Julius “Zeekill” Kivimäki, a 25-year-old Finn notorious for his countless cybercrimes, was arrested this week in France after being on the run since October 2022. He had been charged with extorting money from Vastaamo Psychotherapy Center and publishing session notes for over 22,000 patients online. The Finnish judiciary issued an international search warrant when he failed to appear at a scheduled hearing.
In late October 2022, Kivimäki was charged (and “arrested in absentia,” according to the Finns) with attempting to extort money from the Vastaamo Psychotherapy Center. In that breach, which occurred in October 2020, a hacker using the handle “Ransom Man” threatened to publish patients’ psychotherapy notes if Vastaamo did not pay a six-figure ransom demand.
When Vastaamo refused to meet the Ransom Man's demands, he resorted to targeting individual patients and demanding a ransom of 500 euros in exchange for not publishing their treatment notes
See also: Royal Ransomware: Linux version targets VMware ESXi servers
When Ransom Man didn't succeed much with his blackmail, he uploaded a large compressed file containing all of Vastaamo's stolen patient records to the dark web.
But as documented by KrebsOnSecurity in November 2022, security experts soon discovered that Ransom Man had accidentally included an entire copy of their home folder, where researchers found numerous clues indicating Kivimäki's involvement.
On February 3, Kivimäki was arrested by Courbevoie police when they responded to a report of domestic violence. The fight began after the couple had returned home from a nightclub earlier in the morning. Reports indicate that an argument broke out between the two while they were at the girl's residence, leading to Kivimäki's arrest shortly before 7 a.m., according to French news outlet actu.fr.
When the police arrived, another woman – likely a roommate – opened the door to find a tall, blond man with green eyes sleeping after an apparently long night. After being woken up and asked for identification, he handed them his ID, which showed he was a Romanian citizen.
French police, who were wary of the man's identity, consulted the most wanted criminals' files and quickly identified him as Kivimäki. In response, they arrested him without hesitation.
Kivimäki rose to fame after claiming to be a member of Lizard Squad, a hacker collective known for low-level DDoS attacks. However, both American and Finnish investigators have said that Kivimäki's involvement in cybercrime was extensive since 2008, when he was introduced to one of the founders of HTP.
Finnish officials said the criminal called himself “Ryan,” “RyanC,” and even went so far as to use the name of Ryan Cleary, a member of the rival hacker organization LulzSec who had been imprisoned for codebreaking.
See also: Italy faces a large-scale cyberattack
Multiple law enforcement sources confirmed to KrebsOnSecurity that Kivimäki was behind a bomb threat against former Sony Online Entertainment president John Smedley in August 2014, which resulted in the grounding of an American Airlines. While it was initially thought to be due to a Lizard Squad tweet, according to both Smedley and other accounts, it appears that the phone call came from Kivimäki himself.
Kivimäki also participated in various criminal activities, such as making fraudulent bomb threats in order to provoke a highly armed law enforcement response.
Kivimäki's blatant disregard for covering his tracks piqued the curiosity of Finnish and American cybercrime investigators, leading Finnish prosecutors in 2015 to charge him with various cybercrime offenses.
See also: Iranian hacking group Holy Souls (NEPTUNIUM) is responsible for Charlie Hebdo hack
Kivimäki was ultimately found guilty of organizing more than 50,000 cybercrimes. However, due to his age at the time (17 years old), he was given a two-year suspended sentence and had to pay fines of 6,558 euros.
Information source: krebsonsecurity.com
