An 18-year-old from Oxford has been legally determined to be a member of an international cyber-crime network responsible for a series of hacking attacks targeting tech giants.
Arion Kurtaj was an essential part of the Lapsus$ group that infiltrated Uber, Nvidia, and Rockstar Games.
It was reported during a court session that Kurtaj had disclosed footage from the yet-to-be-released Grand Theft Auto 6 title while he was on release from custody in a Travelodge hotel.
The bold actions of Lapsus$ in 2021 and 2022 took the cyber security industry by surprise.
Kurtaj has been diagnosed with autism and due to the opinion of psychiatrists, it was decided he was not well enough to participate in court proceedings, and thus he was not present to offer any testimony.
The jury was requested to decide if he did the acts that were claimed - not if he meant to commit a crime.
A 17-year-old autistic individual who was affiliated with the Lapsus$ gang was convicted, but the law prohibits revealing his identity due to his young age.
A court characterized the collective originating from the United Kingdom and reportedly Brazil as "digital bandits".
The purported teens reportedly adopted deceitful tactics and resorted to computer hacking to infiltrate the systems of multinational companies such as Microsoft and Revolut, an online banking firm.
The hackers flaunted their offenses and baited their targets on Telegram in both English and Portuguese as they conducted their criminal activity.
The case was tried at Southwark Crown Court in London for a period of seven weeks.
The jury was told that an adolescent, whose identity remains unknown, had begun to partake in hacking activities with Kurtaj since July 2021, after they had encountered each other through the internet.
Kurtaj, enabled by his associates at Lapsus$, accessed the systems and files of BT and EE, the cellular operator, prior to requiring a ransom of $4 million (£3.1 million) on 1 August 2021.
No ransom was given, however, the court listened to testimony that the 17-year-old and Kurtaj employed stolen SIM information from five individuals to pilfer roughly £100,000 from their cryptocurrency accounts which were safeguarded by their breached mobile phone SIM details.
The two defendants were taken into custody on 22nd January 2022, after which they were released while the investigation was still ongoing.
The two hackers persevered despite this, managing to hack into Nvidia (a tech behemoth based in Silicon Valley, renowned for producing chips for AI chatbots) in February 2022.
They appropriated and disseminated confidential and precious information and asked for a payment of money to prevent them from disclosing more.
The jury was presented with Telegram group conversations of the gang instructing a person that they had employed to contact the Nvidia staff help desk, pretending to be a staff member in an effort to obtain log in particulars for the organization.
The gang utilized other scams, bombarding employee phones with requests for access confirmation during the night until somebody granted permission.
On March 31st 2022, Kurtaj and the young people were both apprehended again.
Prior to his apprehension, Kurtaj was subjected to "doxxing" by the competition's hackers, who posted his and his family's contact information online, as well as snapshots and clips of the passionate angler obtained from social media.
Kurtaj was removed to a Travelodge hotel in Bicester for his security, and given a set of stringent bail conditions, one of which was not allowing him access to the internet.
However, Kurtaj continued to hack.
Prosecutors allege that City of London Police uncovered him in the act when they searched his hotel room.
Jurors heard that police located an Amazon Fire Stick situated in the hotel television of the accused in blatant violation of his bail conditions. They also discovered his purchase of a smartphone, keyboard and mouse, enabling connection to cloud computing services.
The court was informed that he had participated in assaults on Revolut, Uber, and Rockstar Games.
Kurtaj's last attack against the game-maker was regarded as his boldest as he posted an announcement on the business's Slack messaging platform to all its staff that went: "I am not a Rockstar employee, I'm an intruder."
He proclaimed that he had acquired all data for Grand Theft Auto 6, Rockstar's widely celebrity video game series, and made clear that "unless Rockstar speaks to me on Telegram within 24 hours I will begin to make the source code available".
At the same time, 90 videos featuring incomplete footage of the sleekly-awaited new game were uploaded to a fan forum by the user TeaPotUberHacker.
Kurtaj was taken into custody again and held until his trial.
Kevin Barry, the principal barrister for the prosecution, commented that Kurtaj and his accomplices continually exhibited an "immature inclination to provoke those they were targeting".
Once inside a business's computer system, the cybercriminals frequently left provocative postings on Slack and Microsoft Teams as they attempted to extort employees.
The gang's behaviour was unpredictable, as their motivations seemed to vary between wanting fame, making money or simply having fun.
A major review conducted by US cyber authorities this month highlighted the need for better cyber defences in order to counter the increased menace of teenage hackers, following their extensive hacking spree.
The report indicated that Lapsus$ demonstrated how easily its members (including juveniles) could break into highly protected organisations.
It is believed that members of the gang are still at large.
In October, Brazilian police apprehended an individual accused of hacking various Brazilian and Portuguese companies and public entities with Lapsus$.
It is uncertain how lucrative Lapsus$'s cyber offenses were. None of the affected companies have disclosed that they paid off the hackers, and the 17-year-old declined to permit law enforcement to access his digital currency hardware wallet.
At a later date, Her Honour Judge Lees will sentence both teenagers.
Kurtaj has been detained and the 17-year-old is still on bail.
Comments