Within the early hours of January 20, 2023, a physician’s person account logged onto the Hawaii Digital Demise Registration System from out of state to certify the loss of life of a person named Jesse Kipf. The loss of life certificates listed the trigger as “acute respiratory distress syndrome” resulting from COVID-19 per week earlier. And with that, Kipf was unceremoniously registered as deceased in a number of authorities databases.
On the identical day, a hacker nicknamed “FreeRadical” posted the identical loss of life certificates on a hacking discussion board in an try and monetize the entry they needed to the system. “Access level is medical certifier which means you can create and certify a death in this panel,” the hacker wrote.
Within the submit, the hacker included a partial screenshot of the faux loss of life certificates, however additionally they made a vital mistake. FreeRadical forgot to redact the purported state of start of the particular person within the loss of life certificates and left a small a part of the state authorities’s seal exhibiting within the nook of the screenshot.
On the opposite aspect of the nation in Colorado, Austin Larsen, a senior risk analyst at Google’s cybersecurity agency Mandiant, alongside along with his colleagues, noticed the submit on-line as a part of their routine risk intelligence gathering, which incorporates monitoring cybercrime boards. By homing in on the badly cropped screenshot of the faux loss of life certificates, Larsen and his colleagues realized the discussion board submit was proof FreeRadical had hacked the U.S. state authorities of Hawaii.
Three days after discovering the hacking discussion board submit, Larsen notified Hawaii state officers that its authorities programs had been hacked.
“It is likely the actor compromised a medical certifier account,” the notification learn, in line with a screenshot of Larsen’s message shared with TechCrunch in an interview earlier in September.
Larsen’s warning set in movement a federal investigation that will reveal that the physician’s person account used to file the loss of life certificates was compromised by none apart from Jesse Kipf himself, the one that had supposedly died. Prosecutors would later allege in a courtroom doc that Kipf faked his personal loss of life to keep away from paying his ex-wife round $116,000 owed to assist their daughter.
Kipf, whom prosecutors later referred to as a “serial hacker” with “ample technical knowledge towards making a living by stealing from others,” had made a collection of errors, together with utilizing his residence web from Somerset, Kentucky, to immediately connect with the Hawaii loss of life registration system, which finally led federal brokers proper to his door.
Consequently, the U.S. Division of Justice criminally charged Kipf in late November 2023 with a collection of hacking crimes. Kipf, prosecutors alleged, had hacked pc programs belonging to 3 U.S. states, in addition to two distributors of huge lodge chains. The Division of Justice’s press launch, in addition to the indictment revealed on the identical time, didn’t embrace most of the particulars that prosecutors had claimed Kipf had accomplished. Forbes had reported a number of days earlier that Kipf allegedly hacked the Hawaii Division of Well being.
Earlier in September, Mandiant’s Larsen, together with FBI Particular Agent Andrew Satornino, and Assistant U.S. Legal professional for the Jap District of Kentucky Kate Dieruf, sat down with TechCrunch to disclose how they discovered Kipf and introduced him to justice. The three spoke to TechCrunch forward of a chat they gave on the Mandiant cybersecurity convention, mWISE.
Kipf, in line with Larsen, Satornino, and Dieruf, in addition to the courtroom paperwork of his case, was a prolific hacker with a number of identities.
Satornino mentioned Kipf was an “initial access broker,” which means a hacker who breaks into programs after which tries to promote entry to these programs to different cybercriminals. In affidavits supporting search warrants towards Kipf, the FBI particular agent wrote that Kipf had dedicated bank card fraud to buy meals from meals supply providers — and was arrested for it in 2022; used faux Social Safety numbers to use for loans; had greater than a dozen U.S. driver’s licenses on his pc; and had hacked Marriott lodge distributors.
Kipf probably acquired the credentials he used within the Hawaii hack from an information-stealing malware that contaminated the unnamed physician’s pc, which then ended up on a Telegram channel for hackers. Kipf used the nickname “GhostMarket09” to function a credential stealing service, Larsen mentioned.
Other than GhostMarket09, Larsen mentioned that Mandiant recognized a number of different monikers that Kipf used on completely different hacking boards, in addition to Telegram, which included: “theelephantshow,” “yelichanter,” and “ayohulk.” Having that record of monikers, Larsen mentioned he manually reviewed hundreds of messages despatched by Kipf below his numerous on-line personas, going by a database that Mandiant created by scraping the hacking boards, “semi-public chats,” and Telegram channels.
Larsen mentioned that Mandiant recognized the FreeRadical and GhostMarket09 personas as being related to what the corporate calls UNC3944, or Scattered Spider, a prolific hacking and cybercrime group allegedly behind the MGM Resorts hack, and linked to the broader felony underworld behind a string of violent crimes often known as “the Com.”
In accordance with Larsen, Kipf — as GhostMarket09 — supplied stolen credentials for the delivery big UPS to an alleged member of the Com who makes use of the moniker “lopiu” or “lolitleu.” Larsen mentioned that Kipf was not a part of the Com, however a part of the cybercriminal ecosystem enabling it.
“I would say he’s a run-of-the-mill hacker. It felt like he didn’t have fear of consequences either,” mentioned Larsen. “He was adjacently involved in other parts of the criminal community, but really, where he came into play was selling credentials to enable other intrusions.”
In parallel, and unbeknownst to Mandiant, the FBI had acquired a report from the Nationwide Cyber Forensics Coaching Alliance, a nonprofit that displays the darkish net and collaborates with legislation enforcement and the non-public sector, which included a collection of nicknames used on the darkish net by a hacker positioned in Kentucky.
The investigation led to Kentucky as a result of Kipf had apparently forgotten to make use of a VPN a minimum of as soon as when accessing the Hawaii loss of life registration programs, exposing his Somerset, Kentucky, residence IP tackle, in line with Larsen and courtroom paperwork.
Then, in Could 2023, Hawaii’s Legal professional Common’s Workplace, which was investigating the hack of its loss of life registry, alerted the Kentucky Legal professional Common’s workplace that somebody within the southeastern state used the login credentials of an actual physician, who had “system level entitlements to input death worksheets,” to entry the Hawaii loss of life registration system and file a loss of life certificates for a person named Jesse Kipf, in line with a courtroom doc.
On July 13, 2023, U.S. federal brokers arrested Kipf at his residence in Somerset and took him into custody. In a later interview with the authorities, Kipf confessed to a collection of cybercrimes, which he mentioned allowed him to not have an everyday job for 5 years.
“How did you let your IP slip?” the interviewers requested Kipf, referring to the house IP tackle Kipf used to hook up with the Hawaii system. “Just laziness…I just super didn’t care anymore,” Kipf responded, in line with a partial transcript of the interview. Kipf mentioned that he “quit giving a f—.”
In actual fact, later within the investigation, the authorities discovered that Kipf had used his identical residence IP tackle to try to “visit, and extract data from Marriott internet domains and internal servers” between February 9 and Could 22, 2023 — a complete of 1,423 occasions. The aim there, in line with Satornino, was to promote entry to these networks to different hackers on boards utilized by cybercriminals.
Kipf additionally mentioned within the interview that he had accessed the loss of life registration programs of Arizona, Connecticut, Tennessee, and Vermont, simply to see how straightforward it might be, the courtroom paperwork say. In Arizona’s loss of life registry system, Kipf efficiently filed a loss of life certificates the place he put the title “Crab Rangoon” — a sort of cheese-filled crisp Chinese language wonton — because the title of the deceased, in line with a screenshot of the certificates seen by TechCrunch.
He did, nonetheless, have some semblance of a plan. Kipf informed interviewers that he had created a solid credit score profile with a false Social Safety quantity as a way to use it after he faked his loss of life, in line with courtroom paperwork.
The hacker additionally confessed to promoting the non-public info of hacking victims to individuals in Algeria, Ukraine, and Russia, and offering entry info for a Marriott vendor system to Russians, courtroom paperwork present.
As soon as the FBI was in a position to undergo Kipf’s gadgets, they discovered previous Google searches in his searching historical past suggesting he was looking for info on easy methods to keep away from paying baby assist, mentioned Satornino.
Lastly, Kipf was additionally accused of hacking into GuestTek and Milestone, two distributors who labored with Marriott resorts. In these hacks, too, Kipf used his residence IP tackle.
Maybe due to all of the proof Mandiant and the FBI had gathered on Kipf’s historical past of cybercrime, and his confession within the interview with the authorities, the hacker reached a plea take care of prosecutors. Kipf formally admitted to inflicting near $80,000 in damages to the federal government and company networks he hacked, and $116,000 for the unpaid baby assist for his ex-wife. He additionally admitted to identification theft, for utilizing physician’s stolen credentials within the Hawaii hack to create the loss of life certificates.
“The Defendant is a serial hacker, stealing personal identifying information and infiltrating protected computer networks of businesses and governmental entities with abandon,” Dieruf wrote in a memorandum asking the courtroom to condemn Kipf to seven years in jail. “He caused significant damage, both monetarily and in the form of technological responses, to his corporate and governmental victims.”
Dieruf added: “By attempting to kill himself off to avoid child support obligations, [Kipf] continues to re-victimize his daughter and her mother, who are owed more than $116,000 in child support obligations.”
Within the sentencing memorandum filed by Kipf’s lawyer, Thomas Miceli, the legal professional conceded that Kipf “understands and does not deny the seriousness of his conduct.” Miceli, who didn’t reply to TechCrunch’s request for remark, wrote on the time that Kipf was recognized with paranoid delusions and schizophrenic tendencies, and that his “mental health spiraled after the conclusion of his military service” in Iraq, which “increased his drug addiction.”
Kipf was sentenced to jail for 81 months, simply shy of seven years. In accordance with the Division of Justice press launch saying his sentencing in August, Kipf should serve a minimum of 85% of his jail sentence — greater than 5 years — below federal legislation.
