Accused Cypriot scammer threatened to publish stolen data if victims didn't pay huge extortion fees

Victims included the Ripoff Report and a sporting news site owned by TBS.

The government of Cyprus has extradited a 21-year-old accused cybercriminal to the United States after he was accused of breaching a number of U.S. companies as part of a years-long extortion effort.

Joshua Epifaniou, a Cypriot national, arrived in New York City on Friday, more than two years after he was initially arrested in connection with a corporate hacking spree.

Epifaniou is charged with stealing personal information from at least four sites, then demanding a payment in exchange for not publishing that data, according to the U.S. Department of Justice. Epifaniou also hacked Ripoff Report, a business accountability site, and charged his clients between $3,000 and $5,000 to delete relevant complaints, prosecutors contend. Epifaniou also allegedly worked with a search engine optimization firm to research companies disparaged on Ripoff Report that would be most likely to pay for his services.

The Justice Department announced Saturday that Epifaniou was the first Cypriot national to be sent to the U.S. under an extradition treaty. Law enforcement sent Epifaniou to the U.S. along with Ghassan Diab, a citizen of Lebanon wanted in Florida on unrelated charges of laundering proceeds from drug sales through the black market.

Epifaniou’s alleged hacking scheme involved the theft of personal data from a game publisher in Irvine, Ca., a hardware company based in New York, NY, an employment website in Va. and a TBS-owned sporting news website based in Atlanta, Ga.

By exploiting software vulnerabilities to steal data, then threatening to publicize that information if the victim didn’t pay a ransom, attackers defrauded victims out of $56,850 in bitcoin between October 2014 and November 2016. The affected organizations also paid more than $530,000 to remediate their security incidents.

Epifaniou also breached Ripoff Report on Oct. 30, 2016, the indictment alleges, by using a brute force attack, which involves guessing usernames and passwords through a trial-and-error method. As part of the scam, Epifaniou is accused of emailing Ripoff Report’s chief executive and threatening to publish stolen data if the company refused to pay $90,000 within 48 hours. While the indictment does not say whether Ripoff Report agreed to the terms, Epifaniou’s alleged operation continued for months afterward, as he accepted payments to delete dozens of records.

Representation for Epifaniou could not be located for comment.

He is scheduled to be arraigned on Monday in a court in the Northern District of Georgia.

The indictment is available in full below.

[documentcloud url=”http://www.documentcloud.org/documents/6997860-Epifaniou.html” responsive=true]

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure