Kill List: Hacking an Assassination Site on the Dark Web

Kill List: Hacking an Assassination Site on the Dark Web

Speakers: Carl Miller, Chris Monteiro

Conference: DEF CON 33

YouTube: https://www.youtube.com/watch?v=cYZmRp90hss

Slides: https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20presentations/Carl%20Miller%20Chris%20Monteiro%20-%20Kill%20List%20Hacking%20an%20Assassination%20Site%20on%20the%20Dark%20Web.pdf

Overview

This talk is one of the most unusual presentations ever given at DEF CON: a meticulous account of how a darknet investigator (Chris Monteiro) and a think-tank researcher (Carl Miller) spent nearly a decade running a secret intelligence operation inside a network of darknet assassination marketplaces, using the data they collected to warn people whose lives were in danger and ultimately contribute to 32 arrests, 28 convictions, and 180 years of prison sentences handed down worldwide.

The story begins in December 2016 in a London pub, where Monteiro showed Miller a video of a car being torched — a threat against Monteiro for publishing skeptical analysis of darknet hitman sites. It ends with the pair building a covert data exfiltration engine that ran for years inside the site, intercepting kill orders in real time, cross-referencing them against Bitcoin payment data, and trying to warn the targets — mostly ordinary people caught in domestic disputes, custody battles, or personal vendettas — that someone had paid to have them murdered.

The technical core of the talk covers: the insecure direct object reference vulnerability that gave initial access to all site messages; the Apache directory listing misconfiguration that exposed the server's file system; the SQL injection attack that popped a web shell; the pivot into the administrator's email and subsequently into the site's entire content management infrastructure; the cron-based data exfiltration engine that silently lurked on the server for years; and the OSINT-intensive process of identifying, locating, and warning people on the kill list without being discovered.

Background

▶ Watch: references about domestic violence, uh, about sexual violence, about kidnap. (1:48)

Darknet assassination markets have been a subject of speculation, journalism, and academic interest since Silk Road popularized darknet markets in the early 2010s. The common consensus — which Chris Monteiro was actively writing about on Wikipedia and Rational Wiki — was that these sites were universally scams: the reputation systems required for a genuine assassination service don't function on anonymous darknet markets, and there was no evidence of any actual murders being delivered.

This consensus was challenged when an IP address from Romania vandalized Monteiro's Wikipedia entry, claiming that while most assassination sites were indeed scams, one site — Besa Mafia 2 — was genuinely delivering murders. The vandal linked to the site. Monteiro investigated and concluded it was also a scam — but a very unusual one. Rather than a simple exit scam (take the money and disappear), Besa Mafia 2's operator (who goes by the handle Yura) was running a long-term fraud operation: accepting payments, stringing clients along with excuses, upselling, and reinvesting the proceeds into increasingly sophisticated social proof and marketing infrastructure designed to convince Google searches that the site was legitimate.

The site's operator, Yura, was a criminal genius in marketing terms but shockingly incompetent in security terms — a combination that Monteiro and Miller were uniquely positioned to exploit.

Key Findings

▶ Watch: given what this website was purporting to offer. (11:15)

Insecure Direct Object Reference (IDOR) on message IDs: The site's messaging system (a one-to-one communication interface between clients and the site operators) stored messages with sequential numeric IDs visible in the URL. Changing the number in the URL returned a different message. Monteiro wrote a Python script to iterate through every message ID sequentially and exfiltrate the entire message database — receiving not just Bob the Builder's fake kill order (placed to gain access to the messaging system) but every message ever sent to the site, chronologically ordered from the first order to the most recent.

Apache open directory listing exposing site filesystem: A misconfiguration in the Apache web server left directory listing enabled on several paths, including a template subdirectory containing images and assets the administrator was using to build the site. In one of those directories, the administrator had accidentally uploaded a screenshot of their own desktop — showing them searching Google Images for "most secure looking padlock for Bitcoin" to add to the site, while Monteiro was simultaneously reading their private messages.

SQL injection → web shell → CMS access: Security researcher BR_PSD had previously demonstrated on a darknet forum that the site was vulnerable to SQL injection. Monteiro used this to inject a web shell via standard SQL-to-file-write techniques, obtaining remote code execution on the server. From there, he traversed the CMS filesystem, discovered an unused mailing component, and found the administrator's email address and password in plaintext in the component's configuration file.

Email pivot to full site ownership: With the administrator's email credentials, Monteiro gained access to the email account, then pivoted to additional email accounts linked through the same credentials, and ultimately gained access to all marketing and management accounts the administrator was using. Monteiro effectively owned the entire site infrastructure.

Covert cron-based data exfiltration engine: Rather than a one-time data dump, Monteiro (later with Miller) built a persistent intelligence operation. They installed a cron job on the server that ran silently on a schedule, intercepting all new kill orders as they arrived, packaging them into an AWS data lake, loading them into an operational database, and then into an investigator's database with enriched OSINT. This engine ran for years without being detected, providing a real-time stream of active murder-for-hire solicitations.

Yura's sprawling criminal empire: The site was not a single darknet marketplace. It was the hub of a network including: a clearnet "hitman for hire comparison site" that was so well SEO-optimized it appeared above the New York Times in Google searches for "hire hitman"; multiple assassination market site brands that Yura kept recycling; a franchised codebase sold to other operators; a fake darknet escrow service; and a "scam as a service" empire running in parallel. Every site in the network was under Monteiro and Miller's surveillance.

175 paid kill orders, 32 arrests, 28 convictions, 180 years of prison: Over three years of operation, the team disclosed 175 paid kill orders to law enforcement and targeted individuals worldwide. The resulting prosecutions include multiple cases across the United States, Australia, Europe, and other jurisdictions.

Technical Deep Dive

▶ Watch: And that was all connected to a whole fake darknet escrow service that Eura wa (18:00)

Initial Access and IDOR Exploitation

The Besa Mafia 2 site's messaging system assigned sequential integer IDs to each message thread, and this ID was passed as a URL parameter. There was no session-based access control on message retrieval — any request with any message ID would return the corresponding message regardless of who sent it. This is a textbook Insecure Direct Object Reference (IDOR) vulnerability.

Monteiro's Python script:

1. Determined the highest message ID from his own (fake) order.
2. Iterated from 1 to that maximum, making a GET request for each ID.
3. Stored all returned message content.

The result was a complete chronological archive of every kill order and every administrator-client conversation on the site — the raw material for the kill list. Each conversation included the target's name, address, photograph, sometimes their daily routine, and the Bitcoin payment amount. Messages were often long and explicit, with clients providing detailed justifications for why they wanted someone killed.

Web Shell and CMS Traversal

The SQL injection vulnerability allowed writing a PHP web shell to the web-accessible filesystem via MySQL's INTO OUTFILE or LOAD_FILE functions (the classic MySQL-to-webshell pathway), or through SQL injection into file write operations in the application code itself. With code execution on the server, Monteiro traversed the directory structure to identify:

• The CMS database credentials (typically in a config.php or equivalent)
• The mailing component configuration file with plaintext admin credentials
• The server's .onion private key (which Monteiro exfiltrated — allowing him to take over the hidden service address if needed)
• All stored customer data from the CMS database

The Intelligence Engine

The covert intelligence operation built by Monteiro and Miller:

1. Cron job persistence: A script installed as a cron entry on the server ran at regular intervals (likely every few minutes to every hour), querying the site's database for new orders and new messages since the last run.

1. AWS data lake ingestion: New orders were streamed to an AWS S3 bucket, with timestamps and structured data extracted from the raw message content.

1. Operational database: A relational database layer stored normalized kill order data: target name, target location, target photograph URL, payment amount and status, order timestamp, operator (Yura) response messages, and OSINT-enriched fields.

1. Investigator database: A higher-level layer linking individual orders to Bitcoin transaction data, enabling correlation of which orders had confirmed payments attached and which were unpaid inquiries.

1. OSINT enrichment: For each target, OSINT work was performed to identify the person, their address, their Facebook profile (most photographs uploaded with kill orders were Facebook profile pictures), and any publicly available contact information.

Bitcoin Payment Tracing

Bitcoin's blockchain is public, so all confirmed transactions to the site's wallet addresses were visible. Yura published Bitcoin wallet addresses for payment on the site. By correlating payment timestamps against order timestamps and payment amounts (often matching the requested kill price), the team could determine which orders had been paid. Paid orders were treated as higher-priority disclosures.

The Warning Operation

The challenge of warning targeted individuals was substantial:

• Calling a stranger to tell them someone has paid to have them murdered is inherently implausible — most people hang up immediately.
• Warning a target when the person who placed the kill order might be present with them at the time of the call risks triggering the perpetrator to act.
• Law enforcement was largely unresponsive: the Metropolitan Police conducted a wellness check on Miller's house rather than investigating the site; Interpol stripped the disclosed information and sent generic threat warnings to local forces rather than coordinating a prosecution.

The team's evolved strategy:

1. Indirect approach: Make vague initial contact referencing "information relevant to your safety," ask for a safe location and time for a follow-up conversation, avoid naming the specific threat until the target is somewhere private.
2. Network of local journalists: Unable to travel themselves during COVID, Miller and Monteiro built a global network of local journalists who could approach targets in person in their own countries — knowing the target's name, photograph, and approximate location from the kill order data.
3. Elena (Zurich): The first successful warning. A Swiss journalist drove to Elena's apartment, made contact, and connected her to Miller via Zoom. Elena — a woman in her 50s in a bitter divorce dispute — took the news remarkably calmly and recognized her estranged husband as the likely perpetrator. Police later arrested the husband and found a rented room adjacent to her apartment containing an AK-47, Glock 9mm, submachine gun, zip ties, a rubber mask, GPS trackers, and other murder-planning materials.
4. Working with the FBI: After the initial law enforcement frustration, the team developed a strategic disclosure relationship with the FBI, which distributed cases to relevant jurisdictions globally.

Scale of the Operation and Perpetrator Profiles

The kill list revealed a pattern: the perpetrators were overwhelmingly ordinary people in personal crises, not organized crime.

• Kelly Harper (Wisconsin): A hospital administrator and former children's charity founder, locked in a custody battle, paid $2,200 for a hit on her husband Travis.
• Christopher Pence (Utah): A Microsoft IT security technician, father of 11 (including 5 adopted children), paid $16,000 to have the biological parents of his adopted children killed to prevent contact. Arrested at Barcelona Airport by 14 FBI agents; a pink Post-it note in his home safe read username: SCAR215, password: Mufasa.
• Ron Ilg (large order): A neonatologist who ran a charity for women with addiction issues, placed a $60,000 order — the largest seen — to have a woman kidnapped, forcibly addicted to heroin, and offered monetary bonuses for additional compliance conditions. Currently in prison; attempting to sell his life story as "50 Shades of Gray on steroids."

Demo / Proof of Concept

▶ Watch: You saw there was one in Paris, there was one in Slovakia, there was one in H... (24:45)

Miller presented the talk as a narrative rather than a technical demo, but included:

• The original Besa Mafia 2 site screenshot (a crude 1990s-style web page with clip art imagery).
• The administrator's desktop screenshot accidentally uploaded to the site's template directory.
• Anonymized kill order examples (names redacted, locations and amounts provided).
• Audio clips from the first warning calls (recipients hanging up immediately).
• The Zoom recording of the Elena warning conversation.
• Court documents and news coverage from 32 prosecutions worldwide.
• A schematic diagram of Yura's full criminal empire (comparison site → assassination sites → escrow service → scam-as-a-service).

Defensive Implications

▶ Watch: and I could not convince her not to go. (32:24)

For darknet service operators (adversarial perspective):

• Sequential integer IDs in URL parameters without session-based access control are exploitable in minutes. Any object that should be access-controlled must validate session ownership before returning data.
• Directory listing in Apache/Nginx must be explicitly disabled.
• CMS components with plaintext credentials in configuration files represent high-value targets for post-exploitation pivoting.
• Any server-side persistence by an attacker (cron jobs, web shells) can run silently for years if there is no integrity monitoring.

For law enforcement:

• The geographic diffusion of kill orders — targets in multiple countries — is itself a feature of these platforms that prevents any single jurisdiction from taking comprehensive ownership. The case argues strongly for standing international coordination mechanisms specifically for darknet assassination fraud with victim protection dimensions.
• The FBI collaboration model (team discloses to FBI, FBI routes to local jurisdictions) worked better than direct disclosure to multiple forces simultaneously.

For people who receive unexpected safety warnings:

• The scenario explored here — a stranger calling to say someone paid to have you killed — is real and verifiable. The instinct to hang up is understandable but potentially dangerous. Any persistent, multi-channel warning (telephone + journalist + documentation) should be taken seriously regardless of how implausible it sounds.

Key Takeaways

• An IDOR on sequential message IDs with no access control, combined with an Apache open directory and a SQL injection-to-webshell chain, gave complete and persistent access to an entire darknet assassination site empire and years of criminal activity.
• A covert cron-based data exfiltration engine installed on the compromised server ran for years without detection, providing real-time intelligence on active murder-for-hire solicitations globally.
• 175 paid kill orders resulted in 32 arrests, 28 convictions, and 180 years of prison time — demonstrating that sustained, methodical darknet intelligence work with coordinated law enforcement disclosure produces concrete public safety outcomes.
• Perpetrators of darknet murder-for-hire solicitations are primarily ordinary people in personal crises (divorce, custody disputes, personal vendettas), not organized crime — with real weapons and real capacity for violence.
• The operator (Yura) was a marketing genius who built an elaborate social-proof infrastructure including a SEO-optimized clearnet "comparison site" appearing above the New York Times in Google, while simultaneously being so operationally insecure that an IDOR gave complete site access to anyone who discovered it.

About the Speaker(s)

▶ Watch: was a username, SCAR 215, and there was a password, Mufasa. (39:09)

Carl Miller is a researcher at the Centre for the Analysis of Social Media at Demos, a UK think tank. He is described as a "mild-mannered think tanker" who was drawn into this investigation through his collaboration with Chris Monteiro. He has written about online radicalization, social media manipulation, and the criminal economy of the darknet. This investigation consumed years of his professional life alongside his regular research work.

Chris Monteiro is a system administrator by day and darknet investigator by night, based in London. He has a deep background in cyber crime economics, darknet reputation systems, and exit scam analysis. He was unable to attend DEF CON 33 in person due to visa issues; Miller presented the talk on behalf of both. Monteiro's original technical work — the IDOR discovery, the SQL injection, the email pivot, and the intelligence engine — forms the technical backbone of the entire investigation.