Transcription performed by LeahTranscribes[START OF RECORDING] JACK: To build a successful business, you need a good business plan; a carefully thought-out, step-by-step guide to launch, develop, and expand. You need good people too, people you trust and can rely on. But the internet has changed how people become entrepreneurs. It’s made it easier to find good help and easier to find customers. Digital technology and the internet have created a whole range of new opportunities for businesses and entrepreneurs. But there’s a flip-side to these innovations, a darker side. You see, the criminal underworld has also benefited from the explosion of digital technology and the internet. Criminals make business plans, too. They build networks and work together to advance their elicit agendas. When greedy criminals set out to execute a business model armed with the powers of the internet and a hacker or two, they can achieve astounding criminal feats. The thing is, it’s not easy to catch a cyber-criminal. Hacking is mostly invisible. It’s quiet, secretive, and always done under the cover of the internet. It’s like the perfect burglary that takes place in pitch black. There’s no trace of the perpetrator on the CCTV camera footage, no fingerprints, and no leads. With hacking, it’s all digital. Whatever virtual fingerprints you might have left behind can be covered up, deleted, or hidden. This is why so many cyber-criminals get away with their crimes. This is a story about a group of very savvy businessmen who made a fortune exploiting people online.
(INTRO): [INTRO MUSIC] These are true stories from the dark side of the internet. I’m Jack Rhysider. This is Darknet Diaries. [INTRO MUSIC ENDS]
JACK: In July 2014, Hold Security, a small firm that specializes in external cyber-threat intelligence made an unbelievable discovery. This small firm which supposedly monitors the darkweb for hacker activity that may be a threat to their clients, reported to the New York Times claiming to have found a credential dump containing 4.5 billion usernames and passwords on the darkweb. Now, 4.5 billion usernames and passwords is just a crazy amount of credentials. When Hold Security filtered out duplicates, they were left with 1.2 billion credentials. But still, a credential dump that large would be the biggest credential dump ever found.
The New York Times ran with this story but the security community was pretty skeptical. First, everyone wanted to see what was in the dump but Hold Security wouldn’t reveal this data to anyone. Later, Hold Security announced that for a $120 fee, they would tell companies whether the dump included credentials from their websites. Huh. With Hold Security claiming they had one of the largest dumps ever and not sharing it with anyone except a few people who paid to search for their own names, it was just a little hard to trust. Alex Holden, the CEO of Hold Security, was interviewed by Forbes. This is what he said.
ALEX: …had come with me. I tried to clear up the criticisms here. There are two different pieces to this puzzle. First of all, we have 1.2 billion credentials that belong to about half a billion e-mail addresses, unique e-mail addresses. These are the individuals who entrusted their credentials to different web services’ websites. These credentials were stored on those websites. Unfortunately through no wrongdoing on the individual side, these – this information had been stolen by the hackers. These individuals are the ultimate victims in this particular crime.
JACK: Later, Hold Security released a summary report of the dump. They said the dump was from 420,000 different websites that had been breached, some of which were Fortune 500 companies. The report listed some of the companies that were breached and they called the group that stole this data CyberVor which means ‘cyber-thief’ in Russian. [MUSIC] 420,000 websites is a huge proportion of the entire world wide web. At this point, even I think this dump sounds a bit ridiculous to me ‘cause it just doesn’t add up. But let’s switch gears for a second. Imagine you are part of a IT security team at the JPMorgan Chase Bank. You work for the biggest bank in the US and the sixth-biggest bank in the world. Your bank pretty much dominates the financial sector in terms of investments and banking. Imagine you’re one of JPMorgan Chase’s 250,000 employees scattered across 171 offices in 39 different countries.
Imagine you’re part of the team that’s responsible for [00:05:00] protecting data in this bank which has an annual revenue of 115 billion dollars, of which about ten billion is spent on tech and 250 million dollars a year is spent on cyber-security. There’s about 1,000 people working with you in the IT security team at JPMorgan Chase. Now, I’m not sure if any company spends more money on security than JPMorgan Chase. But either way, they aren’t messing around when it comes to protecting their networks. If you were on the IT security team of JPMorgan Chase and you saw that Hold Security released a summary report, would you take a look to see which companies had been breached? Of course you do. It doesn’t matter if it’s real or not; your company is spending every dollar it can to do everything to protect the network.
You’d definitely be looking at this report. You’d be looking at every report that might have anything to do with JPMorgan Chase’s IT security. That’s just what happened; an IT security analyst at JPMorgan Chase did read Hold Security’s report. In it, Hold Security claimed the website for a charity race sponsored by JPMorgan called Corporate Challenge was breached. This site had been used by JPMorgan employees to register for the race. It was hosted by a company called Simmco Data Systems. As it happened, Simmco Data Systems was also mentioned in the Hold Security report. It claimed that Simmco had been breached, too. Huh. So, if JPMorgan Chase employees were registering at that site, then it’s possible their data was stolen. This caused the IT security analysts at JPMorgan Chase to look into this a little more.
[MUSIC] The security team at JPMorgan Chase contacted Simmco Data Systems to investigate the claims made by Hold Security. Simmco Data dug around their network logs and confirmed that the Corporate Challenge website was hacked and breached. The hackers had stolen an SSL certificate from the site and the hack was executed through a few IP addresses that had been creeping around the network without any legitimate reason to be there. Two techs from the JPMorgan Chase office in Columbus, Ohio went over to Simmco Data Systems’ office in Michigan to get copies of any forensic data they could find. They wanted to know exactly what had been stolen and understand the indicators of compromise.
As the JPMorgan Chase security team was collecting data from Simmco, they were using this data, including IP addresses, to search their own logs for any similar activity. They were looking for any trace of a breach and any sign of activity from the IP addresses associated with the Simmco data breach. Sure enough, they found the same eleven IP addresses that had been used to execute the Simmco breach had also been used to attack JPMorgan Chase. What’s more, some of these attacks against JPMorgan Chase had been successful. The biggest bank in America had been hacked and they never even knew it happened. At this point, JPMorgan Chase contacted the FBI and handed over these IP addresses to the Financial Services Information Sharing Analysis Center. This is an organization that circulates this kind of data to banks and financial institutes so they can check whether they have been breached.
Up until this point, JPMorgan Chase had kept this whole situation under wraps while they were working to figure out what was going on, but this kind of breach is a huge deal and they weren’t going to be able to keep quiet about this for long. [MUSIC] We don’t know exactly how the hackers jumped from the charity’s website into the bank’s servers, but I’ve got a few theories. First, it’s possible that the hacker gained access to this Corporate Challenge charity site. How? Possibly by hacking through Simmco Data Systems which was the hosting provider for the Corporate Challenge charity site. If the hosting provider got hacked, then the hackers would have access to the back end of all the other websites that hosting provider hosts.
If they got into the Corporate Challenge website that way, they could have accessed the credentials for all the JPMorgan employees that were registering on the site. Maybe some of those username and passwords were the same usernames and passwords used to log into JPMorgan Chase’s network. This kind of tactic would likely work because so many people reuse passwords on multiple sites. Any JPMorgan employee who used their JPMorgan network password on another site would have made their network vulnerable for this kind of attack. That’s one theory. The other is that this hacker crew might have targeted an IT admin at JPMorgan Chase through spear phishing or some other attack that got them remote access into the admin’s computer.
If a hacker was able to do that, they’d be able to steal that IT admin’s network credentials and do whatever they want from there. Either way, what we know is that this hacker group did have a valid login to a JPMorgan server. With that, they were able to get past the huge front gates of the super-secure JPMorgan Chase network. But once they got past the [00:10:00] front gates, they still needed to figure out where to go. It’s as if they broke into a bank but didn’t know where the safe was. They were just wandering through the network and they hadn’t actually gained access to anything valuable yet. There was an old server that the bank used to manage employee benefits data. It was still running, just not used very often. See, there’s 250,000 employees at JPMorgan Chase and they’re using about a half a million computers in this network.
It’s not easy for such a large company to manage half a million computers. In this case, the employee benefits server had been neglected. It wasn’t updated with the latest security patches and features, and it wasn’t set up for two-factor authentication which would have required users to enter a time-sensitive token code with their password to get in. The hackers discovered this server on the network and used their stolen credentials to log in. This is a perfect example of when two-factor authentication probably would have stopped these hackers from getting any further into the network. [MUSIC] Anyway, once a skilled hacker establishes access to a network, they’re gonna want to create a persistent connection and elevate their privileges.
They’ll need a persistent connection in case their connection gets dropped. Then they have a guaranteed way to get back into that server. The hackers created a back door into the JPMorgan Chase network. This was a point of access that only the hackers would know about but the security team wouldn’t be able to detect them. Once they did that, they began crawling around the network, looking for something in particular. They slowly made their way towards the systems they were after. They were good; hiding their tracks, doing things just the right way to avoid setting off alarms and avoid being detected by antivirus scans. For months, these hackers had been creeping around, quietly accessing databases and exporting data to their own servers as they went along. All the while, they were silent and invisible.
In all, they breached over ninety of JPMorgan Chase’s servers which included multiple databases used to store customer information. This story became public on August 27th, 2014 when Michael Riley and Jordan Robertson reported on this hack in an article in Bloomberg. They revealed that there had been a successful breach at JPMorgan Chase and they said it was the work of Russian hackers. The accusation that this was a nation state attack on US financial infrastructure grabbed the attention of the US financial system. Could it be that Kremlin-sponsored hackers had managed to get inside the networks of JPMorgan Chase, breach layer after layer of security, and make off with tons of customer data without JPMorgan Chase knowing anything about it?
It wasn’t until the bank filed a disclosure with the Security Exchange Commission on October 2nd that we learned more details about this hack. It was way worse than anyone thought. [MUSIC] The hackers had accessed multiple customer databases and stole 83 million personal identifiable records of JPMorgan Chase’s customers. These records were associated with 76 million households and seven million small businesses, pretty much all located in the US. To put that into context, in 2014 there was something like 127 million US households. That’s around 60% of all US households that got their information stolen from this hack. The idea that Russians were behind this hack and that they were probably state-sponsored wasn’t all that surprising.
I mean, just a few months before this, the US had put a load of heavy sanctions on Russia’s financial infrastructure. See, in 2014, that was the year when Putin decided he wanted to take the Crimea Peninsula from Ukraine. Putin dispatched scores of mast armed soldiers to Crimea. They seized the territory, raising Russian flags, and then went on to take control of the cities and the Supreme Council building. The Supreme Council is sort of like the Crimean parliament. The current PM was booted out and a new one was voted in although there were some good reasons to doubt the fairness of this election. This was the most blatant land-grab in Europe since World War II. Russia’s invasion of Crimea stirred up a whirlwind of controversy.
The US and EU and of course Ukraine strongly condemned Russia’s tactics and said that Putin had violated multiple local and international laws. The US and EU imposed sanctions against Russia. These sanctions threatened to tip the already fragile Russian economy into recession. The US and EU intended for these sanctions to force Putin to relent and relinquish control of the Crimean Peninsula back to Ukraine. But Putin wasn’t having any of it. He denounced the US and EU for imposing these sanctions which he said was just another example of aggressive US foreign policy, and he warned that Russia may retaliate against these actions. It seemed possible that the hack on JPMorgan Chase was the first volley of Russia’s retaliation. Here’s a clip from CNN discussing the very idea.
ALISYN: [00:15:00] The FBI is investigating a series of cyber-attacks against US banks thought to be coming from Russia. Hackers are believed to have accessed sensitive information from several financial institutions including banking giant JPMorgan Chase. Could this be retaliation for western sanctions against the Russians? Christine Romans is here with more. Is this retaliation?
CHRISTINE: Well, that’s what the investigation is gonna have to really zero in on here, quite frankly, Alisyn. The US official tells us that the location of the hacker still isn’t clear but given the sophistication of this, the cyber-security community is saying this investigation appears to center and should definitely center on Russia. Now, hackers from Russia are often top FBI suspects. The timing of the hack has raised suspicions given recent US sanctions against Russia. Also, still this big question; the motivation.
Still unclear if the attack was financially or politically motivated or if it was some sort of espionage. Banks have very tough security. Getting through that and getting account information, getting so much information, definitely not an easy task. Now, in response to this breach, JPMorgan said companies of its size experience cyber-attacks every day and the bank has measures to protect itself. Again, the FBI US officials are investigating just what the cause was of this cyber-attack.
JACK: [MUSIC] For JPMorgan Chase, this attack came at the tail-end of a really bad year. They lost a heap of staff in the previous months. In 2013, their chief information officer resigned and took a position as the CEO of a payment processor called First Data. Around this time, five other senior staff from JPMorgan Chase also quit. This included the information officer and chief of security for their IT teams. In early 2014, a new chief of security was appointed; James Cummings. He helped to recruit a new information officer, Gregory Rattray. When this hack was carried out in July 2014, the top IT leadership had only been in place for about six months. Both Cummings and Rattray were former US Air Force and they were both convinced that this attack was state-sponsored and probably executed by Russians.
They thought this hack represented a threat to US national security. I have to wonder though whether their military training and experience biased their interpretation of this hack. After all, they would have been used to dealing with state-sponsored attacks while in the military. It’s not like this hack couldn’t have been what Cummings and Rattray thought it was, but the problem is the FBI’s analysis just didn’t match up with Cummings’ and Rattray’s. The FBI had several specialist units working on this hack. They pulled in their cyber-crime unit, the Secret Service, and Homeland Security to investigate this attack. All of this analysis wasn’t enough to convince the FBI that the hack was executed by a nation state or that there was a clear threat to national security.
That set off this weird political drama over the data that had been stolen from JPMorgan Chase. See, there was this system in place that was supposed to capture any stolen data in a hack like this. Think of it like a CCTV system that you could rewind and watch back if you knew something bad happened. But according to Bloomberg sources, this system didn’t have enough storage at the time of the attack. Even though they collected the data at the time of the attack, they didn’t have it anymore. On top of that, maybe because of political drama around who committed this hack, JPMorgan Chase didn’t want to hand over the data they did have from the hack to the FBI. Things were starting to get out of hand and none of this was helping to solve the actual problem that millions of JPMorgan Chase customer records had been compromised.
[MUSIC] Two weeks after the hack had been discovered, the Assistant Director of the FBI’s Cyber Division, Joseph Demarest, had a conference call with JPMorgan Chase’s COO Matt Zames, James Cummings, and Gregory Rattray. Cummings and Rattray, the Air Force veterans from JPMorgan Chase’s IT department, were pushing for the hack to be deemed a threat to national security. If they got their way, the US Department of Justice would excuse them from any obligations to tell their customers about the hack. The idea of this policy is that if a hack is a threat to national security, then it should be kept quiet as possible while it’s being investigated.
But in the end, the FBI thought it was more likely that this hack was done by a group of clever and skilled criminal actors rather than a nation-sponsored threat actor. JPMorgan Chase and the FBI reached a truce. JPMorgan Chase handed over all the data they collected during the hack so the FBI could conduct a thorough investigation. But jeez, this was a bumpy ride to get there. Jordan Robertson, the journalist from Bloomberg who originally broke this story talks about what happened between JPMorgan and the FBI.
JORDAN: In one of the questions we set out to answer eight months ago when this breach occurred was why we were hearing such a different story from folks who were familiar with the bank’s investigation, which they said the Russian government was believed involved, versus the law enforcement investigation which was indicating a criminal [00:20:00] attack. The answer to that is yeah, the bank is staffing up on former senior military officials, cyber-warriors, and they come to these problems with a very specific mindset about who’s responsible for hacking. There’s a fundamental difference between studying attacks on military infrastructure versus studying attacks on the private sector. The private sector faces a lot more for-profit criminal activity than the military does, and that really animated the bank’s investigation.
HOST: Very interesting on the military approach. That’s led to some problems, Jordan, right, that you’ve found out; including some clashes internally but also with the FBI as well, right?
JORDAN: Yeah. What happens is you hire people who are really great at offensive cyber operations and they’re great network attackers. Defending a network is a whole another matter and dealing with law enforcement beyond that is another matter entirely. What we found was that the bank repeatedly clashed with the FBI and the Secret Service over information-sharing. The Secret Service went so far as to threaten to subpoena the attack data because they believed they were not getting it in a timely fashion. A senior FBI official had to intervene on his agent’s behalf to facilitate that information-sharing more quickly. There were clashes at multiple levels and a lot of it traces back to this difference in mindset between the military and private sector.
JACK: Now the FBI were hunting down these hackers using the IP addresses JPMorgan Chase and Simmco Data Systems had found on it. It was hard for investigators to track this attack because the hackers deleted most of the log files that would have left bread crumbs, revealing their activity in the network. Early in the investigation it was suggested that the hackers spoke Russian, but I’m not sure whether they had any actual evidence of that. [MUSIC] Now, what about these IP addresses the hackers were using? Well, investigators started tracing these back and found the IPs were from different countries all over the world. The computers that had launched these attacks were located in Russia, Egypt, Czech Republic, South Africa, and Brazil.
All of these IPs belonged to hosting providers who were in the business of renting servers to whoever wanted them. This is a simple way to hide your tracks as an attacker. You don’t want to do all this hacking from your own office or house. You want to rent a server on the other side of the planet and use that to carry out your hacks. The hackers had rented one server in Egypt which they used on some of these hacks. Get this; the day after the news broke about JPMorgan Chase, the hackers stopped using that server in Egypt and canceled that account. It seems like whoever was behind this was watching the news and knew they were about to be hunted. While all these investigations were going on, there were reports coming out of other financial companies across the US. Slowly, these reports started to paint a bigger picture.
JPMorgan Chase wasn’t the only target. The same hackers had hit multiple other financial institutions. By October 2014, investigators believed the same hackers had hit at least twelve or thirteen other financial institutions. But from what I can tell, none of these companies have officially come forward about these breaches. But reports are naming some pretty specific banks including Fidelity Investments, ADP, HSBC, Citigroup, and Bank of the West. They had all found signs that these IP addresses from the JPMorgan Chase hack had also been sniffing around inside their network. Now the financial industry was really starting to get worried. Some of the banks only found evidence that the hackers had entered the network and had poked around, but others found signs that stuff was stolen. Here’s journalist Emily Glazer from the Wall Street Journal.
EMILY: Yeah, so right now we know that Fidelity and E-Trader are on that list of thirteen financial institutions including JPMorgan. We had reported earlier yesterday that Citigroup, HSBC, ADP, the payroll processor, and regional lender Regions Financial were also spotting traffic from alleged hackers linked to JPMorgan. There is a lot going on here and it’s very fluid. FBI already involved onsite at JPMorgan, we reported, Secret Service, NSA, Benjamin Lawsky, the top New York financial watchdog, and SDNY, the US attorney based in Manhattan. There are a lot of regulators and prosecutors either examining or investigating this.
JACK: It’s early 2015, seven months after the hack, and the JPMorgan Chase security team is still working on the investigation. Internally, they were calling it the Rio Investigation. They hired outside experts plus some tech executives to form a control board panel. [MUSIC] The job was to meet every two weeks and figure out just how this hack was going to affect JPMorgan Chase and their customers. They also needed to make sure these hackers could never get in the systems again. The year all these financial companies got hacked was a pretty big year for large [00:25:00] data breaches. Target was breached at the end of 2013 and they had forty million customer credit card records stolen. eBay was hacked less than six months later in May 2014.
Their customer database was breached. In September 2014, while JPMorgan Chase was working on the Rio Investigation, Home Depot discovered they’d been hacked, too. A heap of credit card information from their customer database appeared on the darkweb. Investigators suspected that the same people were behind both the Target and Home Depot hacks but they still had no idea who those hackers were. The truth is, many hackers working on this scale don’t ever get caught. But in the middle of 2015, things started to get weird for the Rio Investigation. On July 21st, the Israeli police made two coordinated arrests in Israel at the request of the FBI. Now remember that date; July 21st, 2015. It’s gonna come up a few other times in this story.
The police arrived unexpectedly at the homes of thirty-one year old Gery Shalon and forty-year-old Ziv Orenstein. They were both arrested and charged with securities fraud which is basically illegal stock market manipulation. Now, Gery Shalon is a bit of a flashy guy. He lives in a six million dollar mansion in the very posh Savyon suburb of Tel Aviv. This is kind of like Israel’s version of Beverly Hills where all the celebrities live. His closets were full of expensive tailored suits and the police found half a million dollars in cash in his house when he was arrested. Ziv Orenstein who lived in Bat Hefer, about twenty-nine miles away, may have been wealthy too, but he was more low-key.
[MUSIC] Both of these guys are Israeli citizens and in 2009 they established a web marketing company called Webologic Ltd. Gery was the manager of this company and Ziv wasn’t listed as being involved with Webologic, at least on the books. Still, the Wall Street Journal reported that there were thirty odd employees that worked there and they all knew Ziv was really the guy in charge. As part of the securities fraud investigation, the Israeli police seized all electronic devices in both Gery and Ziv’s house and the Webologic offices. Now, there was this third guy involved in all this. The Israeli police also raided the house of thirty-one year old Joshua Samuel Aaron at the same time. But when they went to his house, he wasn’t home. He had been in Russia but he was supposed to be back in Tel Aviv at the time of the arrest.
But there was no sign of him at all. They report back to the FBI that they didn’t get Joshua. So, Joshua becomes a wanted man. Get this; at the same time that Gery and Ziv are arrested in Israel, the FBI coordinated a simultaneous raid in Florida. They arrested Anthony Murgio and Yuri Lebedev for running an illegal Bitcoin exchange called Coin.mx. What do these arrests have to do with major US bank hacks? Well, on that same day, July 21st, Preet Bharara, US attorney of the Southern District of New York, unsealed an indictment against Gery, Ziv, and Joshua. Bloomberg News and the New York Times published some wild claims. They reported that a leaked internal FBI memo had linked Joshua, the man on the run from Israel police and Anthony, the man arrested in Florida, to the JPMorgan Chase hack.
[MUSIC] The memo said there was evidence of Joshua logging into the servers that were used for these hacks. On the same day, we also find out exactly what they stole. I mean, these people attempted to get into twelve banks and they successfully got into a few of them. They must have done this for monetary gain, right? But did they steal any money? No. I mean, I can think of a number of ways they could have stolen money. Obviously a bank the size of JPMorgan Chase has a lot of money in its accounts. The hackers could have moved some of that money around. Okay, but there’s other ways they could have made money too, like the Chase Bank giftcards. Imagine if they got into the database of those or prepaid debit cards, or they could have manipulated the bank’s reward points system.
Imagine if they set their own accounts to have like, a billion reward points. They could convert that to cash and just siphon money out that way. Or what if they instructed a ton of accounts to buy a certain stock, driving up the price? There are a ton of things they could have done while in the bank’s networks. But all they did was steal customer database records. Specifically, they grabbed e-mail addresses of bank customers. I just don’t understand that. Why go through all the effort of breaking into the biggest and possibly the most secure company in America just to steal 83 million customer records? There’s something more to this story. Things are pretty confusing at this point. We have three people who were supposed to be arrested in Israel; Gery, Ziv, and Joshua. They got Gery and Ziv but Joshua wasn’t home. Then, at the same time, two people were arrested in Florida; Anthony and Yuri.
The two Israelis were arrested on charges of securities fraud and the Florida men were arrested [00:30:00] on charges connected with the JPMorgan Chase hack and something to do with a Bitcoin exchange. Finally, some news agencies started reporting on an FBI memo, suggesting that all five men were connected with this hack. Were they the hackers or were they conmen? What role did everyone play? It turns out the feds had started investigating this group shortly after the JPMorgan Chase hack was discovered. The forensic data that the FBI got from JPMorgan Chase had led authorities to Joshua. Somehow, they got server logs that pointed them to his IP address, but they didn’t know how involved he was and they were pretty sure he wasn’t in on it alone. They start digging around his life to see what he was doing and who he was associating with.
That’s how they discovered Anthony, Gery, and Ziv. These guys were looking pretty suspicious. [MUSIC] Joshua was the prime suspect who led investigators to the door of the others. He’s an American citizen. He grew up in Potomac in Maryland. He enrolled in Florida State University in 2002 and studied business. There is where he met Anthony Murgio who was later arrested in Florida. While at university together, they became pretty good friends and being business students, they wanted to find ways to earn cash while in college. They set up a money-making scheme writing Google ads for affiliate commissions. They did pretty well at it, too. They had other students working for them and they were making thousands of dollars a month. Not bad for a couple college kids, actually.
Joshua dropped out of his courses in 2005 but he stayed in touch with Anthony. Now from there, Anthony’s story actually goes in a wild and crazy adventure totally tangent to this one, which is another story worth telling but it doesn’t quite fit this story. I mean, he was arrested in connection with this story but Anthony tells me he was only arrested so the feds could get information on Gery, because Anthony and Gery started a Bitcoin exchange together called Coin.mx. They purposely hid from financial regulators and even went so far as to take over a Credit Union to look legit. The feds swooped in on Anthony for his illegal Bitcoin exchange and because they knew he was working with Gery. Okay, so back to Joshua, the man on the run. In 2013, Joshua set up an internet marketing business with a partner who had a history of defrauding stock markets.
Apparently this guy had been banned for life from the Financial Industry Regulation Authority for marketing useless stocks, sort of a pump-and-dump kind of thing; you buy up an unknown stock, try to inflate the price of it, and when it’s at its peak, you dump it and make a massive profit. But Joshua’s partner got caught doing this and got banned so after that fell apart, Joshua moved to Israel. It seems that’s where he met Gery Shalon and that relationship started. By 2014, Joshua and Gery were running their own stock fraud scam with Ziv Orenstein who was one of Gery’s associates. They had been running that Webologic business together in Israel. Now, the feds didn’t think it was actually Gery, Joshua, or even Ziv that carried out these hacks.
But it looked like they were working with whoever did. As the feds investigated Gery, Ziv, and Joshua, they find these guys are up to their necks in scams and plots, and may have been connected to some serious hacking. By October 2014, internally the feds have totally rejected the idea that these hacks were state-sponsored by Russia. No, it wasn’t the Russians. It was this collection of conmen and fraudsters who’ve been operating huge scams under the radar for years. [MUSIC] Let’s take a look at this indictment that was unsealed by Preet Bharara on July 21st, 2015. It was a lawsuit brought by the SEC, the Securities and Exchange Commission. They’re the US federal agency that enforces security laws.
This lawsuit was brought against Gery, Ziv, and Joshua for six stock market scams they pulled off over the previous four years. It included details about how much money they were making off these scams. Let’s take a look at the first one. They were buying stocks in a company called Southern Home Medical Equipment, a US company based in South Carolina that provided healthcare services across the country. In May 2011, Gery and Joshua bought the company’s stock at 1.7 cents each, not quite two cents per share. They launched their own marketing campaign for this company, hyping it up, writing articles about how great it was and telling everyone that this company was about to go to the moon.
Gery was the savvy business guy. He knew stocks inside and out, and Joshua was the marketer. He was great at selling anything. They successfully raised Southern Home Medical Equipment’s stock price from just under two cents per share to thirty-three cents per share before selling off their stocks in the company. Their net value in that stock rose 1,800% in just six days. But the problem was that all the marketing they did for this company was made up. They had faked the numbers and the news about this company in order to temporarily inflate the stock price. That’s why this kind of market manipulation [00:35:00] is illegal. If you’ve seen the Wolf of Wall Street, you may recognize this idea because that movie is about a similar kind of scheme.
JORDAN: The Securities and Exchange Commission sent two lawyers down to review our files so I set them up in our conference room, and I had it bugged and the air conditioning turned up so high that it felt like Antarctica in there. Then, while they were looking for a smoking gun in that room, I was gonna fire off a bazooka in here, offering up our latest IPO. An IPO is an initial public offering. It’s the first time a stock is offered for sale to the general population. Now, as the firm taking the company public, we set the initial sales price and sold those shares right back to our friends. Look, I know you’re not following what I’m saying anyway, right? That’s okay. That doesn’t matter. The real question is this; was all this legal? Absolutely not, but we were making more money than we knew what to do with.
JACK: Gery, Joshua, and Ziv were in the business of manipulating the stock market and getting people to buy stocks based on false information. These scams are called pump-and-dumps because the scammers try to pump up the value to make a quick profit by dumping the stocks at a higher price. Here’s how they did it. [MUSIC] First, they forged documents so that they could present themselves as stock brokers. They were already working under false pretenses. Now, stock brokers are like middlemen between investors and the stock exchanges. They help investors figure out what stock to buy, when to buy them, and they seek out good investment opportunities for their clients. These days, everything is digital and online so Gery, Joshua, and Ziv created newsletters, social media accounts, and websites to tell investors what shares to buy.
These tools gave their investors the impression that if they followed Gery, Joshua, and Ziv’s tips, their money would grow quickly. Sometimes they would fake the data on these articles and predict that a stock was going to rise in value, but they would actually backdate that article to make it seem like all their predictions came true. Their indictments show that these guys were all using the classic scams. Since May 2011, they hit six microcap companies. They targeted one after another with their tried-and-tested schemes. They hit each of these six companies using the same pump-and-dump formula. They’d buy the company while the stock was less than five dollars each and then they’d create a bunch of false hype about these stocks resulting in a buyer surge that would drastically increase the trading volume and stock price within just a few days. In 2011, they made about $460,000 doing just three companies.
Then they upped their game. In February 2012, they hit a company called Mustang Alliance which is a mining corporation. In just one week, they bought two million shares of Mustang Alliance, increased the share price over 65%, and then sold the shares for a 2.2 million dollar profit. Altogether, they collected 3.5 million dollars in just a couple years running these scams. But this wasn’t their only racket. Gery was the head of operations and CEO of their company, Webologic. He had the final say on all these decisions and he found a couple of stock promoters to bring in on these scams. Their job was to advertise and promote different stocks and shares all day long. They would go hunting for companies that they knew could easily be promoted to be a pump-and-dump. But they did more than that.
In case you didn’t know, there’s a big difference between being a public and private company. Basically, it has to do with who owns the company. A private company is own by some group of people, usually the founders or a management group, or private investor. But a public company is a company that has sold some of its shares to the public through a stock exchange. This means that part of the public company is literally owned by members of the public, the people who have purchased shares in the company. That’s why they’re called shareholders. Also, private companies can’t sell shares of their company on the stock market and it’s actually really hard for a private company to become a publicly-trading company.
It’s a long process that takes years. Even for legit, fast-growing companies, they have to apply and be audited before they can be listed as a publicly-trading company. When that finally happens, they have an event called an initial public offering, or IPO. I say all that because sometimes Gery would find private companies that seem like they would be easy to falsely promote. He worked out a system to help these companies go public so that he could run his pump-and-dump scams using their shares. [MUSIC] Over the years, Gery created heaps of shell corporations. These are companies with no staff, no revenue, no office. These corporations only exist on paper and Gery would go through the long, rigorous process of getting these corporations to go public and be traded on the stock exchange which might have taken him years.
But with publicly-trading shell corporations ready to go, Gery was able to approach private companies, pretend to be a legit stockbroker, convince them to do a reverse merger with his shell corporation, and that would fast-track that company to be public trading on the stock market. Now, this whole scheme is all upside for Gery. First, he’s going to sell his shell corporation to [00:40:00] some company. This could make him anywhere between a few thousand dollars to a few hundred thousand dollars. Because he created these shell companies, he was able to assign any amount of company shares to himself or his friends like Joshua or Ziv. If he did that, then before the actual scam even started, he would already have tons of shares in these companies.
He would sell his shell corporation to a company and then that company does a reverse merger with it, and now that company is suddenly a publicly-trading company. He did all this under the guise of being a helpful stockbroker just here to help them navigate going public. Then once the reverse mergers were complete and that private company was now publicly trading, Gery’s fake marketing campaign would ramp up and make the stock of that company boom. That’s the pump. Right when the hype was about to fizzle out, Gery and Ziv and Joshua would sell all of their stocks which they could have had from the very beginning, and that’s the dump. If Gery was the CEO of this scam operation, Ziv was his ops manager with some IT thrown in.
Ziv bought up a heap of domains and built stockbroker websites that all looked legit. He was the one who maintained all of the different brokerage accounts and the false documents for their schemes. He was the one keeping track of all the moving pieces. Joshua was like the communications and marketing manager; he wrote all the promotional materials that they used to market the companies. With this systematic approach and with all the pieces ready to move, these scams were really just a matter of bombarding people with marketing and buying and selling stocks at the right times. Now, at this point you might be wondering how is any of this connected to the breach at JPMorgan Chase? Well, we’re almost there. Bear with me.
See, over time as these guys were marketing stocks, they were starting to do some e-mail marketing. They would send people e-mails that said ‘Amazing opportunity! Small cap investment can double your money in weeks. Don’t blow your shot at financial freedom.’ They would list a stock ticker symbol and make people feel like they had to buy this stock right away. You’ve probably seen these types of e-mails. I receive thousands of them, myself. The way they work is that the sender of these scammy e-mails just buys a huge list of e-mail addresses and blasts out millions of e-mails at a time. That’s what Gery’s crew was doing at first and that was somewhat successful, but they wanted to take their scam to the next level. [MUSIC] They thought if they could get a list of e-mail addresses of real stock market investors, their spam would be much more effective.
I mean, who better to advertise a stock tip to than people who are actively trading on the stock market?Traders are always looking for a hot stock, and they might just go ahead and buy some random stock that they saw in a scammy-looking e-mail. That brings us to JPMorgan Chase. It turns out that the whole JPMorgan Chase hack was about getting better leads for Gery’s marketing campaign to make his pump-and-dump scams more profitable. That’s right; Gery, Ziv, and Joshua wanted millions of stolen JPMorgan Chase’s customers’ e-mail addresses just to e-mail them stock tips. Of all the absurd, off-the-wall, preposterous crimes, this one takes the cake. Three random scammers orchestrated a hack into the largest bank in the US just to make money on their pump-and-dump scams. Unbelievable. But their criminal activity went beyond just stock market manipulation.
On the same day Gery and Ziv were arrested, July 21st, 2015, an Israeli newspaper reported that another indictment had named them both. But this time it was for a huge, illegal online gambling operation, an operation that was supposedly even bigger than the stock fraud scams they had been pulling. When this report came out, the online gambling forums just lit up. It turned out that Gery and Ziv were behind the well-known, dodgy online casinos Affactive and RevenueJet. These are actually groups of casinos owned and operated by companies called Netad Management and Milore Ltd, and it had dozens and dozens of online gambling websites. For years, the casino sites ran by these two companies had been getting called out by the gaming review sites as being scams. The review sites actively warned players not to use Gery and Ziv’s online casinos.
In fact, in 2010, Casinomeister gave Affactive Group the Worst Casino Group Award, citing their terrible customer service and failure to pay players their winnings. Now, all these sites under Affactive and RevenueJet used gambling software called Rival and RTG for the games. These are the leading suppliers of casino games and online gambling. Then they lease this gaming software to the independent casinos. The games on Affactive and Revenue Jet were legitimate, well-designed games and that’s how they attracted players to come to their sites to gamble. But to gamble on these sites, you need money to play. When winners would actually win money, that’s when Gery and Ziv would start pulling some shady business.
[MUSIC] His casino sites started to develop a reputation for being really unreliable at paying out their players. When a player made a cash-out withdrawal request, [00:45:00] there were all kinds of delays. Security procedures would make players wait ninety days. Some players waited the ninety days for their money only to be told their cash-out wasn’t valid because they didn’t play at the casino for the last few weeks. Sometimes they wouldn’t pay the whole amount; maybe just a percentage just to keep the players guessing. But that would be as far as it went. Often, players would just give up, take the loss, and move on to a different site or they’d end up gambling away their winnings and playing more games in the casino. By avoiding paying out the players, these sites were racking in tons of cash.
Like the JPMorgan Chase hack, this is an absurd scam that doesn’t make any sense to me. An online casino by its very nature makes a ton of cash. The odds are always in the casino’s favor to win, even without scamming anyone. Maybe you’ve heard the term ‘the house always wins.’ Yeah, that’s about casinos. They are literally money-printing machines for the owners. Why treat the players so poorly? Ugh, the nerve of these guys. The greed is just astounding to me. But it gets worse. Just after the arrests, the Netad Management casino’s network collapsed; just stopped. None of the sites were loading at all and the executive director of the Gambling Portal Webmaster’s Association said that he got a notice that the Affactive was closing its operations, effective immediately. It seems like as soon as the indictments came through, someone pulled the plug on the casinos. Their online casino empire had crumbled overnight.
[MUSIC] At that time, Gery and Ziv were in custody in Israel and the US was trying to get them extradited to face these stock fraud charges. Joshua was still nowhere to be found and with his indictment unsealed, his name showed up on the FBI’s Most Wanted list. But still, we don’t know who actually conducted the hack against JPMorgan Chase and the other twelve financial institutions. Gery, Ziv, and Joshua were market manipulators, shady businessmen, and con artists, but they weren’t hackers. We know they had the stolen e-mail addresses from the JPMorgan Chase hack, but how did they get them? Breaking into JPMorgan Chase’s network is not an amateur hacking project. Whoever did it really knew what they were doing.
But if Gery or Ziv or Joshua weren’t the hackers, then who was? A year after JPMorgan Chase discovered they’d been hacked, several more financial companies received visits from the FBI informing them that their networks had been breached and they had evidence to prove it. These companies started to send out letters to their customers. In October 2015, the online discount stockbroker E-Trade sent a letter to all their customers explaining that their network had been breached and that customers’ personal information had been compromised. They said their database was breached which contained 31,000 E-Trade customers’ data. Scottrade, another online stockbroker, revealed that they were also hit by these hacks, but their breach was way bigger. They believe that the person information of 4.6 million of their customers had been stolen.
Dow Jones sent out letters, too. Now, they’re not a financial institution in the way of a bank or a broker is, but they’re a big publisher of financial information. They’ve been going for 137 years. They published the Wall Street Journal, MarketWatch, and Barrons. In October 2015, they informed their customers of a data breach. In their letter, they explain that the hackers may have been in the system for three years but they’d only found evidence of the theft of 3,500 people’s contacts or payment data.
There were clues like IP addresses and the malware and the data that was stolen which made authorities suspect that these hacks were all conducted by the same hackers. A month later, all the evidence came out. On November 10th, 2015, Preet Bharara, the attorney general of the Southern District of New York, unsealed a superseding indictment against Gery, Ziv, and Joshua. It was a bombshell. Getting indicted for these stock scams probably seemed bad enough for these guys, but now they were really in trouble.
PREET: Good afternoon. My name is Preet Bharara and I’m the United States attorney for the Southern District of New York. Today we announce criminal charges in one of the largest cyber-hacking schemes ever uncovered. The charges involve cyber-intrusions over several years targeting twelve different companies; seven financial institutions, two financial news publications, two software development firms, and a market risk intelligence company. By any measure, the data breaches of these firms were breathtaking in scope and in size.
The defendants allegedly stole personal information for over 100 million customers including 83 million customers from one bank alone, the single-largest theft of customer data from a US financial institution ever. That bank was JPMorgan Chase, as it has disclosed itself. To hide their tracks, the defendants allegedly operated their criminal schemes through over seventy-five shell companies and used close to twenty – two-hundred, I’m sorry, identification [00:50:00] documents fraudulently including thirty false passports from seventeen different companies. The good news is that the FBI and the Secret Service have cracked this case and we aim to prove it in court.
JACK: [MUSIC] At this point, the evidence of the case was getting massive. These guys have been running an international cyber-crime enterprise. The new indictment accused them of twenty-three counts which included computer fraud, hacking, wire fraud, security fraud, money laundering, identity theft. It just went on and on. This one group had been running this whole system of interconnected, illegal schemes; scam on top of scam on top of scam. They were making hundreds of millions of dollars. What the feds had uncovered here was huge. The scale of this is just incredible. I mean, it’s really crazy. But let’s stop for a minute and talk about the money. That’s what Gery was doing all this for, right? Well, he was living the high life in his Tel Aviv mansion, passing himself off as a really successful businessman.
I guess that in a certain sense he was a successful businessman and he did have some legitimate business interests and investments that earned him good money. But to live the kind of lifestyle he wanted, I guess he felt like he needed to keep chasing the next big payday. Anyway, all these scams; the online casino, stock fraud, the hacks, they were making Gery, Ziv, and Joshua hundreds of millions of dollars and they couldn’t just throw all that into a bank account. That definitely would have attracted some unwanted attention. Banks are required to report deposits of a certain size and I’m sure that if Gery, Ziv, and Joshua had deposited their hundreds of millions of dollars, it would have triggered some sort of reporting policy. They needed a solution, a way to launder the money, convert their money from illicit and unusable to clean and spendable. They came up with a couple of ways to do it.
[MUSIC] Remember those shell corporations that Gery was using to do reverse mergers with private companies for their stock scam? Well, this also came in handy for laundering a lot of money they were making. Gery and Ziv were moving money around left, right, and center. They were transferring millions of dollars from their casino businesses to bank accounts in Cyprus, and then shifting it all around through all the shell companies. They had their money-laundering down to a science. All they had to do was fill their shell companies’ ledgers with transactions for goods and services that they had supposedly been providing their customers. They could then use this dirty money to pay themselves for those made-up goods and services.
That way, it would look like this money was just shell companies invoicing it and paying out legitimate customers. This left the shell companies with loads of money in their accounts and a nice audit trail that made everything look more legit. At the end, they had clean money. Gery had seventy-five different shell companies. He, Ziv, and Joshua had multiple bank accounts and brokerage accounts in countries all over the world. Obviously, none of them were set up in their own names. All three of these guys had aliases they would use. They had thirty different fake passports from across seventy different countries. Keeping track of all these companies and accounts and the false documents and the different names; that must have been a full-time operation just doing that.
It’s pretty impressive how they were able to manage all these moving pieces. Before they got caught, it probably seemed like it was worth all this work. [MUSIC] In 2011, the same year he started the pump-and-dump scams, Gery created two online payment processing companies called IDPay and Todur. You could think of these as more like shady versions of PayPal. Gery used these payment processors to let his players deposit money into gaming accounts in his online casinos. These sites were the intermediaries between the players’ bank accounts and the casinos’ bank accounts. Each transaction would go through these payment processors, but Gery had to hide that money because it wasn’t legal. To turn that money into money he could actually use, he needed to make it look like it came from a legal source.
Gery and Ziv opened multiple bank accounts in different countries using fake IDs and fake documentation. They would send transactions made through IDPay and Todur into these accounts around the world. Now, credit card companies are not allowed to process payments that they believe might have come from illegal activity. Gery and Ziv would code their transactions to make them look like simple online purchases from everyday retail websites like pet stores or wedding outlets. If they could find banking officials in the countries they were depositing their money, they would bribe them to turn a blind eye. Basically, they did anything they could to prevent anyone from catching onto their operations. Of course, the players at Gery’s online casinos had no clue what was going on in the background.
Everything probably just seemed normal from their perspective. Gery had a bunch of like-minded friends, other criminals who needed to launder money just as much as Gery did. He was friends with people selling fake pharmaceuticals, malware, and fake antivirus software. Whatever their business, if they wanted to collect payments via credit card, they needed a shady payment processor and they would use Gery’s IDPay and Todur. Of course, just like any payment processor, Gery would take a nice cut of each transaction. But sometimes the credit card companies did get suspicious. [00:55:00] When that happened, the credit card companies would stop processing Gery’s transactions and issue fines and penalties to whichever financial institution Gery got caught using. Gery would just pay these off and carry on where he could.
It was just a minor inconvenience; a cost of doing business. If they got questioned about this, they’d all act shocked and surprised as if they had no idea the transactions were for illegal goods and activities. If a bank got suspicious and closed one of Gery’s accounts, he’d just find a new bank and open a new account. It became a pretty constant process of finding new accounts and coming up with fake merchants to use for transactions to make them look legit. It was all very shady but it was working. In 2012, Gery did another astonishing move. There was this company called G2 Web Services. This is sort of a watchdog company that monitors payment processors to make sure they’re above board and not fraudulent. Basically, the staff at G2 will go and do a test at payment processors to make sure they’re trustworthy.
Well, Gery was using IDPay and Todur to process a lot of payments for his illegal activities. He didn’t want G2 to flag his payment processor as fraudulent, so he hired a hacker to break into G2 and get a list of credit cards that were used in test-payment transactions. Then Gery would just block those credit card numbers from being used at IDPay and Todur so that nobody at G2 could even test the payment processing on his websites. The audacity! I’ve never heard of a hack like this; to hack into a watchdog company just to make sure that they don’t talk bad about you and to block them, it’s just ridiculous. In July 2013, two years after Gery first created IDPay and Todur, Brian Krebs published a report about potentially suspicious activity being conducted at IDPay.
A source had found IDPay’s customer database and discovered a bunch of fake antivirus sites were using this payment processor. These websites had addresses like spyblocker.com, malwaredefender.com, personalguard.com, and so many more of fifty domains. Krebs investigated IDPay and he couldn’t find anything about them. There were no records of this company existing at all, so he concluded that these websites were installing fake malware onto victims’ computers and then asked the victim to pay to get the virus removed. These sites were using IDPay because a legitimate processor would never process sketchy transactions like this.
If this is what was going on, then I guess we can add this bogus antivirus payment processing scam to the list of growing crimes that were committed by Gery and his friends. One site on the list of IDPay’s customers was rxpartners.com. This was known to be an illegal pharmacy affiliate program. Hackers and spammers would sign up and earn cash for promoting illegal pharmacies. In 2013, not many people knew about Gery and his massive empire of hacking and scamming, and they didn’t know he was the one behind IDPay. While Gery was focusing on making sure anti-fraud companies like G2 Web Services weren’t onto him, he didn’t realize that the feds were onto him. How did the feds get on Gery’s trail?
[MUSIC] Well, a month before he was arrested, an undercover federal agent went on to one of his casino’s websites and deposited some money using his credit card to make a bet. When he checked his credit card statement, he found the transaction had been recorded as a payment to houseforpets.com which wasn’t even a real website. This was the first thing that tipped off the feds and from there, they quickly found a lot of evidence leading to Gery, Ziv, and Joshua. It was the hack on JPMorgan Chase that really brought down Gery’s empire. If you remember, the hackers successfully broke into the JPMorgan Chase’s network and stole 86 million records and got out without raising a single alert. JPMorgan Chase had no idea they were breached and that was by design. The hackers were extremely careful not to raise any red flags.
The only reason JPMorgan Chase ever found out that they’d been breached was when they read that Hold Security report and found that Simmco Data was breached, and the evidence from that breach is how JPMorgan Chase figured out they were breached. JPMorgan Chase was never supposed to find out that they were breached, so once it came out that JPMorgan Chase did know that they were breached, it was time for the hackers to start covering their tracks. Remember the canceled Egyptian server rental? Yeah, they knew they were getting rumbled. But again, JPMorgan Chase wasn’t their first hack. Uh-uh. They already got away with hacking six other US financial companies. On the same day of the big twenty-three count indictment was unsealed, a third indictment was unsealed also in Atlanta.
This indictment was focused on the hacks and it tells us exactly how they happened. The feds had confirmed that it was Gery pulling the strings on all these hacks and they knew Joshua helped him out. But they also knew that neither Gery nor Joshua were hackers capable of doing this. The indictment brought charges against Gery, Joshua, and an unidentified suspect, a John Doe, the mystery hacker. [01:00:00] Okay, so with this indictment, we learned about how the hacker got into E-Trade and Scottrade. At first, the hacker got a regular login to E-Trade and poked around as just a normal user, looking for vulnerabilities on the site. I’m not sure what he found but on that same day, three of E-Trade developer servers got accessed by the hackers. But nothing was stolen at that time.
Almost a whole year passes, then Gery tells the hacker the plan to steal customer data from the databases and gives the hacker servers around the world to use; servers in South Africa, Romania, and the Czech Republic. These were not bulletproof servers which were untouchable by the feds, but Gery told the hacker they were registered anonymously. With the hacker ready, the infrastructure in place, and the plan figured out, Scottrade was the first of the two to be hacked. [MUSIC] On September 8th, 2013, Gery’s hacker reported that he’d hit a wall. Scottrade had antivirus in place and he could only get access to one employee’s computer without raising alarms. But this employee had no admin rights, so this slowed down the hacker. For the next two months, he tried and failed to gain access.
But on November 22nd, the hacker asked Gery to get him a Scottrade user account, hoping he could use it to breach Scottrade’s systems. So, Joshua and Gery provided the hacker with a regular user login. From there, the hacker was able to find vulnerabilities in the site and exploit them to get access to Scottrade’s servers. The next day, he was searching through Scottrade’s networks for customer databases and he found them. He looked through a few of the records in the database and he saw customer name, phone numbers, and e-mail addresses. Bingo. This is what he was looking for. He did a quick count to see how many records were in the database.
There were six million customer details. Gery was very excited about this discovery and of course, he wanted the e-mail addresses of this database. The hacker took one more look around the database server and he noticed he wasn’t in there alone. A database admin was also logged into the customer database and actively running commands. The hacker got nervous. He needed to download these six million records. He was right there in front of it, but he wanted to do it in secrecy so that nobody would ever know he was there. He was nervous that if he downloaded the data while the other admin was there, he might draw unwanted attention.
He couldn’t afford for that admin to notice that something fishy was going on and at the same time, he didn’t want the admin to notice he was there and kick him out. So, he waited nervously until that admin logged out. Then he quickly copied six million customer records to a server that the hacker controlled, covered his tracks, and disconnected from Scottrade’s network. The hacker gave Gery a password and location of the stolen database. On November 25th, Gery sent the hacker a report of the customer data that was stolen from Scottrade. The database included information of four million Scottrade customers. 100,000 of them were residents of Georgia. The hacker then added more, around 200,000 to 300,000 bank customers of Scottrade.
Two days later, he breached more databases and added more data to the server. On November 27th, Gery’s hacker reported that he now had six million records from Scottrade. They didn’t waste any time before going to E-Trade. The very next day, the hacker breached E-Trade’s server using a brute force attack to gain access to a video teleconferencing server on their network. Of course, once he got in, he got himself persistence and elevated his privileges. He installed a back door into the servers and started looking around the network for database servers. Four days later, the hacker breached another server on E-Trade’s network and installed a reverse shell on it. Four days after that, he gained access to three more internal servers and a core admin platform. This was the motherload.
These servers contained all of the customer data for E-Trade customers. The hacker began copying all the data stored on these servers. The reverse shell he had set up was exporting data for days after that. Gery’s hacker would eventually steal fifteen million customer records from E-Trade’s network. Once he stole them, he would send them straight to Gery. By December 16th, one of Gery’s associates had cleaned up and merged all the stolen customer records from E-Trade and Scottrade into an enormous database. This was the customer information Gery wanted; a vast database containing the contact details of millions of potential investors, people who he knows are already investors.
Over the course of four months, Gery’s hacker had been going in and out of multiple servers on both E-Trade and Scottrade’s internal networks. He hadn’t set off any alarms. No security scans picked up on his activity but at some point, E-Trade began to suspect their systems had been breached. They launched an internal investigation and they got law enforcement involved. But nothing came of it. They couldn’t find any evidence that data was stolen. There were no logs that somebody copied the data because [01:05:00] the hacker hid his tracks so he wouldn’t get detected. E-Trade concluded that if they had been breached, then the perpetrator had hidden their tracks really well, so the investigation just kinda stalled out. But they were right; someone had been in the systems and it was Gery’s mysterious hacker.
[MUSIC] As E-Trade and Scottrade were being hacked, Gery’s online casinos were making considerable money. He was running at least twelve different casinos. In October 2013, they made him 78 million dollars. Gery and Ziv had 270 employees in Ukraine and Hungary working in call centers to help keep these casinos running. They were responding to queries and trying to help keep players happy, but they were also giving the runaround to players who were trying to cash out their money. Gery and Ziv needed to draw as many players to their casino as possible. The more people playing meant the more people they could scam out of their winnings.
To help that bit along, Gery called in his hacker. When people want to do some online gambling, they typically start with a Google search and visit the first few gambling websites that show up. They think oh, this casino is the first result in Google so it must be popular and trustworthy. Knowing this, Gery started trying to get his hacker to find ways to improve the casino’s search ranking on Google. Now, there’s a whole lot that goes into search ranking.
It’s called SEO, search engine optimization, and what actually determines the ranking on Google’s search is a little bit mysterious. They use an algorithm of some kind but in the SEO world, it’s generally believed that to boost a site’s ranking, you need more links to that website. So, much of SEO is based on the idea that the more websites on the internet that post links to your site means that your site becomes more popular in the search rankings. Gery knew this and wanted more links to his casinos. He used a secret ingredient to get that. Want to take a guess on what that was?
HANS: The secret ingredient is crime.
JACK: He asked the hacker for help and the hacker got to work to try to find a way to make tons of links to Gery’s online casinos. After a bit of searching, he started hacking into dormant gambling-related WordPress blogs. We’re talking like, thousands of them here, blogs that hadn’t been updated in ages and whoever owned them lost interest in it. All their plugins were out of date, the software hadn’t been updated and well, yeah, they were vulnerable to being hacked. The hacker exploited a lot of these old WordPress blogs and he created tons of links to the casinos’ websites. Compare this to hacking into banks; it was pretty easy.
Once he finished, these sites had new posts mentioning Gery’s casinos and how they were absolutely the best place to gamble on. When these blogs got re-indexed by Google, these new posts made Gery’s casinos rise up in the ranking and become more popular. Now whenever users searched Google for keywords like ‘best online casino’ or ‘where to play online casino games’, these ancient blogs were starting to pop up with fresh results. People always click on the first couple of results. That’s just how it is. So, people clicked on these old blogs, they saw tons of glowing reviews of Gery’s casinos, and this hijacking of neglected blogs drove enormous amounts of traffic straight to Gery’s online gambling sites. That wasn’t all.
Gery liked to be in control and know exactly what was going on, so he paid this hacker to visit his competitors’ websites. [MUSIC] He would have the hacker take down any competing gambling site he got annoyed at. The hacker would use a botnet to launch a huge denial-of-service attack on competitor casinos, interrupting service for those casino players. Of course, when gamblers can’t get into their favorite gambling site, they might go looking for a different site to gamble on. The DDoS attacks that Gery was conducting could actually drive players to his casino, too. Then Gery would find out what software the competitor casinos were using and then ask the hacker to gain access to that software company to monitor what rival casinos were saying and doing.
He also hacked into e-mail accounts of executives at the companies that made online gambling software used by many casinos, just let Gery in on deals that executives were making with each online casino. This allowed him to stay a step ahead of his competitors. If anything was going on that might compromise one of his casinos, he would have an early warning. Gery was used to getting what he wanted and he was quite happy to use sneaky, underhanded tactics to get his way. He was getting away with everything until it all caught up with him on July, 2015 when Gery and Ziv got arrested by the Israeli police. Once the indictment was announced on November, everything went, well, a little bit quiet.
The feds and prosecutors were working to prepare their cases. The first thing they were going to do was get Gery and Ziv extradited to the US. This was a pretty long process which took about a year. In June 2016, they were both extradited to New York and found themselves in a Manhattan prison. On June 9th, they appeared in Manhattan Federal Court. Both Gery and Ziv pleaded not guilty to the long list of charges against them. But there was still one guy out there; Joshua. Joshua was still somewhere in the wild and the FBI was searching [01:10:00] everywhere for him. They suspected that he was hiding out in Russia. It made it pretty complicated to look for him there. But then Joshua just solved that problem for them.
It turned out Joshua was in Moscow all along and on December 14th, 2016, his attorney called the feds and said Joshua’s gonna turn himself in and is flying into the JFK Airport in New York. So, Joshua did. He flew to New York and was arrested on the spot. You see, Joshua got himself in a bit of trouble with the Russians. He had flown into Russia via Ukraine on May 23rd, 2015 and had been staying in an apartment in Moscow. In May 2016, right as Gery and Ziv were about to be extradited from Israel to the US, Joshua was arrested by the Russian immigration police. They turned up at his apartment for a surprise spot check on his Visa documents. For Joshua to maintain his Visa, he was supposed to fly out of the country and then come back every six months. He hadn’t been doing that because he was hiding out from the FBI.
The Russian immigration police put him in jail. On May 20th, a Russian judge fined him an equivalence of $80 and ordered him to leave Russia. Joshua had to leave Russia but he wasn’t interested in going to the US and getting arrested by the FBI. He applied for refugee status so that he could stay in Russia. [MUSIC] While he was waiting on his refugee status at an immigration office in Moscow, he talked to his lawyers and they changed his mind. They convinced him that it was better for him to come to the US and face his charges than to continue hiding out in Russia. But strangely enough, when Russia found out Joshua was wanted by the FBI, they offered him asylum.
They probably thought he would be useful for some sort of political or diplomatic leverage. Joshua had already made up his mind though so he turned down the offer of asylum, but Russian immigration was now hesitant about letting him leave. So, he was stuck in the immigration center while his lawyers were negotiating with Russians and the feds, both of which wanted Joshua in their custody at this point. After about six months of this, in December 2016, everyone agreed and Joshua got on the flight to New York and was arrested. By the time Joshua gave himself up, Gery had been in prison for almost two years. Gery plead not guilty and was looking at a lengthy court trial. Gery was the mastermind behind all these schemes.
He had the valuable knowledge and connections with the underground criminals. Plus, he probably knew some stuff about Russian cyber-crime networks. The feds recognized that Gery could be really valuable to them, so they offered him some plea deals. They offered to release him if he agreed to plead guilty to all the crimes he did if he became an informant. On May 22nd, 2017, a big daily newspaper in Israel, The Calcalist, reported that Gery had agreed to pay US authorities 403 million dollars in cash under forfeiture. His plea deal also meant that three criminal proceedings against him plus an SCC civil lawsuit, were all dropped. [MUSIC] Now, 403 million dollars sounds like a lot, but the feds estimated he had earned over two billion dollars.
Gery probably was walking away with some extra cash left in his pockets. But giving up his cash meant that he had to tell the feds where the money was and wow, he had a lot of cash stashed all around the world. He had eighty-one different bank accounts around the world. Many of them were in Switzerland and some of these accounts had over 100 million dollars in them. There were accounts in Cyprus, Georgia, Virgin Islands, Luxembourg, Latvia. They were everywhere. On top of that, he had stashes of cash and jewelry worth millions, and a six-million-dollar house. Gery’s plea deal wasn’t straightforward. According to The Calcalist, it took six different law firms to negotiate it. Five of these law firms were in the US and one was in Israel.
While Gery agreed to pay hundreds of million dollars of his illegal profits to get out of prison, he had to give the feds more than money. It seems like he gave up a hacker, a thirty-eight year old Russian man named Peter Levashov. Peter was from St. Petersburg and he’s the one who built the Kelihos botnet which infected 100,000 computers. This botnet was built to send massive amounts of spam e-mails. But the Kelihos botnet was also available for hire; anyone could use it to send tons of spam themselves, and Gery was definitely sending a lot of spam. Peter was arrested on April 9th, 2017 while on holiday with his family in Barcelona, Spain. He was accused of running the Kelihos botnet and pleaded guilty of it in Connecticut in September 2018.
The counts against him included the distribution of fake spam e-mails, promoting counterfeit pharmaceuticals, and other frauds including pump-and-dump stock schemes. He’s still awaiting his sentencing. [01:15:00] It’s not clear what Gery told feds about Peter, whether he just straight-up ratted Peter out or what happened there. But the question everyone had was hey, this Peter guy, is that Gery’s mystery hacker? At first, I thought it was but no, he wasn’t. Peter wasn’t Gery’s hacker. That was someone else entirely. [MUSIC] In December 2017, law enforcement flew into the airport of Georgia, an Eastern European country. They were there at the request of the US authorities and they went to the capital to arrest thirty-five-year-old Andrei Tyurin.
Andrei is a Russian citizen but the US had been tracking him and knew he was flying into Georgia from Moscow, and they wanted him in custody before he could disappear. Andrei was a well-known, high-level Russian hacker. The feds believed he was the hacker working with Gery in his empire of scams, and they spent the last two years trying to track him down and detain him. Once in custody in Georgia, the feds set out to get him extradited to the US. Now, Russia does not like giving up its hackers, but there’s not much they can do when it’s outside their country. That’s why the US arrested him in Georgia, because you can get him extradited out of Georgia.
Now, some Russian hackers have a double motive for hacking. They work on a freelance basis, taking jobs from whoever is willing to pay their fee. But they may also be looking to pass any juicy information they find to the Russian government or anyone else who’s willing to pay for this information. Regardless of who’s paying for the hack, the hacker’s always the first person to get their eyes on the data. Sure, the hacker will upload a copy to whoever hired them, but there’s nothing stopping them from uploading a copy to someone else, too. Although the FBI had ruled out the possibility that the JPMorgan Chase hack was executed by the Russian government, US intelligence had apparently found some evidence to suggest Andrei was getting some protection from the FSB, Russia’s intelligence agency.
It hasn’t been confirmed but some evidence suggests that the FSB tried to recruit Andrei while other bits of evidence suggest he may have had a bigger role in the operation run by FSB. Either way, it took almost a year for feds to get through the red tape and bring Andrei onto US soil and book him into a federal prison. [MUSIC] Now, a quick aside about US attorneys; this case was being handled in the Southern District of New York and Preet Bharara was the US attorney for that district. When the US government brings this case to trial, a federally-appointed attorney handles the case. But when Trump was elected president, he had Jeff Sessions order all forty-six US attorneys from Obama’s administration to resign.
Preet Bharara had met with Trump a few days earlier and did not get the impression that he was being fired, so Preet refused to resign, but Trump fired him the next day. The Trump administration appointed Geoffrey Berman as the new US attorney for the Southern District of New York. On September 7th, 2018, Geoffrey Berman announced that Andrei had been extradited from Georgia to New York. This was a massive win for the feds; getting an indicted Russian hacker extradited into the US for cyber-crimes is not something that happens very often. Oh, and as for the US attorney for the Southern District of New York, Jeffrey Berman, Trump fired him, too. I guess Trump didn’t like that Berman was investigating Rudy Giuliani, Trump’s personal attorney regarding some suspected criminal activity.
Trump put Jay Clayton in place to be the current US attorney for the Southern District of New York. Clayton has never been a federal prosecutor before but he was the chairman of the Security and Exchange Commission. This case has now passed through the hands of three different US attorneys for the Southern District of New York. Andrei was charged with ten counts including computer hacking, conspiracy, wire fraud, and identity theft all relating to Gery’s enterprises. The same day they got him into New York, he was put in front of a judge to state his plea, not guilty. Andrei wouldn’t admit to anything. On September 25th, there was an initial pretrial conference hearing.
The prosecution presented their evidence to Andrei through a Russian interpreter. The evidence against him, which was mostly in Russian, was pretty damning. They had almost 3,500 pages of online chats between Andrei and Gery all discussing the hacks and scams. The evidence took up nearly two terabytes of storage. They also had evidence from devices seized from Gery and Ziv when they were arrested in Israel which all pointed to Andrei being involved in this. They had the data from the hacked companies too, like logs and records from the hack, and that resulted in another few terabytes of data which was not looking good for Andrei. The data from the JPMorgan Chase hack was over three terabytes just on its own. The prosecution and defense had to agree on a way to deal with all this digital evidence. You can’t just print all that out; it’s just too much information and it’s not like it’s just some long text document.
Lots of this evidence [01:20:00] was complex technical data. Prosecutors and defense attorneys aren’t computer experts, so they needed to get all this data into a format that they understood that could be used in the court case like this. The prosecution and defense worked together to figure out how they were gonna do that. What followed was a long line of adjourned court dates and pretrial hearings. For a full year, nothing moved in terms of court appearances. Then suddenly, Andrei’s case ended in one day. On September 23rd, 2019, Andrei submitted a change of plea. He was now pleading guilty.
Andrei admitted to conspiracy to commit computer hacking, wire fraud, unlawful internet gambling conspiracies, and conspiracy to commit wire fraud and bank fraud. [BEEPING] In pleading guilty to these four counts against him, he was admitting to hacking eight different US financial institutions between June 2012 and August 2014. These include JPMorgan Chase, Fidelity, Dow Jones, E-Trade, and Scottrade. Publicly at least, Andrei’s conviction was the first in this entire case. His lawyer said that Andrei was hired by the masterminds of the schemes to hack these computer networks under their instructions.
Because he pleaded guilty, there was no need to have a trial. On Jan 7 2021, the court sentenced Andrei to 12 years in prison for his involvement with this. It’s believed that Andrei earned over $19 million dollars from his hacking activity.
Gery is believed to be out of prison and living somewhere in the US. Until his forfeiture is completely paid, he’s not allowed to fly out of the country. Information about his court hearings or progress on his remaining charges are hard to come by. I mean, if Gery is an informant, then that means that a lot of his court documents are going to be sealed, and a lot of his court documents are sealed. It’s just one of those things I don’t have a visual into. Ziv, though, has been convicted of something. He is currently waiting to be sentenced. The fact that he hasn’t been in any news about any of these cases could mean that all three are cooperating with US authorities.
It’s possible that they are providing information in exchange for leniency in their own cases, but unless their cases are unsealed, we might not ever find out. Altogether, these schemes made a colossal amount of money. It really was a sprawling, interconnected network of scams building on top of each other, scaling up, leveling up, and expanding outward. The whole story is full of surprises and by the end, it’s mind-bogglingly complex; a web of illegal schemes, hacking fraud, money laundering, carried out by some shady businessmen and conmen joining forces with a hacker. Just as the schemes themselves were large-scale, so too was the network of people and resources Gery had built to operate it all. The story has it all; the villains, the hacks, the underground illegal acts, and finally a hammer of justice that brings it all crashing down.
The hack into JPMorgan Chase wasn’t random, a one-off attack. It was done by someone who seemed to have an insatiable appetite for more; more hacking, more data, more scams, more money. Sure, there’s an element of glamour to Gery Shalon’s story. The money, the fancy watches, the mansion, but there’s also an element of desperation. I mean, what was the point of all this besides just wanting more? How many hundreds of millions of dollars more did he need? From my point of view, it’s like none of these schemes seemed big enough for him. No amount of money seemed satisfying enough and at the end, it kinda seems like it was all an endless desire that eventually led to the destruction of Gery Shalon’s empire.
(OUTRO): [OUTRO MUSIC] If you love Darknet Diaries, stories from the dark side of the internet, then support it. Go to patreon.com/darknetdiaries and join the group of the most amazing people, the people who keep my network running. I talked with one Patreon member the other day and he told me he drove for eight hours while listening to the show. What’s funny is he only had to go to the store to get some bread but the show was so addicting that he kept driving around just to listen.
If that’s the kind of listener you are, then consider giving back to the show by supporting it at patreon.com/darknetdiaries. Join today and I’ll grant you special access to bonus content and an ad-free feed. Thank you. This show is made by me, the spider-buyer, Jack Rhysider. This episode was written by the crime-traveler, Fiona Guy. Sound design and original music was created by the graphical interface Andrew Meriwether; editing help this episode by the window-gazing Damienne. Our theme music is by the sound system Breakmaster Cylinder. Even though back in my day we didn’t have USB; we only had USA, this is Darknet Diaries. [01:25:00]
[OUTRO MUSIC ENDS]
[END OF RECORDING]