Within the early hours of January 20, 2023, a health care provider’s person account logged onto the Hawaii Digital Dying Registration System from out of state to certify the dying of a person named Jesse Kipf. The dying certificates listed the trigger as “acute respiratory distress syndrome” resulting from COVID-19 per week earlier. And with that, Kipf was unceremoniously registered as deceased in a number of authorities databases.
On the identical day, a hacker nicknamed “FreeRadical” posted the identical dying certificates on a hacking discussion board in an try to monetize the entry they needed to the system. “Access level is medical certifier which means you can create and certify a death in this panel,” the hacker wrote.
Within the publish, the hacker included a partial screenshot of the pretend dying certificates, however in addition they made a important mistake. FreeRadical forgot to redact the purported state of beginning of the particular person within the dying certificates and left a small a part of the state authorities’s seal displaying within the nook of the screenshot.
On the opposite aspect of the nation in Colorado, Austin Larsen, a senior menace analyst at Google’s cybersecurity agency Mandiant, alongside along with his colleagues, noticed the publish on-line as a part of their routine menace intelligence gathering, which incorporates monitoring cybercrime boards. By homing in on the badly cropped screenshot of the pretend dying certificates, Larsen and his colleagues realized the discussion board publish was proof FreeRadical had hacked the U.S. state authorities of Hawaii.
Three days after discovering the hacking discussion board publish, Larsen notified Hawaii state officers that its authorities programs had been hacked.
“It is likely the actor compromised a medical certifier account,” the notification learn, based on a screenshot of Larsen’s message shared with TechCrunch in an interview earlier in September.
Larsen’s warning set in movement a federal investigation that might reveal that the physician’s person account used to file the dying certificates was compromised by none aside from Jesse Kipf himself, the one that had supposedly died. Prosecutors would later allege in a courtroom doc that Kipf faked his personal dying to keep away from paying his ex-wife round $116,000 owed to assist their daughter.
Kipf, whom prosecutors later referred to as a “serial hacker” with “ample technical knowledge towards making a living by stealing from others,” had made a collection of errors, together with utilizing his house web from Somerset, Kentucky, to immediately connect with the Hawaii dying registration system, which finally led federal brokers proper to his door.
Consequently, the U.S. Division of Justice criminally charged Kipf in late November 2023 with a collection of hacking crimes. Kipf, prosecutors alleged, had hacked laptop programs belonging to 3 U.S. states, in addition to two distributors of huge lodge chains. The Division of Justice’s press launch, in addition to the indictment revealed on the identical time, didn’t embrace most of the particulars that prosecutors had claimed Kipf had achieved. Forbes had reported just a few days earlier that Kipf allegedly hacked the Hawaii Division of Well being.
Earlier in September, Mandiant’s Larsen, together with FBI Particular Agent Andrew Satornino, and Assistant U.S. Lawyer for the Japanese District of Kentucky Kate Dieruf, sat down with TechCrunch to disclose how they discovered Kipf and introduced him to justice. The three spoke to TechCrunch forward of a chat they gave on the Mandiant cybersecurity convention, mWISE.
Kipf, based on Larsen, Satornino, and Dieruf, in addition to the courtroom paperwork of his case, was a prolific hacker with a number of identities.
Satornino mentioned Kipf was an “initial access broker,” which means a hacker who breaks into programs after which tries to promote entry to these programs to different cybercriminals. In affidavits supporting search warrants in opposition to Kipf, the FBI particular agent wrote that Kipf had dedicated bank card fraud to buy meals from meals supply companies — and was arrested for it in 2022; used pretend Social Safety numbers to use for loans; had greater than a dozen U.S. driver’s licenses on his laptop; and had hacked Marriott lodge distributors.
Kipf possible obtained the credentials he used within the Hawaii hack from an information-stealing malware that contaminated the unnamed physician’s laptop, which then ended up on a Telegram channel for hackers. Kipf used the nickname “GhostMarket09” to function a credential stealing service, Larsen mentioned.
Aside from GhostMarket09, Larsen mentioned that Mandiant recognized a number of different monikers that Kipf used on totally different hacking boards, in addition to Telegram, which included: “theelephantshow,” “yelichanter,” and “ayohulk.” Having that checklist of monikers, Larsen mentioned he manually reviewed 1000’s of messages despatched by Kipf below his numerous on-line personas, going via a database that Mandiant created by scraping the hacking boards, “semi-public chats,” and Telegram channels.
Larsen mentioned that Mandiant recognized the FreeRadical and GhostMarket09 personas as being linked to what the corporate calls UNC3944, or Scattered Spider, a prolific hacking and cybercrime group allegedly behind the MGM Resorts hack, and linked to the broader felony underworld behind a string of violent crimes generally known as “the Com.”
In line with Larsen, Kipf — as GhostMarket09 — supplied stolen credentials for the transport big UPS to an alleged member of the Com who makes use of the moniker “lopiu” or “lolitleu.” Larsen mentioned that Kipf was not a part of the Com, however a part of the cybercriminal ecosystem enabling it.
“I would say he’s a run-of-the-mill hacker. It felt like he didn’t have fear of consequences either,” mentioned Larsen. “He was adjacently involved in other parts of the criminal community, but really, where he came into play was selling credentials to enable other intrusions.”
In parallel, and unbeknownst to Mandiant, the FBI had acquired a report from the Nationwide Cyber Forensics Coaching Alliance, a nonprofit that displays the darkish net and collaborates with regulation enforcement and the non-public sector, which included a collection of nicknames used on the darkish net by a hacker situated in Kentucky.
The investigation led to Kentucky as a result of Kipf had apparently forgotten to make use of a VPN no less than as soon as when accessing the Hawaii dying registration programs, exposing his Somerset, Kentucky, house IP deal with, based on Larsen and courtroom paperwork.
Then, in Might 2023, Hawaii’s Lawyer Common’s Workplace, which was investigating the hack of its dying registry, alerted the Kentucky Lawyer Common’s workplace that somebody within the southeastern state used the login credentials of an actual physician, who had “system level entitlements to input death worksheets,” to entry the Hawaii dying registration system and file a dying certificates for a person named Jesse Kipf, based on a courtroom doc.
On July 13, 2023, U.S. federal brokers arrested Kipf at his house in Somerset and took him into custody. In a later interview with the authorities, Kipf confessed to a collection of cybercrimes, which he mentioned allowed him to not have an everyday job for 5 years.
“How did you let your IP slip?” the interviewers requested Kipf, referring to the house IP deal with Kipf used to hook up with the Hawaii system. “Just laziness…I just super didn’t care anymore,” Kipf responded, based on a partial transcript of the interview. Kipf mentioned that he “quit giving a f—.”
In truth, later within the investigation, the authorities realized that Kipf had used his identical house IP deal with to aim to “visit, and extract data from Marriott internet domains and internal servers” between February 9 and Might 22, 2023 — a complete of 1,423 instances. The objective there, based on Satornino, was to promote entry to these networks to different hackers on boards utilized by cybercriminals.
Kipf additionally mentioned within the interview that he had accessed the dying registration programs of Arizona, Connecticut, Tennessee, and Vermont, simply to see how simple it will be, the courtroom paperwork say. In Arizona’s dying registry system, Kipf efficiently filed a dying certificates the place he put the title “Crab Rangoon” — a sort of cheese-filled crisp Chinese language wonton — because the title of the deceased, based on a screenshot of the certificates seen by TechCrunch.
He did, nevertheless, have some semblance of a plan. Kipf advised interviewers that he had created a solid credit score profile with a false Social Safety quantity in an effort to use it after he faked his dying, based on courtroom paperwork.
The hacker additionally confessed to promoting the private data of hacking victims to folks in Algeria, Ukraine, and Russia, and offering entry data for a Marriott vendor system to Russians, courtroom paperwork present.
As soon as the FBI was in a position to undergo Kipf’s units, they discovered previous Google searches in his looking historical past suggesting he was looking for data on how you can keep away from paying little one assist, mentioned Satornino.
Lastly, Kipf was additionally accused of hacking into GuestTek and Milestone, two distributors who labored with Marriott motels. In these hacks, too, Kipf used his house IP deal with.
Maybe due to all of the proof Mandiant and the FBI had gathered on Kipf’s historical past of cybercrime, and his confession within the interview with the authorities, the hacker reached a plea take care of prosecutors. Kipf formally admitted to inflicting near $80,000 in damages to the federal government and company networks he hacked, and $116,000 for the unpaid little one assist for his ex-wife. He additionally admitted to id theft, for utilizing physician’s stolen credentials within the Hawaii hack to create the dying certificates.
“The Defendant is a serial hacker, stealing personal identifying information and infiltrating protected computer networks of businesses and governmental entities with abandon,” Dieruf wrote in a memorandum asking the courtroom to condemn Kipf to seven years in jail. “He caused significant damage, both monetarily and in the form of technological responses, to his corporate and governmental victims.”
Dieruf added: “By attempting to kill himself off to avoid child support obligations, [Kipf] continues to re-victimize his daughter and her mother, who are owed more than $116,000 in child support obligations.”
Within the sentencing memorandum filed by Kipf’s lawyer, Thomas Miceli, the lawyer conceded that Kipf “understands and does not deny the seriousness of his conduct.” Miceli, who didn’t reply to TechCrunch’s request for remark, wrote on the time that Kipf was identified with paranoid delusions and schizophrenic tendencies, and that his “mental health spiraled after the conclusion of his military service” in Iraq, which “increased his drug addiction.”
Kipf was sentenced to jail for 81 months, simply shy of seven years. In line with the Division of Justice press launch asserting his sentencing in August, Kipf should serve no less than 85% of his jail sentence — greater than 5 years — below federal regulation.
