Accessibility links

Breaking News

Exclusive: Digital Trail Betrays Identity Of Russian 'Hacker' Detained In Prague


A screengrab of alleged Russian hacker Yevgeny Nikulin
A screengrab of alleged Russian hacker Yevgeny Nikulin

PRAGUE -- An investigation by Current Time TV has determined that the Russian national accused by American officials of hacking U.S. targets and arrested earlier this month in the Czech capital is 29-year-old Moscow resident Yevgeny Nikulin.

Czech authorities this week said the suspect was detained in downtown Prague on October 5 in response to an Interpol warrant requested by the United States and now faces a Czech extradition hearing.

Czech police and local media have identified him only as "Yevgeniy N," and the Russian and U.S. governments revealed only that he was a Russian citizen.

The investigation by Current Time, which is run jointly by RFE/RL and VOA, uncovered Nikulin's Instagram account under the handle "i.tak.soidet," displaying a taste for luxury cars and jewelry and a digital trail that led through Belarus and Poland to the Czech Republic in the weeks before the Prague arrest.

WATCH: Czech Police Arrest Russian Accused Of Cybercrimes

Czech Police Video Identifies Russian Arrested For Hacking
please wait

No media source currently available

0:00 0:01:11 0:00

The Instagram account went private shortly after Current Time's Russian-language report was published on October 20. Soon after that, Russian Foreign Ministry spokeswoman Maria Zakharova confirmed Nikulin’s identity for journalists in Moscow.

"The Russian Foreign Ministry and the Russian Embassy in Prague are actively working with the Czech authorities to prevent the extradition of a Russian citizen to the United States," she added.

The Instagram account contained numerous photographs that included a gold Rolex watch, a distinctive bracelet and sneakers, and a luxury Mercedes AMG GLE63 automobile that all match items shown in a video of the arrest released by Czech police.

A social-media friend of Nikulin's who asked not to be identified told Current Time that Nikulin was "an idiot" for traveling abroad and that "he knew about Interpol."

The last post to the i.tak.soidet Instagram account appeared on October 11, six days after Nikulin's arrest. It is a simple text message that says, "I will return soon, what's all the fuss?" and was tagged "Prague Old Town."

LinkedIn Hack

One of the Instagram road photos from the days before the detention shows Nikulin's Mercedes apparently in Poland, and has a comment from a user asking, "What about Interpol?"

Current Time was also able to learn the license-plate number of Nikulin's Mercedes, which appears to match the blurred number shown in the video released by the Czech police

It is unclear exactly what role Nikulin is suspected of playing in the alleged U.S. website hacks or even which websites were involved. A spokesperson from the U.S. Embassy in Prague confirmed that a Russian had been detained who was "suspected of hacking U.S. targets."

Hours after news emerged of the arrest, the professional networking service LinkedIn issued a statement suggesting the development was connected to a 2012 breach of its members' information. In May, LinkedIn acknowledged that intrusion compromised more than 100 million of its users' passwords.

The social-media friend who spoke with Current Time described Nikulin as "a young genius" who "now will be working for the government in the United States." The i.tak.soidet Instagram account, however, does not hint at any specific expertise in computers.

The i.tak.soidet account is popular, with nearly 44,000 followers and most of his posts garnering hundreds, or even thousands, of "likes."

'A Successful Entrepreneur'

In a 2015 interview with the Russian car website AvtoRambler, Nikulin describes his experience of owning Lamborghini cars. He is described as "a very busy young man."

"Yevgeny is already a successful entrepreneur whose business interests include a construction firm, an automobile service garage, and a company that sells luxury watches. As you can see from our interview," the article states, "the Huracan is not his first Lamborghini."

He boasts of owning a Bentley, a Continental GT, and a Mercedes-Benz G-Class.

No date has been set for Nikulin's extradition hearing, but Czech authorities said the man would remain in custody until that process.

The Russian Embassy in Prague told Current Time that Moscow will be seeking his return to Russia. Moscow, an embassy source said, rejects "the U.S. practice of forcing the entire world to enforce its extraterritorial jurisdiction."

Interpol had issued a so-called Red Notice for the alleged Russian hacker, a designation for "wanted international fugitives."

President Barack Obama's administration on October 7 explicitly pointed to Russia as the alleged director of recent cyberattacks and leaks seemingly aimed at disrupting the U.S. elections in November, citing e-mails and digital intrusions on a range of election-related institutions. A week later, Vice President Joe Biden said the United States was "sending a message" over Russia's apparent role in the digital attacks and Russian President Vladimir Putin would get it.

Putin's spokesman and other Russian officials have downplayed such allegations and suggested that they are "dirty tricks" and Americans should pay more attention to the information contained in the leaks.

RFE/RL has been declared an "undesirable organization" by the Russian government.

If you are in Russia or the Russia-controlled parts of Ukraine and hold a Russian passport or are a stateless person residing permanently in Russia or the Russia-controlled parts of Ukraine, please note that you could face fines or imprisonment for sharing, liking, commenting on, or saving our content, or for contacting us.

To find out more, click here.

XS
SM
MD
LG