Prosecutors in Finland this week commenced their prison trial towards Julius Kivimäki, a 26-year-old Finnish man charged with extorting a as soon as well-liked and now-bankrupt on-line psychotherapy apply and hundreds of its sufferers. In a 2,200-page report, Finnish authorities laid out how they linked the extortion spree to Kivimäki, a infamous hacker who was convicted in 2015 of perpetrating tens of hundreds of cybercrimes, together with knowledge breaches, cost fraud, working a botnet and calling in bomb threats.
In November 2022, Kivimäki was charged with making an attempt to extort cash from the Vastaamo Psychotherapy Middle. In that breach, which occurred in October 2020, a hacker utilizing the deal with “Ransom Man” threatened to publish affected person psychotherapy notes if Vastaamo didn’t pay a six-figure ransom demand.
Vastaamo refused, so Ransom Man shifted to extorting particular person sufferers — sending them focused emails threatening to publish their remedy notes until paid a 500-euro ransom. When Ransom Man discovered little success extorting sufferers straight, they uploaded to the darkish net a big compressed file containing all the stolen Vastaamo affected person information.
Safety consultants quickly found Ransom Man had mistakenly included a whole copy of their dwelling folder, the place investigators discovered many clues pointing to Kivimäki’s involvement. By that point, Kivimäki was not in Finland, however the Finnish authorities nonetheless charged Kivimäki in absentia with the Vastaamo hack. The two,200-page proof doc towards Kivimäki suggests he loved a lavish life-style whereas on the lam, frequenting luxurious resorts and renting fabulously costly automobiles and dwelling quarters.
However in February 2023, Kivimäki was arrested in France after authorities there responded to a home disturbance name and located the defendant sleeping off a hangover on the sofa of a girl he’d met the evening earlier than. The French police grew suspicious when the 6′ 3″ blonde, green-eyed man introduced an ID that said he was of Romanian nationality.
A redacted copy of an ID Kivimaki gave to French authorities claiming he was from Romania.
Finnish prosecutors confirmed that Kivimäki’s bank card had been used to pay for the digital server that hosted the stolen Vastaamo affected person notes. What’s extra, the house folder included within the Vastaamo affected person knowledge archive additionally allowed investigators to look into different cybercrime tasks of the accused, together with domains that Ransom Man had entry to in addition to a prolonged historical past of instructions he’d executed on the rented digital server.
A few of these domains allegedly administered by Kivimäki had been set as much as smear the reputations of various firms and people. A type of was a web site that claimed to have been authored by an individual who headed up IT infrastructure for a significant financial institution in Norway which mentioned the thought of legalizing youngster sexual abuse.
One other area hosted a faux weblog that besmirched the repute of a Tulsa, Okla. man whose identify was hooked up to weblog posts about supporting the “white delight” motion and calling for a pardon of the Oklahoma Metropolis bomber Timothy McVeigh.
Kivimäki seems to have sought to sully the identify of this reporter as properly. The two,200-page doc exhibits that Kivimäki owned and operated the area krebsonsecurity[.]org, which hosted numerous hacking instruments that Kivimäki allegedly used, together with applications for mass-scanning the Web for methods susceptible to identified safety flaws, in addition to scripts for cracking database server usernames and passwords, and downloading databases.
Ransom Man inadvertently included a replica of his dwelling listing within the leaked Vastaamo affected person knowledge. A prolonged historical past of the instructions run by that person present they used krebsonsecurity-dot-org to host hacking and scanning instruments.
Mikko Hyppönen, chief analysis officer at WithSecure (previously F-Safe), stated the Finnish authorities have accomplished “wonderful work,” and that “it’s uncommon to have this a lot proof for a cybercrime case.”
Petteri Järvinen is a revered IT professional and creator who has been following the trial, and he stated the prosecution’s case thus far has been sturdy.
“The Nationwide Bureau of Investigation has accomplished an excellent job and Mr Kivimäki for his half some elementary errors,” Järvinen wrote on LinkedIn. “This sends an necessary message: on-line crime doesn’t pay. Traces are left within the digital world too, even when it is vitally tedious for the police to gather them from servers all all over the world.”
Antti Kurittu is an data safety specialist and a former prison investigator. In 2013, Kurittu labored on an investigation involving Kivimäki’s use of the Zbot botnet, amongst different actions Kivimäki engaged in as a member of the hacker group Hack the Planet (HTP). Kurittu stated it stays to be seen if the prosecution could make their case, and if the protection has any solutions to all the proof introduced.
“Based mostly on the general public pretrial investigation report, it seems just like the case has numerous particulars that appear very unbelievable to be coincidental,” Kurittu informed KrebsOnSecurity. “For instance, a full copy of the Vastaamo affected person database was discovered on a server that belonged to Scanifi, an organization with no cheap enterprise that Kivimäki was affiliated with. The leaked dwelling folder contents had been additionally linked to Kivimäki and had been discovered on servers that had been beneath his management.”
The Finnish day by day yle.fi experiences that Kivimäki’s attorneys sought to have their shopper launched from confinement for the rest of his trial, noting that the defendant has already been detained for eight months.
The courtroom denied that request, saying the defendant was nonetheless a flight threat. Kivimäki’s trial is predicted to proceed till February 2024, partially to accommodate testimony from a lot of victims. Prosecutors are searching for a seven-year sentence for Kivimäki.
