KrebsOnSecurity in New ‘Most Wished’ HBO Max Collection – Krebs on Safety

A brand new documentary sequence about cybercrime airing subsequent month on HBO Max options interviews with Yours Really. The four-part sequence follows the exploits of Julius Kivimäki, a prolific Finnish hacker not too long ago convicted of leaking tens of hundreds of affected person information from a web based psychotherapy apply whereas trying to extort the clinic and its sufferers.

The documentary, “Most Wished: Teen Hacker,” explores the 27-year-old Kivimäki’s prolonged and more and more damaging profession, one which was marked by cyber assaults designed to lead to real-world bodily impacts on their targets.

By the age of 14, Kivimäki had fallen in with a gaggle of prison hackers who had been mass-compromising websites and milking them for customer payment card data. Kivimäki and his pals loved harassing and terrorizing others by “swatting” their properties — calling in faux hostage conditions or bomb threats at a goal’s handle within the hopes of triggering a heavily-armed police response to that location.

On Dec. 26, 2014, Kivimäki and fellow members of a gaggle of on-line hooligans calling themselves the Lizard Squad launched a massive distributed denial-of-service (DDoS) assault towards the Sony Ps and Microsoft Xbox Reside platforms, stopping thousands and thousands of customers from taking part in with their shiny new gaming rigs the day after Christmas. The Lizard Squad later acknowledged that the stunt was deliberate to name consideration to their new DDoS-for-hire service, which got here on-line and started selling subscriptions shortly after the assault.

Finnish investigators stated Kivimäki additionally was answerable for a 2014 bomb risk towards former Sony On-line Leisure President John Smedley that grounded an American Airlines plane. That incident was extensively reported to have began with a Twitter put up from the Lizard Squad, after Smedley talked about some upcoming journey plans on-line. However based on Smedley and Finnish investigators, the bomb risk began with a cellphone name from Kivimäki.

Julius “Zeekill” Kivimaki, in December 2014.

The creaky wheels of justice appeared to be catching up with Kivimäki in mid-2015, when a Finnish courtroom discovered him responsible of greater than 50,000 cybercrimes, together with information breaches, fee fraud, and working a world botnet of hacked computer systems. Sadly, the defendant was 17 on the time, and acquired little greater than a slap on the wrist: A two-year suspended sentence and a small high quality.

Kivimäki instantly bragged on-line in regards to the lenient sentencing, posting on Twitter that he was an “untouchable hacker god.” I wrote a column in 2015 lamenting his laughable punishment as a result of it was clear even then that this was an individual who loved watching different individuals undergo, and who appeared totally incapable of regret about any of it. It was additionally abundantly clear to everybody who investigated his crimes that he wasn’t going to give up except somebody made him cease.

In response to a few of my early reporting that talked about Kivimäki, one reader shared that that they had been coping with continuous harassment and abuse from Kivimäki for years, together with swatting incidents, undesirable deliveries and subscriptions, emails to her pals and associates, in addition to threatening phonecalls and texts in any respect hours of the night time. The reader, who spoke on situation of anonymity, shared that Kivimäki at one level confided that he had no cause in any respect for harassing her — that she was picked at random and that it was simply one thing he did for laughs.

5 years after Kivimäki’s conviction, the Vastaamo Psychotherapy Middle in Finland turned the goal of blackmail when a tormentor recognized as “ransom_man” demanded fee of 40 bitcoins (~450,000 euros on the time) in return for a promise to not publish extremely delicate remedy session notes Vastaamo had uncovered on-line.

Ransom_man, a.ok.a. Kivimäki, introduced on the darkish net that he would begin publishing 100 affected person profiles each 24 hours. When Vastaamo declined to pay, ransom_man shifted to extorting particular person sufferers. Based on Finnish police, some 22,000 victims reported extortion makes an attempt focusing on them personally, focused emails that threatened to publish their remedy notes on-line except paid a 500 euro ransom.

In October 2022, Finnish authorities charged Kivimäki with extorting Vastaamo and its sufferers. However by that point he was on the run from the regulation and dwelling it up throughout Europe, spending lavishly on fancy automobiles, residences and a hard-partying way of life.

In February 2023, Kivimäki was arrested in France after authorities there responded to a home disturbance name and located the defendant sleeping off a hangover on the sofa of a lady he’d met the night time earlier than. The French police grew suspicious when the 6′ 3″ blonde, green-eyed man introduced an ID that said he was of Romanian nationality.

A redacted copy of an ID Kivimaki gave to French authorities claiming he was from Romania.

In April 2024, Kivimäki was sentenced to more than six years in prison after being convicted of extorting Vastaamo and its sufferers.

The documentary is directed by the award-winning Finnish producer and director Sami Kieski and co-written by Joni Soila. Based on an August 6 press launch, the 4 43-minute episodes will drop weekly on Fridays all through September throughout Europe, the U.S, Latin America, Australia and South-East Asia.