Arrested, seized, doxed<\/span> and detained. These are just some of the ways police and prosecutors around the world took down the biggest cyber-crime operations of the year, even if it meant resorting to new and unconventional eyebrow-raising methods. From stashing billions of bitcoin under the floorboards to teenage hackers gatecrashing Fortune 500 networks, this year saw some of the most jaw-dropping breaches \u2014 and the highest-profile apprehensions.<\/p>\n As we close out 2022, we look back at the cybercriminals we lost this year\u2026 to the law.<\/p>\n U.S. officials scored some major wins against crypto-laundering in 2022. At the beginning of the year, the Justice Department said it had seized more than $3.6 billion worth of bitcoins allegedly stolen in the 2016 hack of crypto exchange Bitfinex, and that it had arrested a married couple suspected of laundering the money<\/a>.<\/p>\n The couple \u2014 Ilya Lichtenstein, 34, and Heather Morgan, 31 \u2014 face up to 25 years in prison if convicted on charges of conspiring to launder money and defrauding the U.S. government.<\/p>\n Later in the year, the Office of Foreign Asset Control (OFAC), a watchdog within the U.S. Treasury tasked with enforcing sanctions violations, announced<\/a> that it had sanctioned decentralized cryptocurrency mixing service Tornado Cash for its role in enabling billions of dollars\u2019 worth of cryptocurrency to be laundered through its platform.<\/p>\n Tornado Cash, along with other mixers such as AlphaBay, allows customers to conceal the source of their crypto funds when participating in a transaction in exchange for a fee. It blends potentially identifiable or tainted cryptocurrency funds<\/a> with others to obfuscate the source and destination of crypto assets. More than $1.5 billion in proceeds of crime, like ransomware and fraud, has been laundered through Tornado Cash to date, experts estimate.<\/p>\n In August, the U.S government shared an image<\/a> of a suspected Conti ransomware operator known as \u201cTarget,\u201d the first time it has outed a major ransomware actor. The program also offered up to $10 million for information leading to the identification and location of Target, along with four other alleged Conti members known as \u201cTramp,\u201d \u201cDandis,\u201d \u201cProfessor\u201d and \u201cReshaev.\u201d<\/p>\n The State Department said Conti has carried out more than 1,000 ransomware operations targeting U.S. and international critical infrastructure. Most recently, the gang infiltrated 27 government institutions in Costa Rica<\/a> and demanded a $20 million ransom.<\/p>\n Image Credits:<\/strong> State Department (handout)<\/p>\n<\/div>\n Another gang dealt a devastating hit in 2022 was Netwalker, a ransomware gang that has been linked to numerous high-profile incidents including an attack on the University of California San Francisco, which paid a ransom demand of more than $1 million, and an attack targeting cyberthreat startup Cygilant<\/a>. Between August 2019 and January 2021, ransomware attacks involving NetWalker pulled $46 million in ransom payments, according to cryptocurrency analysis firm Chainalysis<\/a>.<\/p>\n In October, Sebastien Vachon-Desjardins, a 34-year-old from Quebec, was sentenced in a Florida court in October<\/a> after pleading guilty to charges related to his involvement with NetWalker. Vachon-Desjardins, who worked as an IT consultant for Public Works and Government Services in Canada, was previously arrested by Canadian police in January 2021 and sentenced to seven years in prison. During a search of his home, law enforcement officials discovered and seized 719 bitcoin and $790,000 in Canadian currency.<\/p>\n In a surprising yet anticlimactic conclusion to one of the government\u2019s longest running cyber cases, the mystery of the notorious dark web drugs marketplace Silk Road\u2019s missing billions was solved. In November, U.S. federal agents said it found $3.36 billion worth of bitcoin<\/a> that had been stashed in a popcorn can under the bathroom closet floorboards in the home of the hacker nearly a decade earlier. Prosecutors brought charges against the hacker, a Georgia resident named James Zhong, whose plea agreement with the feds saw him forfeit the huge cache of cryptocurrency, along with $600,000 in cash and other precious metals.<\/p>\n Somewhat confusingly, Zhong is the second hacker to have ultimately turned over Silk Road\u2019s stolen billions \u2014 albeit at a lower exchange rate than today. In 2020, a hacker who went by the alias Individual X forfeited another huge cache of Silk Road\u2019s bitcoin<\/a> that they had stolen years earlier during a hacking spree over 2012 and 2013. The Justice Department\u2019s latest forfeiture closed the door on another billion-dollar mystery, even if the feds kept secret how the funds were stolen or how they came to find the hacker, long after Silk Road\u2019s founder Ross Ulbricht was jailed.<\/p>\n The partial contents of the popcorn can, containing memory cards with billions of cryptocurrency and other precious metals. Image Credits:<\/strong> Justice Dept. (handout)<\/p>\n<\/div>\n U.S. officials in October charged a Ukrainian national<\/a> over his alleged role in the Raccoon Infostealer malware-as-a-service operation that infected millions of computers worldwide. Mark Sokolovsky, who goes by the online handle \u201craccoonstealer,\u201d is accused of having a major role as a key administrator of the malware, which prosecutors says was used to steal more than 50 million unique credentials and forms of identification from victims around the world since February 2019.<\/p>\n Sokolovsky is charged with computer fraud, wire fraud, money laundering and identity theft and faces up to 20 years in prison if found guilty. Sokolovsky is in Amsterdam awaiting extradition to the United States.<\/p>\n Sokolvsky\u2019s arrest led to an uptick in new Mars Stealer campaigns, including the mass-targeting of Ukraine<\/a> in the weeks following Russia\u2019s invasion, and a large-scale effort to infect victims by malicious ads. However, in November, a security research and hacking startup told TechCrunch that it had found a coding flaw<\/a> that allows it to lock out operators of the Mars Stealer malware from their own servers and release their victims.<\/p>\n Signal jammers, Wi-Fi interception tools, and WhatsApp hacking tools. These are some of the things that one Mexican businessman admitted in federal court<\/a> to selling for both commercial and personal reasons. The Justice Department accused Carlos Guerrero of, among other things, arranging the sale of hacking tools to Mexican politicians, and using other equipment he sold to intercept the phone calls of a U.S. rival. It goes to show that it\u2019s not just nation states and governments<\/a> with powerful phone spying technology at their disposal.<\/p>\n The Lapsus$ gang rose to notoriety in 2022. The data extortion group, which first emerged a year earlier, quickly claimed a number of high-profile victims, including Okta<\/a>, Microsoft<\/a>, Nvidia<\/a> and Samsung<\/a>.<\/p>\n While the gang once seemed invincible, a number of its members were arrested<\/a> in March this year. In a statement given to TechCrunch at the time, City of London Police confirmed that seven people between the ages of 16 and 21 had been arrested in connection with Lapsus$.<\/p>\n News of the arrests came just hours after a Bloomberg report<\/a> revealed a teenager based in Oxfordshire, U.K. is suspected of being the mastermind of the Lapsus$ group. Researchers investigating the gang\u2019s recent hacks said they believed the 16-year-old, who uses the online moniker \u201cWhite\u201d or \u201cBreachbase,\u201d was a leading figure in Lapsus$, and Bloomberg was able to track down the suspected hacker after his personal information was published online by rival hackers. Weeks later, U.K. police said they had charged two of the teenagers with multiple cyber offenses.<\/p>\n U.S. officials in June announced<\/a> the takedown of SSNDOB, a notorious marketplace used for trading the personal information \u2014 including Social Security numbers, or SSNs \u2014 of millions of Americans.<\/p>\n The landmark operation was carried out by the FBI, IRS and the DOJ, with help from the Cyprus Police, and saw authorities seize four domains hosting the SSNDOB marketplace.<\/p>\n SSNDOB listed the personal information for approximately 24 million individuals in the United States, including names, dates of birth, SSNs and credit card numbers and generated more than $19 million in revenue, according to prosecutors<\/a>. Chainalysis reported separately<\/a> that the marketplace has received nearly $22 million worth of bitcoin across over 100,000 transactions since April 2015, though the marketplace is believed to have been active for several years prior<\/a> to its eventual seizure.<\/p>\n The FBI\u2019s seizure notice on SSNDOB, shortly after the site was taken down by federal authorities. Image Credits:<\/strong> TechCrunch (screenshot)<\/p>\n<\/div>\n Also in June, Paige Thompson, a former engineer in Amazon\u2019s cloud division, was convicted of a breach<\/a> that compromised the personal and financial information of 100 million CapitalOne customers in 2019. The breach was one of the biggest bank heists<\/a> in U.S. history, which included the theft of credit scores, limits and balances, and also affected a million Canadians. Thompson was accused of using her knowledge as an Amazon software engineer to breach CapitalOne\u2019s online cloud storage, hosted on Amazon\u2019s servers, and compromising the cloud storage of several other companies<\/a>, including Vodafone, Ford, and Ohio\u2019s state motor vehicle agency. Prosecutors said the former Amazon engineer was \u201cone bad day away from sharing the data she stole.\u201d As such, Thompson was sentenced to time served, allowing her to avoid prison.<\/p>\n With a $10 million bounty<\/a> on their heads after a brazen ransomware attack on Kaseya<\/a> that spread to hundreds of its downstream customers, it was only a matter of time before the REvil ransomware group\u2019s luck would run out. That\u2019s what happened with Yaroslav Vasinskyi, a 22-year-old Ukrainian national, who was arrested in Poland in October<\/a> and later arraigned and extradited to Dallas, Texas to face accusations of computer hacking and fraud by way of his alleged involvement with REvil. Vasinskyi is one of two other alleged REvil members charged by U.S. prosecutors in relation to the attack on Kaseya. It was only after the FBI recovered the decryption key that victims were able to gain access back to their encrypted files.<\/p>\n In September, police in London confirmed that a 17-year-old teenager suspected of involvement in high-profile breaches at ride-hailing giant Uber<\/a> and Rockstar Games<\/a> had been charged with multiple counts of computer misuse and breaches of bail.<\/p>\n These hacks were two of the most high-profile of 2022. Uber, which said it believed a hacker affiliated with Lapsus$ was responsible for the attack, was forced to take several of its internal tools offline<\/a> while it expelled the hacker from its network. Shortly before Uber\u2019s Slack system was taken offline, Uber employees received a message that read, \u201cI announce I am a hacker and Uber has suffered a data breach.\u201d The hacker also reportedly said that Uber drivers should receive higher pay.<\/p>\n In the case of Rockstar Games, the attacker \u2014 who also goes by the alias \u201cTeaPot\u201d \u2014 claimed to have gained access to Rockstar Games\u2019 internal messages on Slack and early code for an unannounced Grand Theft Auto sequel by gaining access to an employee\u2019s login credentials.<\/p>\n<\/p><\/div>\nSanctions and seizures hit the crypto scene<\/h2>\n
U.S. doxes alleged Conti ransomware member<\/h2>\n
James Zhong, the hacker who stole billions of Silk Road\u2019s bitcoin<\/h2>\n
![\"\"](\"https:\/\/techcrunch.com\/wp-content\/uploads\/2022\/12\/zhong-bitcoin-doj-2.jpeg?w=680\")
<\/p>\nRaccoon Stealer operator charged over mass password theft<\/h2>\n
\u200b\u200bSeller of WhatsApp-hacking tech pleads guilty<\/h2>\n
Lapsus$ rounded up once, twice<\/h2>\n
SSNDOB, a marketplace for stolen Social Security numbers, is no more<\/h2>\n
![\"\"](\"https:\/\/techcrunch.com\/wp-content\/uploads\/2022\/12\/ssndob-seized-domains.jpg\")
<\/p>\nEx-Amazon engineer convicted of Capital One data heist<\/h2>\n
A major REvil operator was extradited to the United States<\/h2>\n
U.K. arrest teenagers linked to Uber and GTA hacks<\/h2>\n