#hacker #cybercrime

You start spending time on a Russian-language forum for programmers. It's not a criminal space. Not officially. It's a place where teenagers show off. Someone cracks a game's licensing system and posts the method. Someone else bypasses a paywall on a news site. Small things. Victimless. Or close enough to victimless that nobody feels the weight. You post your school hack. Not the details. Just the concept. A vulnerability in a municipal education network's authentication system. You describe how you found it. How you exploited it. What you do differently next time. The post gets attention. Not a lot. 43 responses. But one of them is a private message from a user with no post history and no profile information. The message contains one sentence. You think faster than your tools allow. We can fix that. Attached is a link to download a custom software package. You should not click that link. You click that link. The software is extraordinary. It's a penetration testing suite unlike anything publicly available. Tools that automate processes you've been doing manually. Exploit frameworks that adapt to target architectures in real time. You don't understand half of it. But you learn fast because learning fast is the only skill that has ever mattered in your life. The anonymous user sends you challenges. Small targets. A regional bank's internal email server. A logistics company's shipping database. A municipal water utilities control interface. Each challenge comes with specific instructions. Access the system. Document what you find. Report back. Don't alter anything. Don't steal anything. Just demonstrate access and exit cleanly. Each completed challenge results in a payment. Not to a bank account. To a cryptocurrency wallet. The user set up for you. The first payment is the equivalent of $800. Your mother makes 600 a month. You complete the first challenge in three hours. You are 15 years old. And you've just earned more than your mother earns in a month by sitting in your bedroom in your underwear and typing. You complete 11 challenges over the next 14 months. The targets escalate. Regional bank becomes national bank. Logistics company becomes defense contractors supply chain database. Municipal utility becomes the internal communications network of a government ministry. In a Baltic country, you've never visited. Each payment increases. 1,000. 2,000. 5,000. 12,000 for the ministry job, which takes you three weeks and requires you to develop a custom exploit that you're privately proud of. In the way that only someone who builds things, nobody else can build understands. You buy your mother a new winter coat. You tell her you're doing freelance programming for foreign clients. This is technically true in the same way that a bank robbery is technically a withdrawal. She doesn't question it. Because questioning good fortune is a luxury that people in Novosibirsk don't practice. You're 16. You have the equivalent of $43,000 in a cryptocurrency wallet. You have skills that most professional cybersecurity analysts acquire over a decade of formal training. And you have no idea who you're working for. The anonymous user contacts you on a Tuesday in March. The message is different. No challenge. No target. An address. An apartment in central Novosibirsk. A time. Tomorrow. 2 p.m. You shouldn't go. You go. The apartment is clean. Sparse. Unremarkable. Two men are waiting. One is in his 50s. Grey hair. Expensive watch. The posture of someone who spent years in a uniform before spending years out of one. The other is younger, quiet. The kind of face you forget immediately, which is probably the point. The older man speaks. He knows your name. Your real name. Not your forum handle. He knows your address. Your school. Your mother's factory. Your sister's name. Her school. Her classroom number. He recites these details the way someone reads a grocery list. Calmly. Completely. He says you've been impressive. He says the challenges were a recruitment process. He says the forum where you posted your school hack three years ago is operated by his organization for the specific purpose of identifying talent. Every teenager who shows ability on that forum gets tested. Most fail. You didn't. He says you now work for them. He doesn't ask. He informs. The way a doctor informs a patient of a diagnosis. Not hostile. Not negotiable. He says the work will be similar but larger. The targets will be international. The payments will be significant. The consequences of refusal are not discussed because discussing them would be redundant. You both know what they are without words. Your mother's factory. Your sister's classroom number. The numbers that he recited weren't information. They were coordinates. You are 17.