Draft Notes: Additions to the NET-WORKER Analysis

Draft Notes: Additions to the NET-WORKER De-anonymization Analysis
(without editing or structure, raw drafts) for researchers
Appendix to the article
👉 De-anonymization of NET-WORKER via Telegram metadata, GIBDD fines, and flights
The simplest and most accessible source for de-anonymization in this case is the GIBDD fines. They can be easily obtained from several sources if you have the vehicle license plate number; sometimes the STS (vehicle registration certificate, not to be confused with PTS or VIN code) is also required. Let’s take Aleksey Kurashov: we know he has a Lamborghini Urus vehicle registered in the name of his biological sister, who lives in Veliky Novgorod, but he is the only one who uses the car. How do we know this? 
First, between 2023 and 2025, he violated traffic rules more than 600 times on this vehicle, recorded by road cameras, and anyone can obtain records of these violations. Go to the Avtokod website, or Nomerogram, or Avinfo and order a report on the vehicle by license plate В888ТК53 (important: enter letters in Cyrillic). 
Also on the Nomerogram website, you can see photos of this vehicle, and there are quite a lot of them. Here, we see this vehicle in parking space 3027, which is owned by Aleksey Kurashov, as well as the adjacent parking space where a Tesla Cybertruck with license plate А469МР77 is parked — this is Kurashov’s second vehicle. More than 250 traffic fines are registered on it. All fines on both vehicles are paid. There are several photos showing this vehicle in that parking space on different dates — in 2024 and 2025 in various months. 
The Tesla Cybertruck is registered to a woman — Kuznetsova Anastasia Sergeevna, born 06.01.1998 — she is the deputy general director of LLC “MarsRobotics” — this is Kurashov’s company, where he is the owner (general director). But he is the only one who uses the vehicle; Kuznetsova is just a front person (trusted person).
Kuznetsova Anastasia Sergeevna, born 06.01.1998 
We also have all of Kurashov’s flights for this period — I obtained them through requests to the “Magistral” system, ordering 4 different reports from different contractors on the Probiv.ss forum, here is the link to this forum. Overall, these data complement each other. I include flights in the table from 2023 to December 2024. I took this time interval because I collected NET-WORKER account messages for a similar period — more than 10,000 messages gathered using FanStat-bot and imsg-bot sources — these are Telegram bots available to anyone (links in the main article). 
FanStat is the most popular — it has a fairly large database; imsg-bot is supplementary, it includes some closed groups not present in FanStat and older messages (for example, I found messages from Dmitry Khoroshev and Vitaly Kovalev there that were nowhere else). I combined all these messages from both sources into a single table and synchronized time zones — this is important because the two sources export message archives in different time zones.
I use the Aeon Timeline application for visual representation of the chronology. I attach the ready file with all data; you can download the application and view this timeline yourself — the app has a free trial period.Let’s conduct a simple and quick reconnaissance analysis using metadata without overloading the timeline with unnecessary details that only distract and overload the brain. At this stage, we don’t need to dive into details like the message text or what specific violation caused the fine and where it happened. 
First, look at the graph globally, at a large scale. What can we see here and what conclusions or assumptions can we make?
Next, we note the controversial points to ourselves and zoom in to see the picture not at the scale of months, but for a specific day and hour. Scrolling through the chronology by days, I immediately notice a clear repeating pattern that jumps out. Around midnight, Kurashov receives one or several fines every time, at different times but closer to midnight or after. Green dots show chat message activity, which neatly precedes or follows the yellow dot — the fine mark. They very rarely visually overlap each other, in isolated cases out of hundreds of examples (if you zoom to maximum). 
Look at these patterns and try to imagine — could this be a simple coincidence? 
Is it even possible in real life? Yes, this is a living dataset but with clear regularities.
What valuable insights can we extract from studying these data? What questions can we answer? 
I was interested in figuring out — is one person active from the NET-WORKER account or two? Is it Kurashov? 
With what accuracy and reliability can I make a final conclusion? 
Can I make an unambiguous conclusion? 
Throughout the period from September 2023 to August 2025, was it only him on this account? 
Are there any anomalies and how can they be interpreted? 
Will these data allow a final de-anonymization of the NET-WORKER account so that no one has any doubts left?
If we look at the global graph and pay attention to the two lines where violations for Kurashov’s two vehicles are marked (Lamborghini Urus license plate В888ТК53 and Tesla Cybertruck license plate А469МР77), we notice clear separations: he uses the vehicles alternately — on different days, switching between them — now one, now the other. This simple observation allows us to conclude that he alone uses these vehicles; there are no days with fines on both. 
Exceptions in such patterns are recorded only at the very beginning, on the first day after he bought the Tesla, and starting from July 2025, several such exceptions are noted. Roughly speaking, for two years he drives these vehicles regularly, daily, when he is in Moscow. These are his habits. Also, if we look at the flight strip marked on the timeline for two years from 2023 to 2024, we see the same patterns — when Kurashov is in Moscow, there are fines; when he flies away — fines disappear. 
Yes, Kurashov also owns two Mercedes-Maybach vehicles (one of them is presumably used by his father — Mikhail Kurashov). I also have fines for these vehicles, but I decided not to analyze them in the article because drivers-bodyguards are usually behind the wheel of these cars (this is visible from the fine photos).
ADDITIONAL NOTES
Separately, I want to lay out all my emerging doubts and reasonable questions that I encountered on the path from building a hypothesis to the final conclusion. This was truly a very complex case, and in some questions and details I still haven’t fully figured it out. I see documentary facts — where flights coincide with activity — and I have to believe them. I can’t find other alternative explanations or versions. With my mind, I understand that such a number of coincidences cannot be random.
From the NET-WORKER account, a teenager recorded and sent me voice messages in a young voice — I considered this a clever trick that Kurashov uses to confuse not only me but everyone else. He also sent me a live geolocation broadcast — and this is the same trick (he did similar things before, judging by his messages in chats in 2023-2024). 
Fact — this teenager is not just a drop; he is aware of what’s going on because the voice messages I received contained threats, trolling, swearing. This guy is in the know. Interesting how deeply he is involved? I noticed that NET-WORKER cleaned some dialogues, deleted all messages — probably so the teenager wouldn’t see anything extra. Perhaps he gives him instructions and information on what to say and how. Perhaps they are partners and know each other offline; perhaps Kurashov has full leverage over him — kompromat, shared secrets (I will describe a separate important observation — in a separate part, where the second NET-WORKER account with the same name and timeline match appeared in gay chats and young guys’ dating in Moscow “Cute Boys Moscow BBS”). There is also a version that the drop does not know Kurashov offline (this would be the ideal anonymization option, but it’s a more complex control variant and hard to imagine, but such a version exists). 
Stylometrically, the NET-WORKER accounts and other accounts Badfood, Target, Bloodrush — match. Their styles are different, but some words and phrases are similar (“дадада”, “don’t reach into my pocket”, “they’ll laugh at you”). I had a weak version that the teenager-NET-WORKER could have adopted these words and phrases, but stylometry works differently; individual words don’t matter to it, and even if you remove these common words I noted from the texts — the result won’t change, the matches remain. 
NET-WORKER is always arrogant, toxic, and conflict-prone. He doesn’t hold back in expressions, writes short sharp messages, often uses profanity, darknet slang. Quite often picks fights, provokes, attacks first or responds дерзко. Reacts quickly. When Kurashov is in the NET-WORKER persona — it’s an inadequate opponent playing to the audience, and moreover, his team supports him in public chats — I know all his people, identified and investigated them (a separate article should be made on these connections, how I identified Conti participants in Telegram). 
From my personal observations, NET-WORKER is equal in intelligence level to his multi-accounts Badfood, William Robinson, but those accounts write more substantive messages and communicate in a different style, while NET-WORKER is brief, trolling. I tried to imagine if I created such an account for such a role. In fact, for public activity this is very convenient, and in the darknet environment it’s even necessary. No matter how smart things you say from the main account, trolls can pile on you, and if you have a similar account with the same role — it’s your advantage, you win. Trolling, sarcasm, mockery — this is a strong dominant role; dominating purely with intellect and eloquence is sometimes much harder. It’s hard to explain; you need to be in a Telegram chat with the community, argue, fight in discussions, defend some complex truth that they try to question and portray you as a clown. When a team of 2-3-5 people attacks you and coordinates their actions while you’re alone — messages with questions and remarks rain down on you; it’s quite difficult to respond to everyone. I’ve had such “press conferences” lasting several hours. Once I typed non-stop for 5 hours. I had to seize the initiative and not let myself be put in a weak position (in the end, they pressured the admin of Tor Zirael Chat and he deleted all my messages entirely, but I managed to save a copy and forward it to my group — there I exposed two other Conti participants and another NET-WORKER multi-account — BadFood). It’s important not to fall for provocations, not to descend into insults, but to impose your own narrative and push your topics — this requires cognitive effort and reaction. Such a “discussion” doesn’t always go according to your script; a lot of unpredictable things happen in a public chat. This is a harsh variant of HUMINT, but it yields valuable results. Sometimes I analyze chats with AI to impartially assess the hierarchy in the chat, who dominated, who lost, who was stronger/weaker, what roles everyone had. This is interesting analytics for operational play. Sometimes more than 80 people are online in the chat actively communicating, and you come in with your topic — throw a meme or photo/picture, and against you there’s a team of 3-5 people, while the rest may not be interested but are still participants and express opinions — criticize or support. When you feel support, when someone helps you, even subtly but at the right moment shuts down some combat troll with IQ 80 who interferes, jumps into the conversation, interrupts — that’s always important help. You always notice it. Thanks to such people. (a lot of text written, shorten). 
Kurashov (Target), from my observations, began using the NET-WORKER account in spring/summer 2023; there is a message history from March 2023 on the previous NET-WORKER account @net_worker_support (with two “p”s), but that account was blocked (he lost it — there are references and mentions), and he created a new account @net_worker_suppport (with three “p”s) in July 2023, but started being active from September. This is an interesting find that I didn’t have before and hadn’t analyzed. His first messages are quite adequate and polite, the style is not toxic; then the communication begins as an arrogant imbecile (though smart, with intellect). I will analyze this account and include it in the general timeline, compare it with flights too, and for some reason I’m sure it will match just as precisely. 
Another version: the teenager is a fan of Kurashov, a young hacker or something like that; perhaps he’s self-taught or knows terms and topics; perhaps he’s allowed to read but not write. I’m sure his role is only for voice; if he starts typing — it will immediately become noticeable that two different people are communicating. I repeat, this is a version, a hypothesis. I couldn’t detect the presence of two people from messages, style, or differences in spelling habits; perhaps they exist; perhaps at some point the teenager answered something himself — I don’t rule it out. Perhaps at some point Kurashov decided it was suspicious and forbade him to type. When needed, Kurashov gives him a command to say something by voice. A fanatic explains a lot. Perhaps he pays him, perhaps not. Perhaps he teaches him something or the guy self-learns in darknet topics or infosec, understands OPSEC. Target (Kurashov) may be a sacred mythical figure in his eyes, a legend, a cult, a true leader from whom he takes example or tries to imitate. He is clearly young; if it’s Kirill Panteleev — he turned 18 a month ago, on November 10. So if they’ve been interacting somehow since 2023 or he’s his drop, then at that time he was 15. Such a variant is quite possible. Interesting only how and where they met, if they have anything in common offline; if not, do they communicate by voice or only text. Kurashov is paranoid; in principle, it’s possible the teenager doesn’t know him offline, at least didn’t before — because after my investigations the teenager started covering for Kurashov, claiming he’s not Target, that he’s a minor hacker, that law enforcement won’t do anything to him because of that. He mocked, swore, insulted, tried to convince me (and at the very beginning he even succeeded — made me doubt, which is why I conducted an additional more thorough investigation). 
The teenager’s identity is not exactly known to me. There is a version that it’s Panteleev Kirill Mikhailovich born 10.11.2008, but I have reasons to doubt this because the video that was spread in a Telegram public — perhaps it was a NET-WORKER (Kurashov) plant; no one knows when it first appeared or from where. Perhaps someone really de-anonymized the teenager (the voice in this video is similar to the voice messages I received from NET-WORKER); photo search yields these full name — Panteleev, but this could also be a mistake; I still can’t unambiguously identify Panteleev’s identity. 
Why does Kurashov need all this circus — posing as a young дерзкий hacker? Why this legend that he maintains so diligently for almost three years? From his messages in some cases, one could conclude that he “swims shallow,” earned relatively small money from DDoS attacks (although in some cases this is status if it’s known that state corporations of the Russian Federation like Gazprom, Rostec, and even special services pay him — that’s already a serious indicator). I will return to this topic below and describe versions.

What do we need this multi-page timeline for? What can we see on it? The most important thing is that we can visually assess periods of intensive communication (activity) of the NET-WORKER account in Telegram chats; they are marked with green dots — these are the most important segments for us, which we will compare with other events (flights and Kurashov’s fines). On segments where this activity is absent — those days are useless to us because there’s nothing to compare them with. You can see some long periods of absence in Telegram — days/weeks, and even a couple of months — July-August 2024.
DATA GAPS
In some places, flight data is missing; for example, there is a departure from Dubai to Moscow on 30.08.2024 15:15:00, but before that there is no information about the flight when Kurashov arrived in Dubai. Shortly before that, there is only a record that he departed on 23.08.2024 14:30:00 from Sheremetyevo (Moscow) to Sochi. Apparently, from there he flew to Dubai for a few days on those dates.

01.09.2024 21:10:00 GIBDD fine А469МР77
01.09.2024 19:14:00 GIBDD fine А469МР77
30.08.2024 20:40:00 flight DUBAI (DUBAI) UAE DOMODEDOVO (MOSCOW)
30.08.2024 15:15:00 flight DUBAI (DUBAI) UAE DOMODEDOVO (MOSCOW)
27.08.2024 19:13:10 fuck the steering wheels Abbadon Chat
24.08.2024 17:22:13 InterForum (chat)
23.08.2024 14:30:00 flight SHEREMETYEVO ANTALYA
23.08.2024 09:55:00 flight SHEREMETYEVO ANTALYA
17.08.2024 12:53:00 GIBDD fine В888ТК53
16.08.2024 22:50:00 GIBDD fine В888ТК53
16.08.2024 15:40:00 GIBDD fine В888ТК53
Let’s try to imagine how an intelligence analyst would use this dataset and the timeline tool (chronology).What do we have and what can it give? For this period we have the following data that can be entered into the general chronology and checked if it fits or if there are anomalies:
BTC address of Target and transaction time 
old secret Kurashov account (NET-WORKER) for gay dating 
name Blood from BlackBasta chats, which belongs to Target, and his correspondence with GG (Trump)

From flight data we can have a fairly accurate idea of the place and time where Kurashov was. Country — in RF or outside RF, and if in RF, then in Moscow or not in Moscow. Of course, data within RF may be incomplete — for example, he could have gone to Piter on Maybach with a driver (it’s worth analyzing fines for Kurashov’s two Maybachs too, but I established that he rarely uses them; mostly drivers transport someone — this is a separate topic I will describe in another part).
Flight data ends in December 2024; for 2025 there are no flight data presented. However, GIBDD fine information covers the period from June 2023 to December 2025. What does this give us? By analyzing and comparing flights with fines, we see a pattern — if Kurashov is not in Moscow — there are no GIBDD fines either. This is important. When Kurashov is in Moscow — fines are almost every day; rarely does he go a couple of days without fines (this is an approximate pattern). 
So, if in 2025 we have no flight data but see a whole week without fines — we can assume with high probability that he flew out of Moscow. For example, from October 26, 2025 to November 3, 2025 no fines — we can assume Kurashov was at the Blockchain Life conference in Dubai, especially since NET-WORKER posted a video recording from the UFC championship that took place there at the same time in his Telegram channel.
It’s also worth noting that we may lack some precise data. According to one “Magistral” source, there is a record that Kurashov was in UAE 15.10.23 – 22.11.23 UAE. It is reliably established that he flew to UAE exactly on 15.10.23 16:55 – 15.10.23 22:10 from Domodedovo to Dubai flight EK134. However, there are no exact details that he returned on 21.11.23 15:15 – 21.11.23 20:50 from Dubai to Domodedovo flight EK131; there is only a record in the “Magistral” report, but it may be erroneous — perhaps he just booked a ticket and canceled it (but didn’t board; perhaps the cancellation mark is simply not indicated). 
According to border control data, Kurashov returned only on January 31, 2024 from UAE (no time or flight data, only border crossing mark and date). And on the timeline we see that there were indeed no GIBDD fines in Moscow during this period; such cross-checking increases accuracy. Yes, the “Magistral” system can also have errors in reports; I ordered 4 different variants from different sources + two variants of “Border” reports from different sources. They all complement each other. 
Also in the “Border” database report there is no flight time, only date. It should also be explained that the “Magistral” system is a ticket purchase system; it contains information about purchase/booking/boarding/cancellation dates. These are important fields. I will attach this table and all reports I used as data sources.It should also be explained that, for example, when there is a record that Kurashov departed from Moscow to Dubai, while in UAE he could have flown to other countries, and we don’t have that data. Similarly, there are records that a person departed from RF to Turkey, but in reality he could have flown further, and we don’t know where he went. Turkey is transit.
There are also NET-WORKER mentions, quote:
17.11.2023 17:30:58 recently was in China at a military factory and exhibition, maybe I’ll send photos
17.11.2023 17:31:08 Chinese made missiles, special for F-16
17.11.2023 17:31:25 they will defocus F-16
17.11.2023 17:31:42 minus radars etc., the faggot sees nothing, guidance system fucked
17.11.2023 17:31:45 so Rostec
17.11.2023 17:31:52 now wants to buy such missiles
17.11.2023 17:32:03 I work with serious people)
17.11.2023 17:32:57 it’s not scary to send such, they won’t deanon)
17.11.2023 17:34:17 just sent a photo that I was)
17.11.2023 17:38:21 now Leopard 2A7
17.11.2023 17:38:25 preparing A8
17.11.2023 17:39:28 I already passed their projectile characteristics
 
It is quite likely that Kurashov flew to this exhibition in China from UAE, and we don’t have the flight date. But we can check when similar military exhibitions he mentions took place and do a small fact-check if it’s possible. So, I managed to find only two suitable exhibitions in 2023: 
CIDEX — China International Defence Electronics Exhibition 2023 (Beijing) – June 26–28, 2023. Theme: radar, electronic warfare, command and communications, anti-drone, etc. — perfectly matches phrases “minus radars”, “defocus F-16” (hint at jamming/blinding radar). But this was ~4.5 months before the correspondence — can also be called “recently”, but weaker in time than Tianjin. eng.mod.gov.cn 
China Helicopter Exposition 2023 (Tianjin) – September 14–17, 2023. Exactly in China, ~2 months before the correspondence (realistic for “recently”). Format: helicopters, UAVs, armament for them. Tradeindia

Judging by available data, he could have been at CIDEX in June and flew to it from UAE since he was there from June 24 to 30. The September exhibition doesn’t fit the chronology; Kurashov was in Moscow those days. Perhaps there were other exhibitions in China; this should be clarified — I found only these two suitable ones.In short, NET-WORKER in one chat (Smoke vid everyday) started telling how cool a pentester hacker he is, how he works for FSB Cybersecurity and serious state companies (ROSTEC), how he steals and sells military secrets, how he was at a military factory in China. They started mocking him there, trolling him, and he fell for the provocation and started telling a lot, showing photos
(later he freaked out and left that chat, but didn’t clean everything after himself; I recovered some of his messages). I fact-checked, and indeed he told sensitive things.
Considering that Aleksey Kurashov really has many opportunities — in Conti he broke into closed military networks (this is in leaked chats) and works with special services — he really spilled a lot of “extra” things. For this he could even face criminal prosecution under the state treason article.Here are some quotes from NET-WORKER from that group:

17.11.2023 17:39:54 say why t14 didn’t go into mass production?
17.11.2023 17:40:37 there was a problem somewhere, I won’t say exactly where. knds makes exactly the same tank “Leclerc”, direct copy of t14, only with laser installations, satellite guidance and something with AI
17.11.2023 17:40:47 I’m working on it now)
17.11.2023 17:41:17 on stealing info)
17.11.2023 17:42:33 that’s what you think)
17.11.2023 17:42:55 this is what the soldier tells me…
17.11.2023 17:43:09 not a specialist in ib or similar
17.11.2023 17:43:39 are you stupid or pretending? do you know what ftp servers are? contract companies on whose servers copies are stored
17.11.2023 17:43:47 this is how it is in rf idiot…)
17.11.2023 17:43:50 in eu prohibited
17.11.2023 17:43:52 say why?
17.11.2023 17:44:07 5 people wanted to bribe a knds employee
17.11.2023 17:44:19 bnd fucked them immediately
17.11.2023 17:44:32 german intelligence
17.11.2023 17:45:10 there is a ton of information outside the site walls
17.11.2023 17:45:30 you’re dumb apparently
17.11.2023 17:46:00 I’m talking about barrels?
17.11.2023 17:46:13 I’m talking about future nato tank characteristics
17.11.2023 17:46:25 rf couldn’t handle t14 into mass production
17.11.2023 17:46:28 leclerc moron
17.11.2023 17:46:35 read what I write
17.11.2023 17:48:04 okay soldier, health to you. you seriously frayed my nerves with your nonsense)
17.11.2023 17:51:52 this is the rf government fuck
17.11.2023 17:51:59 wants to know how germans and french
17.11.2023 17:52:02 will fix the problem
17.11.2023 17:52:11 that arose in rf production
17.11.2023 17:52:33 yes, what about facts
17.11.2023 17:52:57 this is a task from the new department
17.11.2023 17:53:06 well new colleagues(I gave examples; there are more messages on similar topics — see the table)
What other data do we know about Kurashov (and Target) that we can plot on the timeline and general chronology table?We know when Target (Kurashov) made a transaction of 1075 BTC to his wallet bc1q4jqt2tm3mw76fq5gfm4zruvy79rxcwnjedkr07 (08.03.2024, 06:10:00 UTC+3). Strange, March 8 — maybe he made a gift to his beloved girl?We know that in Conti chats Target asks Bentley to register a Jabber for him with the name Blood.
2021-10-25 14:57:59 bloodrush bentley 
bentley I’ll ask you to reg a jabber for me outside TOR
and add there + add there so that KHORS, Dooms, Deploy, Buza authorize all of them there
so they can all write and I’ll pop up there jabber name blood2@....
In BlackBasta chats there is a participant named Blood. And there are his dialogues with GG (Trump) in 2024. Blood is Target from Conti; there are other facts pointing to this. Since it’s established that Target is NET-WORKER, I decided to check what happens if we add Blood’s messages from BlackBasta to the general table (timeline) too — see if they fit the chronology alongside NET-WORKER messages, Kurashov’s fines and flights, or not. And if contextual similarities can be found — then Blood-NET-WORKER-Kurashov-Target can be linked all at once. It fit perfectly. Blood messages in the table are highlighted in red for clarity:


I also managed to find another NET-WORKER account that he used.This fit into the timeline and I concluded that it’s not a random coincidence; just 4 days (from December 20 to 24, 2023) NET-WORKER was completely absent from his main account — no activity. And on December 22, 2023 there was activity on his other account.I found his previous account with the same name. And I also managed to establish that it is indeed his account, not a simple coincidence or setup.
This is NET-WORKER (https://t.me/networkler)
From 22.12.2023 to 22.12.2023
2 messages in 2 chats ID: 6515087017
usernames:
| @networkler | @REZAKKL | @olgaperl1 Names:
├ 08.01.2024 -> NET-WORКER
├ 08.01.2024 -> AнфисаВалеревнα
├ 22.12.2023 -> REZAK
├ 12.12.2023 -> ОленькаТаро
And this account appeared in the following groups and chats:Chats of account 6515087017.
-private, -left
Last message - chat (total messages)22 Dec. PRIVATE TIK TAK CHAT (https://t.me/razdazha93/27280) (1)
22 Dec. CᴜteBoy's BBS Moscow (https://t.me/+Vd2cetsKQtA3MzA6) (1) — Moscow gay dating boardObserved but no messages:
├  Rainbow Chat (https://t.me/+ATUe0_fDr1E0Mjgy) — homosexuals chat
├  DARK PLACE |HACKING REF.. (https://t.me/c/1297405041)
├  Lolzteam services | chat.. (https://t.me/Lolzteam_services)
On the main account NET-WORKER had a name like
├ 04.10.2023 -> |S|C|A|M| [WORK] | he only renamed
├ 24.04.2024 -> NETWORКER
├ 24.04.2024 -> NET-WORKER (such name he has to this day)
but on the other account the name NET-WORКER was set three months earlier. Here is the name history of that account
├ 08.01.2024 -> NET-WORКER
├ 08.01.2024 -> AнфисаВалеревнα
├ 22.12.2023 -> REZAK
├ 12.12.2023 -> ОленькаТаро
I’m talking not about username, but specifically about the display name. And in the chronology strange things are visibleand also on December 22, 2023 he created his Telegram channel with erotic hentai https://t.me/hentaibunnker
this was established from his message in the PRIVATE TIK TAK CHAT group, here is this message
“The end of a long working day came too slowly. Exhausted, I decided to relieve stress and relax. One tempting idea came to mind — join an erotic channel in Telegram t.me/hentaibunnker.”
According to one version, Kurashov was in Dubai at that moment. He took one of his anonymous accounts, joined a Moscow gay dating group, found himself a guy, agreed, bought him a ticket to Dubai. In 5-8 hours he could already meet the guest.
I think this account was for such “entertainments”; at that time it had the display name REZAK, but later perhaps he needed the account for other purposes; he considered it insignificant that this account had a small history (hoped it wouldn’t surface), and on 08.01.2024 renamed the account first to AнфисаВалеревнα, and the same day to NET-WORКER. Later, three months after, he set the name NET-WORКER (exactly in this spelling, with hyphen not together) on his main account and never changed it. and username @REZAKKL he transferred to another account id7409063180 — apparently this account is used for gay communication. It is still not deleted, but last activity on it was at the end of 2024. name REZA_:RMZ.66;$ (strange abbreviation). 
I checked the avatar photo — it’s a young man photo from the back, photo taken in Berlin by professional photographer Karen Tomboy, who posts his works on pinterest https://tr.pinterest.com/alexanderpocholate/ here is the link to the avatar photo https://tr.pinterest.com/pin/691513717821166190/. also a similar photo appears in Telegram channel https://t.me/dlo0oh but this trace also leads nowhere; perhaps coincidence or someone just borrowed this photo. Also quite possible this account does not belong to Kurashov, but someone with the same name later took the username.
Also we don’t know how many such anonymous accounts Kurashov could have created; only this one surfaced where he so carelessly set himself the name NET-WORКER but didn’t use it as main; perhaps abandoned it altogether because he doubted the history might surface.
Regarding username
he now has net_worker_suppport (with three P), earlier was @net_worker_support (with two P)
could he have come up with the next shorter username networkLer? — I think he could. No good free variants left; others successful all taken, unless make with four P, but that would look completely stupid.To sum up briefly regarding the version of Kurashov’s gay inclinations.
I made the conclusion only based on three matching details — there was a period of absence of activity on the main NET-WORKER account (he gave himself a weekend), during this period on December 22, 2023 there was activity in gay chats and creation of his channel filled with erotic content (Japanese hentai cartoons, not gay, just erotic), and later this account acquired the name NET-WORКER for a while. And three months later this name became the main name of NET-WORKER. I would have doubts if it didn’t fit the timeline, but it fit exactly.
ADDITIONAL NOTES
For me it was a mystery whether really one person — Kurashov — is on the NET-WORKER account. Many indirect contextual data made me doubt this. I try to find a rational logical explanation for this. Why does an adult with hundreds of millions of dollars constantly sit in chats? perhaps these are his serious projects, complex ones — infiltrating trust of certain persons (such as Moriarty — owner of the largest drug market, LockBitSupp, perhaps other serious players I don’t know yet). 
If he could reveal the identity of LBS — then in perspective he could capture his project too. Quite an ambitious goal, but his capabilities allow both reconnaissance of crypto-mixers, transactions, wallets, and later forceful capture of the leader himself, take all his assets (over 500 million dollars), and most importantly — the business, ridding the market of one of the most powerful competitors, heading his whole operation and practically monopolizing the “industry” or a large part of it. This would give enormous influence. 
Perhaps for such a project all these tricks, legends, time, effort, etc. are not a pity. NET-WORKER (Target) admitted to me that he launders crypto for LBS for a percentage. He didn’t even admit — he blurted it out when I started provoking him, mocking that he’s an ordinary “advert,” and that LBS is his boss while he himself is not a partner but a subordinate. This hurt Target; every time it hurts (I trolled him about this several times both in PM and in chats), and every time he tried to boast to me that he’s a close partner, that they are equals (since financial status is roughly equal). 
NV that time gave me consent to publish our dialogues; I’m sure he regrets it now. It turns out the project to capture LB revolves around him. This is the goal of T NV. Hence the design of the legend that he’s a young genius hacker, he has fast and loud successes, the whole Russian darknet knows him, no one doubts his coolness. I suppose this is how he declared himself, drew attention to himself, made even more contacts in the ransom community. His loud victories built his reputation. 
Yes, he made many enemies, but his resources and capabilities allowed him to win, destroy them. After Conti, he started from zero; the story that he’s T should be buried and never retrieved. From such dangerous and toxic acquaintances and connections any serious player will distance himself to not become an object of serious FBI and FSB investigations; he didn’t do the rebranding of his personality for nothing, rebuild partner connections — and this is not simple. It takes time, a lot of work and risk again. 
Yes, his experience in C and previous projects shaped him into a dangerous and cunning player; however, he is human, has vulnerabilities he hasn’t gotten rid of. Ego. Vanity. Boastfulness. Emotions. Conflict proneness. Talkativeness (yes, he is talkative, especially when he gives in to emotions or falls into a provocation trap). And other human weaknesses will sooner or later play against OPSEC. And this is a direct path to de-anonymization. 
De-anon is loss of invulnerability. Seriously threatening an anonymous person is impossible. But when your identity is open — your attack surface is open. Anonymity cannot be bought with money once lost. If you’re exposed — your main human vulnerabilities are exposed too; tons of information can be dug up about you and your relatives, friends, acquaintances. About your habits, biography, business. You can no longer threaten others equally in chats — they will threaten you physically and really pursue you.
here is the BTC address, this is Kurashov’s (Target’s) stashcurrently 1075 bitcoins lie on it — more than 100 million dollars
bc1q4jqt2tm3mw76fq5gfm4zruvy79rxcwnjedkr07
here is proof that this address belongs to Target — this address
1G9Zwp2cBdrM8o3wpactcqrw6NC3xGEm1o
it is in Conti chats; building the chain and connection is very easy and can be validated.Here are some of my messages from my Telegram group GangExposed Control Shot ContiI didn’t include this information in a separate article; I’ll leave them as an appendix%
 
update
Target from Conti Ransomware
KURASHOV ALEKSEY MIKHAYLOVICH 23.02.1986
ALEKSEY KURASHOV aka:
TARGET Conti jabber
BLOODRUSH Conti jabber
RED Conti rocket
BLOOD BlackBasta matrix chat
0xBAADF00D user id 7576423476
baadf00d user id 975964430
я не таргет сука user id 975964430
NET-WORKER @net_worker_suppport ID: 6162917461
AlfaBetaX user id 709683685
Smart007
alexsmithla518 instagram
wow2020 proton
JJOHNSON997799 google
TESLA9000X google
BLACKWATER8000 google
FRIMGOLD google
crime.scene.investigator.8000 google
Alexey Smart VK
Vanya Rumyantsev VK
Artur Tereshkov VK
Kirill Kovalsky VK
Alexander Levakov VK
Artyom Kolesnichenko VK
Maxim Zorin VK
BLOOD blood@thesecure.biz exploit in
CRYPT13 exploit in
0xA007 breached
and moreso far I noticed in the Tor Zirael Chat the following Conti heroes:
Target (4 accounts)
Professor (alter)
Tramp (two accounts)
Pin
Hof
Elliot
Skyppy
White
Reshaev
Angelo
Rand
Gabr
and this is just the beginning)and LockBitSupp has two accounts here I saw (one deleted)Conti participants are desperately trying to clean their traces, which exposes them even more; noticeable panic.Guys, this won’t help. I know your past (and future) accounts 
Here is an example from Tor Zireael Chat — after talking to me another participant tried to hide by deleting his account and creating a new one:ㅤ
---- ACCOUNT DELETED ----
This is 𝓛'𝓪𝓶𝓸𝓻𝓮𝓽𝓽 (tg://openmessage?user_id=7092905779)
Diversity of messages 91.05%
From 26.05.2024 to 22.10.2025
15955 messages in 96 chats
36.43% replies 23.88% media
Circles: 20, voice: 476
Searched: 7ΙＤ: 7092905779
ᴜѕеrnamеѕ:
| @lunardelamor | @lunardegrace | @lunarydegrace
Имeна: (3 из 53)
├ 21.10.2025 -> 𝓛'𝓪𝓶𝓸𝓻𝓮𝓽𝓽
├ 21.10.2025 -> 𝐷𝑒 𝐿'𝑎𝑚𝑜𝑢𝑟
├ 07.10.2025 -> Ｄ℮ L'amourhere is another account of the same personㅤThis is [℮mρτy] (tg://openmessage?user_id=7889122362)
Diversity of messages 100.00%
From 23.11.2025 to 06.12.2025
22 messages in 1 chat
63.64% replies 0.00% media
Favorite chat: his name was МαρkΙＤ: 7889122362
uѕеrnamеѕ:
├
Имена:
├ 25.10.2025 -> ㅤ
├ 25.10.2025 -> ѕαnτin d℮ amоr
├ 25.10.2025 -> 𝓛'𝓪𝓶𝓸𝓻𝓮𝓽𝓽This is a person from Target’s team, presumably Elliot — in the group close to Kevin or perhaps Kevin himself. I can say more precisely later; I will conduct additional tests.Over the last days I achieved astonishing progress.I expanded the search front. and ALREADY found almost half of all Conti (and BlackBasta) figures in Telegram. Their current accounts, deleted, multi-accounts. Full history, all messages, connections. These are very valuable finds and leads; such data will allow de-anonymizing many more chat participants from Conti. Roughly speaking — all who were in Conti chats and had the imprudence to communicate in Telegram chats (almost all).Telegram is the social network of the darkweb)For some particularly cautious figures there was nothing known before, and now it will be possible to revive and advance investigations on them.I rewrote some of my scripts, increased accuracy, reduced false positives. Importantly, I also added special markers for determining expertise accuracy.Significantly replenished my database of stylometric fingerprints of suspects.In general, a lot of new information; sorting, analyzing. A lot of interesting stuff)
My goals go beyond Conti. Using this case as an example, I want to demonstrate my capabilities and achieved progress to attract more serious resources and support, and then move on to destroying (in the legal field) other ransomware groups.I am open to cooperation proposals; interested parties — write to me in private messages.
(without editing and structure, drafts and notes)
https://x.com/GangExposed_RU
https://t.me/GangExposed_int
https://t.me/hackintel