Opens in a new tab
14 min 18 sec
Available in:English

Spam Nation: The Inside Story of Organized Cybercrime – From Global Epidemic to Your Front Door

Shows who really sends the spam in your inbox, how a few Russian crime bosses turned it into a profitable industry, and how payment rules, rivalries and better passwords can weaken it.

Table of Content

Most people delete spam as clutter, yet each message is the storefront of an organized industry that can reach you even if you never open it. In Spam Nation, Brian Krebs, who covered cybercrime for The Washington Post, traces that industry to a small circle of Russian criminals. He follows the money behind fake pill ads and miracle diets: the hijacked computers that send them, the payment firms that cash them and the feud that nearly destroyed them.

His argument is that spam is a business, resting on a few bosses, a few networks and a steady flow of payments. That makes it dangerous to everyone online, and it also shows where the business breaks. Along the way you learn who sends the junk, why discount medicine from an email can kill, which pressures actually shrank the trade and the single habit that protects you most.

A silly diet ad seems harmless enough to ignore. Yet the same kind of message once helped knock a whole country’s government websites offline for days, and your own laptop could have been part of it.

An industry that floods billions of inboxes sounds like it needs thousands of workers. Krebs found something smaller and stranger, including a crime boss who also chaired a government anti-spam effort.

One man’s network of infected machines could send billions of messages a day, and he lived well on it. The computers doing the work belonged to people who had no idea they were employed.

A spam offer cut one man’s medicine bill dramatically, and plenty of buyers came back for more. For one woman, the same kind of bargain ended with an autopsy that found something radioactive.

A drunken boast in Russia reached a spam boss on holiday in Spain. What followed cost hundreds of thousands in bribes, sent one man to prison and pushed the other out of the country.

An anti-spam start-up fought back cleverly and was shut down after a chilling threat. The defenses that lasted came from somewhere less heroic: card networks, domain registrars and one very large fine.

Shutting down one racket opened space for a nastier one, built on fake police warnings and locked files. The most effective protection Krebs recommends costs nothing and takes a minute to set up.

Spam Nation changes what an inbox looks like. The pill ad and the fake courier notice are shop windows for a business with owners, suppliers, payment desks, customer service and even turf wars. A few men in Russia built it on hijacked computers belonging to strangers, and the rogue pharmacies it promoted sold pills to hundreds of thousands of customers worldwide.

That same structure explains where the business is weak. When Vrublevsky was arrested, complaints about fake antivirus software fell by 60 percent. When Visa and the domain registrars started asking who their customers were, the scams lost room to work. When the bosses turned on each other, the whole trade shrank.

For one person, the useful moves are modest. Never buy medicine from a seller that found you by email. Pause before opening any message that claims to come from a tax office, a courier or the police. Give your accounts passwords longer than ten characters, mixed with numbers and symbols. Spam pays because it is a huge, efficient industry, and the handful of people running it earn millions. Your part is to be one of the many who never do.

About this book

What is this book about?

Most people think of spam as an annoyance: pill ads, diet miracles and get-rich schemes to delete without reading. Brian Krebs, a longtime cybercrime reporter, argues that this view is dangerously wrong. The junk mail is the shop window of an organized industry, and it can hurt you even if you never open a single message. Krebs traces the trade to a handful of Russian operators. Pavel Vrublevsky ran a payment company that processed cash for crime schemes. Botnet owners known as Gugle and Cosma controlled networks of hijacked computers sending tens of billions of messages a day. Partnership programs called partnerkas connected spammers with illegal pharmacies. He follows the money through rogue drug sales, a bitter rivalry known as the Pharma Wars, threats against anti-spam activists and the arrival of ransomware. Readers come away with a clear map of how this business works and why it weakened when its bosses or its payments came under pressure. They also learn practical defenses: never buying medicine through spam, distrusting official-looking emails and using strong passwords.

Book Information

Rating:

Genre:

Technology & the Future

Topics:

Criminal Justice, Internet & Society

Publisher:

Penguin Random House

Language:

English

Narrator:

Nora

First published:

September 1, 2014

Pages:

251

Length:

14 min 18 sec

Get the book:

Amazon

Who it's for

  • Handling payments or logins

    Professionals who handle payments or logins at work and want to recognize phishing and ransomware.

  • Tempted by cheap medicine

    People tempted by cheap online medicine who want to understand the risks.

  • Curious how cybercrime profits

    Readers curious about how organized cybercrime actually makes and moves its money.

Listen to Preview

About the Author

Brian Krebs

Brian Krebs reported for The Washington Post from 1995 to 2009, covering internet security, technology policy, cybercrime and privacy, and writing the paper's Security Fix blog. He now writes KrebsOnSecurity.com, a daily blog of cybersecurity news and investigation, voted the Blog That Best Represents the Security Industry at the 2013 RSA Conference. His work has also appeared in Popular Mechanics and Wired.com. He holds a degree in International Relations from George Mason University.

Ratings & Reviews

Ratings at a glance

4.3

Overall score based on 32 ratings.

What people think

Listeners find the writing exceptionally accessible and well-crafted, with one listener highlighting how the author presents complicated data in a clear fashion. Furthermore, the narrative earns praise for its high-quality storytelling, and listeners consider it essential reading for cybersecurity experts looking to improve their defenses. The book also receives positive remarks for its educational value and the perspective it provides on the digital underworld. However, reactions to the technical depth are varied; while some listeners feel the concepts are explained well, others believe the work lacks sufficient detail.

Top reviews

Wacharapol

Ever wonder why your inbox used to be flooded with cheap Viagra ads? This book provides the answers in exhaustive, sometimes exhausting, detail. Krebs focuses heavily on the rivalry between the two biggest spam operations in Russia, painting a picture of a digital wild west. I never realized how much of the spam economy was driven by simple consumer demand for affordable medication. Frankly, it’s a bit depressing to see how these criminals exploit gaps in the healthcare system to fuel their botnets. The book is well-written and flows like a crime novel, which helps when dealing with all the complex technical jargon. I found the final chapter on personal security to be the most practical part, though it could have been expanded. If you want to understand the 'who' and 'why' behind the spam, this is the definitive guide.

Show more
Patchara

Gotta say, even if you’re a seasoned IT pro, there is a lot of nuance here regarding the economics of the underground. We often focus on the 'how' of a breach, but Krebs forces us to look at the 'why' and the 'who' behind the keyboard. The book illustrates how difficult it is to bring these people to justice when they are protected by sovereign states. I found the description of the 'Partnerka' system—how they recruit affiliates to do the dirty work—to be incredibly insightful. It’s not just one guy in a basement; it’s a global affiliate marketing scheme for illegal goods. Some of the technical explanations were a bit simplified, but that makes it accessible for non-technical stakeholders in a business setting. It’s an excellent resource for building a better defense-in-depth strategy.

Show more
Somporn

Finally got around to reading this dive into the shady world of botnets and Russian drug lords. Krebs manages to take a topic that sounds incredibly dry—email spam—and turns it into a compelling narrative about rivalries and greed. I was particularly struck by how he breaks down the relationship between pharmaceutical spammers and the credit card industry. It isn't just about annoyance; it’s about a massive, global infrastructure designed to siphon money from unsuspecting users. Truth is, the storytelling is top-notch even if some of the technical details feel a bit glossy. I would have liked more info on how researchers actually track these server IPs, but the human element kept me turning pages. It's a solid piece of investigative journalism that makes you rethink every 'junk' email you've ever received.

Show more
Saranya

The audiobook version by Christopher Lane is probably the best way to consume this because those Russian names are a mouthful. Lane does a decent job, though his accents are a bit inconsistent across different characters. As for the content, it’s an eye-opening look at the 'Spam Nation' that exists just out of sight. I was particularly interested in how Visa and MasterCard eventually became the primary tools for shutting these operations down. It turns out that following the money is much more effective than trying to play whack-a-mole with the servers themselves. Not gonna lie, some of the middle chapters drag a bit as the author gets bogged down in the minutiae of specific hacker squabbles. However, for anyone interested in the history of the early 2010s internet, this is essential reading.

Show more
Udom

Brian Krebs has a real talent for making the invisible infrastructure of the internet feel like a high-stakes thriller. I went into this expecting a dry manual on email filters, but I ended up reading a saga about international fugitives and corrupt officials. The detail regarding the University of Alabama researchers trying to test the spam-bought pills was particularly gripping. It highlights the absurd legal hurdles that prevent us from actually fighting these cybercriminals effectively. Let's be real, the book can be a bit heavy on the author's own perspective, which might grate on some readers. I didn't mind it as much because his personal involvement in the story adds a layer of authenticity. It’s a compelling narrative that proves the truth is often stranger than fiction in the digital world.

Show more
Rapee

After hearing Krebs on various podcasts, I expected a technical deep dive, but what I got was more of a true-crime drama. The focus is much more on the personalities and the political environment in Russia than on the actual code used to build the botnets. For some, this will be a plus, but I was hoping for more information on things like IP spoofing and server architecture. That said, the storytelling is excellent and kept me engaged through the more dense financial sections. It’s frightening to realize how vulnerable our personal data really is when faced with these massive, well-funded organizations. This is a must-read for anyone who thinks their antivirus software makes them invincible. It’s an informative, if slightly lopsided, look at the darker corners of our connected world.

Show more
Maya

As someone who follows cybersecurity news closely, I found this to be a bit of a mixed bag. Krebs clearly knows his stuff, but the transition from writing short blog pieces to a full-length book seems a bit bumpy in places. He spends quite a lot of time on his own personal history with the Washington Post, which felt slightly self-indulgent when I really just wanted to learn about the botnets. To be fair, the sections detailing the inner workings of the Russian pharmaceutical underground are fascinating and provide a perspective you won't find anywhere else. The technical level is accessible for a general audience, though a bit light for those already in the industry. It's an informative read that highlights the sheer scale of the cybercrime problem, even if the pacing is occasionally uneven.

Show more
Chanpen

Look, the landscape of cybercrime moves at light speed, so a book from 2014 is naturally going to feel like a history lesson. Even so, the foundational concepts Krebs explains are still incredibly relevant today for anyone in the tech field. The way he describes the birth of the 'scareware' industry is chillingly similar to the modern ransomware threats we face. In my experience, most people don't realize how organized these 'miscreants' actually are. They operate like legitimate corporations with customer support and marketing departments. My only real gripe is that the book jumps around chronologically, which can make it hard to follow the timeline of events. Despite that, it’s a high-quality piece of investigative work that captures a specific era of the internet perfectly. It belongs on the shelf of any aspiring security researcher.

Show more
Maksim

The sheer number of 'miscreants' mentioned in this book makes it hard to keep track of who is backstabbing whom. I appreciate the list of characters at the front, but in the heat of the narrative, they all started to feel like the same person. It’s a very specific look at the Russian spam scene, which might be too narrow for someone wanting a broader overview of global hacking. Still, the insight into the fake antivirus market was worth the price of admission alone. I was surprised to learn how many legitimate companies were indirectly profiting from this traffic for years. It's obvious that the writing is a bit jerky in the later chapters, suggesting it might have been rushed to print. It’s a solid read that provides good historical context but fails to truly captivate throughout.

Show more
Henry

This book feels like a collection of blog posts that were stretched way too thin to fill a hardcover. While the subject of cybercrime is fascinating, the execution here is less than stellar because of the repetitive nature of the anecdotes. Krebs mentions the importance of understanding IP addresses but then fails to actually explain the mechanics of how they are spoofed or tracked in a meaningful way. Personally, I found the endnotes incredibly distracting; having to flip back and forth in an ebook is a chore that ruins the narrative flow. The focus on the personal feuds between Russian hackers started to blend together after a while, making the 'miscreants' feel interchangeable. It’s an okay introduction for a layman, but it lacks the analytical depth I was hoping for from such a renowned expert.

Show more
Show all reviews

Questions about this book

Krebs investigates who sends spam and how they profit from it. He traces much of it to a few Russian operators, including Pavel Vrublevsky and botnet owners known as Gugle and Cosma, who used hijacked computers and partnership programs called partnerkas to sell fake drugs and software. His main point is that spam threatens everyone, even people who never open it, because it spreads malware and builds criminal networks.

Some rogue pharmacies delivered real pills and good service, which is why buyers trusted them. Others sold fakes or poison. Krebs describes Marcia Bergeron, who died in 2006 after taking pills from a rogue pharmacy that contained metals in place of harmless filler, including radioactive uranium. Since a buyer cannot tell honest sellers from dangerous ones, the safe choice is never to buy medicine through spam.

A botnet is a network of hijacked computers that criminals control together. A click on a spam ad can add your machine to one. Botnets send billions of spam messages, launch attacks that knock websites offline for ransom, and now steal passwords. Cutwail infected more than 125,000 computers by 2008, and in that state your computer works for criminals without you knowing.

In 2011 the US Justice Department announced that Google agreed to pay $500 million to settle a criminal investigation alleging it let rogue pharmacies advertise to the American market. The amount was meant to reflect the profit Google made from those ads. Krebs presents it as part of a wider push to make companies responsible for the illegal businesses they help reach customers.

Krebs’s main advice is to take passwords seriously: use more than ten characters where possible and combine letters, numbers and special characters. Beyond that, his reporting supports distrusting emails or pop-ups that claim to come from the FBI, the tax authority or a courier, never paying fines demanded by prepaid card, and never buying prescription drugs from sellers that contact you by email.

AUDIO SUMMARY AVAILABLE

Listen to Spam Nation in 15 minutes

Get the key ideas from Spam Nation by Brian Krebs, plus 5,000+ more nonfiction titles.

  • 5,000+ titles
  • Listen as much as you want
  • 7-day free trial
  • Cancel anytime

Spam Nation

Preview · Full summary 14 min 18 sec
Home

Discover

Open app

Log in