A 21-year-old from Vancouver, Washington, has confessed to being responsible for creating and operating multiple DDoS botnets, consisting of home routers and other devices network and Internet of Things (IoT).
The culprit is named Kenneth Currin Schuchman (known online as Nexus Zeta ) and he used the botnets either to "rent" them, that is, to allow others to gain access to them (for a fee), or to carry out attacks DDoS himself .
Authorities investigated the case since 2017. However, now, with the confession of guilt, more details have come to light about how Schuchman operated.
One of the most important things that had not been discovered earlier is that Nexus Zeta was not acting alone, but with the help of two other hackers, identified in court documents as Vamp and Drake.
According to the new information, Vamp was the main developer, Drake handled botnet sales and customer communications ,while Nexus Zeta was the “second” developer. He searched for new vulnerabilitiesthat the botnet could exploit to infect victims’ devices.
The timeline of the case up to Schuchman's arrest and confession follows:
July-August 2017: The three perpetrators create the Satori, based on the public source code of the Mirai IoT malware . US authorities were investigating the case and warned that the new botnet was carrying out more sophisticated DDoS attacks, exploiting Telnet vulnerabilities. The Satori botnet managed to infect over 100,000 devices during its first month of use. Schuchman said that 32,000 of the devices belonged to a large Canadian ISP.
September-October 2017 : Nexus Zeta, Vamp, and Drake improve upon the original Satori botnet. The new version is called Okiru . This version, like the previous one, exploits vulnerabilities to spread to vulnerable devices. The Okiru botnet primarily targeted Goahead security cameras
November 2017: The three hackers create a new version of the botnet, known as Masuta. The new version mainly targets GPON routers. At this time, the hackers' work is at its peak. Schuchman creates his own botnet, which he uses to attack the infrastructure of ProxyPipe. ProxyPipe is a company that tries to combat DDoS attacks.
January 2018: Schuchman and Drake create a new botnet that borrows features from Mirai and Satori. The new botnet primarily attacks devices in Vietnam.
March 2018: The three hackers collaborate to evolve Schuchman and Drake's botnet. The new, more advanced version is called Tsunami (also known as Fbot) and infects about 30,000 devices, mostly Goahead cameras. Later, another 35,000 attacks are reported.
April 2018: Schuchman leaves the team and creates another DDoS botnet, based on the Qbot malware and exploiting GPON routers. Schuchman and Vamp enter a competition, each trying to disrupt the other's work.
July 2018: Schuchman and Vamp reconcile and begin working together again. But the FBI tracks down Schuchman and arrests him for questioning.
August 21, 2018: Schuchman is formally charged by US, but has not yet been given a prison sentence. However, he is free on bail.
August-October 2018: Schuchman violates the terms of his release and creates a new botnet with which he attacks Drake's residence.
October 2018: US authorities imprison Schuchman.
After his confession, the court decided to sentence Schuchman to ten years in prison, a fine of $250,000, and three years of supervised release.
Schuchman has Asperger's syndrome and autism. For several years, he had been visiting HackForums, a forum where hacking and other topics are discussed. It is believed that this is where he acquired his knowledge and skills.
Authorities were able to track down Schuchman because he was using his father's ID and credentials . He later used the same credentials for his suspicious activities.
