Ransomware and cyber-extortion news isn’t always about breaches, data theft, and file scrambling crises.
Once in a while, law enforcement gets hold of a cyber-blackmail suspect, brings them to court, and secures a conviction, and that’s what makes the news instead.
It’s worth celebrating these successes, because the perpetrators are often difficult to track and trace, hard to identify, and harder still to bring before a court.
The cryptocoin transactions paid out in ransomware extortions are troublesome to follow, because most cryptocurrencies provide at least pseudo-anonymity.
Attacks are typically conducted via VPNs (virtual private networks) that shield the identity of the real user, hiding their computers behind hard-to-find servers in other countries, or even deliberately redirecting the criminals’ data via unsuspecting and innocent users’ home routers or smart TVs that are infected with traffic-redirecting malware known in the jargon as a residential proxies.
And the “breach announcements” by the criminals, as well as the “negotiations” with their victims, usually happen on the dark web via Tor, a largely anonymous internet-on-top-of-the-internet.
These “announcements” often involving leaking a few records by way of convincing the victims that they really were breached, and thus that it’s worth paying a blackmail demand to have the rest of the stolen data “deleted.”
The dark web gets its name not because it’s inherently evil (though it’s certainly very widely used by cybercriminals and other online ne’er-do-wells), but because it’s effectively unilluminated and unilluminable. Search engines can’t readily index it; clients and servers can communicate with each other without either side being able to trace the connection to the other end; and law enforcement can’t easily work out where dark web servers are located, making them resistant to legal takedowns or other offensive security measures.
Sometimes, however, the Mounties, as the saying goes, get their man.
In this case, they got hold of a prolific Canadian cybercriminal called Connor Riley Moucka, known variously in cyber-underground circles by the handles judische, catist, waifu, and ellyel8.
Moucka was located and arrested by the Canadians at the request of the United States, who named him and a co-conspirator called John Erin Binns, also known as irdev and j_irdev1337, in an indictment dating back to late 2024.
The Mounties didn’t get Binns, who was apparently arrested in Turkey in early 2024, but allegedly managed to acquire Turkish citizenship after his arrest, which now shields him from extradition.
Moucka, however, was extradited from Canada to the US, where he recently pleaded guilty to the numerous charges against him, relating to crimes that followed a well-known but odious and manipulative course:
The attackers’ methods extended beyond data theft to extortion, with Moucka and his group demanding payments to prevent the sale or public release of stolen information.
In one high-profile instance, the group is alleged to have stolen 50 billion customer call and text records from a major US telecommunications company, widely believed to be AT&T.
This resulted in AT&T paying $370,000 to secure the deletion of their compromised data.
The group is reported to have successfully extorted a total of $2.5 million across multiple victims, emphasizing the lucrative and dangerous nature of these cybercrimes.
In fact, Moucka’s indictment lists six primary victims, including a “software-as-a-service provider in the US” with servers around the world.
That cloud provider was Snowflake, and this incident became widely known as the Snowflake Attack.
As you can imagine, once the attackers, including Moucka, had access to a worldwide hosting network, they were able to find and identify personal data belonging not just to Snowflake but also to many of its customers.
This added up to 165 additional victims into the fallout of the attack, according to a US court document filed about eight months after the indictment that brought these second-level victims into the matter:
The indictment alleges that they hacked into at least ten victim organizations’ protected computer systems, stole billions of sensitive customer records, threatened to leak the stolen data unless the victims paid ransoms, and offered to sell online the stolen data.
According to the Government, “[t]he investigation to date has further revealed that closer to 165 companies were likely compromised through this series of breaches, spanning major industries, including telecommunications, banking, and healthcare”․․․
As a result, there is a large number of victims in this case.
Apparently, the attackers focused on accounts without 2FA (two-factor authentication), thereby making usernames and traditional stolen passwords enough on their own to initiate an intrusion.
They seem to have acquired these initial passwords by a range of methods, including simply “buying them up” from so-called IABs (initial access brokers) operating on cybercrime forums.
Of course, this doesn’t mean that 2FA is a silver bullet against intrusions based on already-known passwords.
There are numerous convincing phishing tricks to lure victims into giving away their one-time 2FA codes, and a range of open-source tools (often available publicly on GitHub, pitched as “research projects” or “red-team tools”) to automate these lures.
One approach involves luring victims into giving away a current 2FA code by making up fake password reset or account compromise warnings, and asking for the 2FA code as a legitimate-sounding “proof of identity.”
Another attack technique aims to wear down users via so-called 2FA fatigue or approval bombing attacks, where unwanted login approvals pester the user until they either give in to make the pop-ups stop, or press the wrong button in haste and irritation.
We’ve asked before, “How far can you trust a ransomware criminal?”
This sounds like a rhetorical question that assumes the answer, “Not very far at all,” but it’s useful to have real-world examples that remind everyone why paying the blackmail money comes with no guarantees at all.
The US Department of Justice (DOJ) provides just such an example in its own write-up of the case:
In at least one instance, Moucka re-extorted a victim with threats of further disclosure of the victim’s stolen data.
Moucka used the stolen data of a government officer and members of a then-former government officer’s immediate family in this re-extortion attempt.
Presumably, Moucka squeezed money out of an organization by saying he’d delete the data he’d stolen, but deliberately kept back some or all of it so he could then target individuals with the same blackmail scheme.
Moucka pleaded guilty to the charges against him, and now faces a minimum of two years in prison on one of the charges, and an additional maximum of 30 years for the others, meaning that he could get up to 32 years for his crimes.
He’s already in custody, but he’ll find out how much longer he’ll be there when he’s sentenced in October 2026.
Why not ask how SolCyber can help you do cybersecurity in the most human-friendly way? Don’t get stuck behind an ever-expanding convoy of security tools that leave you at the whim of policies and procedures that are dictated by the tools, even though they don’t suit your IT team, your colleagues, or your customers!
Paul Ducklin is a respected expert with more than 30 years of experience as a programmer, reverser, researcher and educator in the cybersecurity industry. Duck, as he is known, is also a globally respected writer, presenter and podcaster with an unmatched knack for explaining even the most complex technical issues in plain English. Read, learn, enjoy!
Featured image of red hand by Julian Gentile via Unsplash.
Malware writeups used to tell you everything there was to know about each new threat. But life’s not like that today, and it’s not because threat researchers aren’t as smart or as diligent as they used to be!
Organizational risk is no longer limited to the office. It has spread to the cloud, third parties, and employee devices. We discuss why mobile device security needs to be made a priority.
“It’s not a bug, it’s a feature!” How phishers abuse your browser to steal data.
By subscribing you agree to our Privacy Policy and provide consent to receive updates from our company.
