18-year-old Arion Kurtaj was found to be responsible by a London jury for a spree of cyber-attacks on major companies, stealing their data, and demanding ransom while threatening to leak the information.  

The Oxford native was believed to be one of the ring leaders of the teenage cybercriminal gang Lapsus$, which has a number of high profile victims such as Microsoft, Cisco, Okta, T-Mobile, Samsung, Vodafone, Ubisoft, 2K, and Globant.

Kurtaj is autistic and was deemed not fit to be in court for the seven-week trial but remains in police custody. His counterpart, also autistic, is 17-years old and cannot be named for legal reasons. The two are due to be sentenced at a later date. 

“These young opportune hackers are prevalent because companies are still falling foul of basic security controls. The tactics used by Lapsus$ follow those of similar groups, targeting low hanging fruit and moving as quick as possible once they’re inside. Smash and grab,” said William Wright, CEO of Closed Door Security.

Kurtaj was found to have helped his associates in the Lapsus$ gang to hack the data files and servers of telecoms company BT and mobile operator EE, demanding a £3.1m ransom in 2021. While the ransom was not paid, Kurtaj instead used SIM details to steal nearly £100K in crypto from just five cryptocurrency wallets. 

Following this ordeal, Kurtaj and the unnamed 17-year-old were arrested. The two were later released under investigation. 

Not one month later, the duo were “key members” in a breach of the AI chip-maker Nvidia, leaking sensitive information and demanding a ransom. The group was then re-arrested in March 2022. Kurtaj was moved to a Travelodge hotel for his safety after being targeted and doxxed by rival hackers, which revealed his home address. 

As a condition of his bail, Kirtaj was not allowed to use the internet, but still managed to do so from his hotel room with the Amazon Fire Stick which was found connected to the hotel TV, along with a smartphone, keyboard, and mouse. Using this, he was able to connect to cloud computing services, and participate in an attack on Revolut, Uber, and Rockstar games. 

Recommended

• Nvidia Confirms Cyber-attack that saw Employee Log-ins Leaked Online
• Sophisticated Ransomware Attacks Pose Growing Threat to the UK
• Teen Commits Suicide After Instagram Poll

This attack accessed approximately 5,000 Revolut customers’ information, and two days later, Kurtaj caused nearly £2.3 million in damages to Uber. 

When he breached Rockstar games Kurtaj leaked 90 second clips of the highly anticipated Grand Theft Auto 6 video game in a fan forum under the name TeaPotUberHacker. 

“This case once again highlights the focus law enforcement is placing on catching cybercriminals and the fact that even despite working behind the shadows under many guises, attackers will get caught,” said Wright.