof4 - 08 4 FACT: We went and had a look at a version of TSRh website listed by the internet archive. Its old, but none the less has some info on members. It wasnt properly archived, (why?) because of the very specific org.ua domain. But as it was mentioned the tsrh.org.ua went down only a few months ago. CONSLUSION: TSRh have always had a public web page with mirrors of it, to distribute cracks, which has been active up very recent history LINK: http://tinyurl.com/kq4sta (notice that links on the cracks are downloadable in free access) 5 FACT: The leader (progopis) has a public/open blog, wheres hes talking about how to join TSRh as a trial member (recruiting), his experiences as a cracker, overall cracking. CONCLUSION: : LINK: Proof9 6 FACT: One of high-ranking TSRh members (B-hep aka BiSHEP) even gave an interview to a mainstream magazine for wannabe hackers called (duh!) Hacker (Xakep,Xaker,][aker), back in 2005. CONCLUSION: Hmmm... Dont know what to write here really. This goes beyound definition of public. LINK: http://tinyurl.com/lhlrjc (in Russian, auto-translate if interested) 7 FACT: Stop! Maybe we badmouthing a perfectly good, new 0day, team, maybe the public TSRh weve been telling you about is just a coincidence? OK then. Lets have a look at their current nfo and a random nfo taken off the internet by simple googling. Huh! Interesting: they look 100 identical, except for the bottom part - it was cut in the new nfo, because it listed ALL their members (nicks,status,specialisation) and the groups contact details (where to get the cracks from, irc). Needless to say that email and member contacts can be obtained by simple googling, since they all were on most of the big forums :) Also, have a look at .diz files, they too are almost identical, with exception of a few cut parts. Also notice that nfo was updated on 27th of July, a day before their first pre. CONSLUSION: TSRh that pred on 0728, is the SAME public TSRh Team, using the SAME nfo and run by the SAME leader and members LINK: Proof10 - 13 8 FACT: The releases pred on 0728 have a file called tsrh_relcheck.exe. Get any release from the web, most of them have the very same file. If they dont, that means the releases has been messed with/repacked. So the point of this file is to check authenticity CONCLUSION: Another pointer that this is the very same public web team LINK: Proof14 9 FACT: TSRhs acting leader, progopis, is still active on biggest russian cracking forum, name ending with ab. His latest post there: July 27. CONSLUSION: yet another public forum where the leader actively participates in cracking/reversing-related discussions LINK: not that important. find it if interested. 10 FACT: Our fearless leader progopis was kind enough to even contribute a file_id.diz from his group to Wikipedia CONSLUSION: yet another public display of his assosiation with cracking/reversing LINK: Proof15 + http://tinyurl.com/mo4w7s 11 FACT: progopis is also a very keen on shring his cracking experience with everyone he possibly can. Look at his nice little crackto! And he even gives us a link to the crackto itself: geeworks.trialmaster.2.0.keygening.rus.tutorial-tsrh.zip :) By the way, notice the same avatar as on his blog (see #9, above) CONCLUSION: huh? LINK: Proof16 12 FACT: progopis participates in tsrh-owned cracking forum. Watch him take a request :D This is the same forum that a TSRh member by name of Lice admins. Actually, look at progopiss staus: Administration :) CONSLUSION: do we need to say more? LINK: Proof17 THE CONCLUSION We could go on and on and on and on with the proof thing. But why bother? Try googling (especially google.ru with search in pages in russian option on) for: tsrh, The+Sabotage+Rebellion+hackers, tsrh+progopis, progopis, tsrh+crack, tsrh+keygen, tsrh+starix, tsrh+progopis+crack, tsrh+progopis+keygen, and so on and so forth. OR you could try to go to any site that spreads keygens/cracks and dig around a bit: you will find that a lot of cracks are by TSRh (since they got 10k+ releases). Anyhow, suit yourself, its all over the place. WHAT WE THINK We think that a team with THIS huge level of publicity (actually, ANY publicity) and history (1999+) of releasing and spreading cracks to the public is: 1) against the whole idea of The Scene being a closed community AND being a community only for people who contribute as well 2) puts in danger whoever will be (since they dont have site access yet) on site with them 3) people who pre for them are INsecure and must be purged from all sites, because they KNOW what TSRh stands for and STILL they pre for them 4) nukers who hesiate nuking their releases should NOT do so: this is a 100 web team, and its been so since 1999, so web.grp IS a reason that ABSOLUTELY valid in this case!!!!!!!!!!!!!! TSRh people blog, fill requests on public forums, spread cracks on public forums, recruit members on public forums and their blogs. And now they cut off a part of their old public nfo and think that this is the only thing they need to do in order to get in?! Its up to you whether you want to belive this or not, or whether you decide to report the person who pres for them if you see it. BUT ask yourself this: - Are you ready to risk being on site with a group whose members are STILL do what theyve been doing since 1999? - Are you ready to take even the SMALLEST risk of being caught because of THOSE people? - Do you really want allow people who gave a goddamn interview in a mainstream magazine to be on site with you? Because if not, Im telling you: - LOOKOUT FOR THE SITE WHERE SOMEONE PRES FOR THEM! - FIND OUT THE GROUP WHICH HELPS THEM PRE! - MAKE THE SITEOP PAY ATTENTION TO THE FACT THAT SOMEONE PRES FOR THEM! - WE NEED TO FIND WHO AND OF WHICH GROUP HELP THEM PRE - but most importantly: !!!RELEASE A NOTICE!!! if you have ANY information about WHO or WHAT GROUP pres releases for TSRh! Why? Simple: the person who pres for them, KNOWS (and thats a fact) that TSRh is a public group (and everything else), BUT STILL this person pres for them. Now, would you like to be on site with this person/group? Id think twice before answering. THE TASK: -NUKE NETS: nuke ALL their releases, until they stop preing. This is the only proper course of action in such cases. We got enought people leaking stuff to torrents, lets at least not allow a CLEAR AND PRESENT danger to be around us! -EVERYONE: lookout for any TSRh preing on your site, if you see TSRh release pred on your site you can/must: 1) RELEASE A NOTICE, LET EVERYONE KNOW (which group pres for them)! 2) contact your siteop and show THIS notice, while pointing that someone pres their releases. MAKE the siteop look into this! 3) contact someone from any major nuke net 4) contact us + Keep an eye for any new 0day teams, they might resurface. MESSAGE FOR TSRh Stay the fuck away from The Scene. Youre NOT welcomed here, and never will be. Youve been public since forver: stay that way. You do no belong here, because you are insecure to your very very core, and it will always stay this way. Cutting the bottom of your nfo is NOT what it takes to be a part of this extended family, security and integrity - are. Im saying this, NOT because Im jelous of 2 public wannabe sceners, Im saying this, because The Scene is NOT A FUCKIN GAME (unlike it says in your nfo): people get caught and arrested. We do this for fun, but people DO get choked up over this fun. It might be joke to you in Russia, but not to everyone else (in countries where law actually works). So STAY THE FUCK AWAY, and let us keep whatever little security we got as it is. THE END and GOD BLESS THE SCENE. We Scare, Because We Care (c) Monsters Inc. P.S. They say ignorance is a bliss: you might choose to ignore it, choose not to believe it. But YOUR own eyes wont lie, googole: tsrh. Itll show you more than any words can. P.P.S. And people, get off your asses: START WRITING NOTICES, even if its a simple message/sentence. Do you want to say something? Do you want to ask us/anyone something? Do you have helpful information? PRE A SHORT NOTICE, TELL EVERYONE! It aint a crime to communicate with each other, for cryin out loud!!!