Case involving 'AlfabetoVirtual' website defacements ends in guilty plea

Billy Anderson allegedly hacked into and defaced thousands of websites, including ones run by the NYC Comptroller and West Point.

A California man accused by federal prosecutors of defacing thousands of websites belonging to the U.S. government pleaded guilty on Tuesday to two felony counts of computer fraud, the Department of Justice announced.

The DOJ says that Billy Anderson, 41, admitted to more than 11,000 instances of hacking into and defacing websites belonging to the military and government, as well as businesses. Anderson allegedly conducted these operations under the alias “AlfabetoVirtual,” which would appear on the defaced websites.

“This case demonstrates that those who seek to commit cyber intrusions of government websites will be prosecuted to the fullest extent of the law,” said Geoffrey Berman, U.S. Attorney for the Southern District of New York, in a statement.

While the DOJ says he “took responsibility for” thousands of defacements, Anderson’s plea is for two counts in particular. In July 2015, prosecutors say he gained access to a website run by the New York City comptroller’s office and displayed the messages “#FREEPALESTINE” and “#FREEGAZA.” In October 2016, DOJ says that Anderson defaced a website belonging to Combating Terrorism Center at the U.S. Military Academy at West Point. In the West Point hack, he reportedly just displayed his pseudonym.

The DOJ says Anderson employed different methods for his defacements. In the NYC comptroller case, he reportedly exploited a bug in a plugin on the website. In the West Point case, prosecutors say Anderson bypassed access controls by using an “unauthorized administrative account” and exploiting “a known cross-site script vulnerability.”

Apart from the counts he faces in court, Anderson’s alias, AlfabetoVirtual, is mentioned in January 2018 Trend Micro report as one of the top participants in a series of defacements related to territorial disputes in the South China Sea.

Anderson was first charged in May. He faces a maximum sentence of 10 years for each of the two counts of computer fraud and is set to be sentenced in February 2019.

According to the DOJ announcement, the FBI, United States Army Criminal Investigation Command and the Brazilian Federal Police assisted in the investigation.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure