Teens from LAPSUS$ Convicted for Cyberattacks on Rockstar Games, Uber, and Nvidia

A jury from United Kingdom has confirmed the involvement of Lapsus$ teenage members in the notable cyber intrusions targeting Rockstar Games, Uber, and Nvidia systems.

Found Guilty on 12 Counts

In a significant ruling, a London jury has determined that teenagers affiliated with the Lapsus$ hacking syndicate were responsible for orchestrating the notable cyber intrusions into Rockstar Games, Uber, and Nvidia systems.

According to a report from Gizmodo, the verdict emerged from proceedings at the Southwark Crown Court. At the heart of the decision, 18-year-old Arion Kurtaj was pronounced guilty on a total of 12 charges. These encompass a range of offenses including blackmail, fraud, and multiple violations of the Computer Misuse Act of the UK.

Despite being arrested multiple times over the last two years, Kurtaj persisted in executing cyberattacks on numerous companies like Nvidia. Employing tactics like social engineering and SIM-swapping, he managed to evade legal consequences.

However, in September 2022, London law enforcement apprehended Kurtaj once again. This final arrest came after he breached bail conditions, which specifically forbade his internet usage.

Hacking Big Companies

In court, it was revealed by prosecutors that Kurtaj had ingeniously used an Amazon Fire Stick within his hotel quarters. This tactic provided him with a gateway to access cloud computing services, facilitated by a recently acquired smartphone, keyboard, and mouse.

During this period, Kurtaj went on to upload gameplay videos of the yet-to-be-launched Grand Theft Auto VI. His actions were accompanied by threats directed at the game's developers, Rockstar Games.

Kurtaj managed to breach the security of both Uber and the financial firm Revolut through hacking efforts. As reported by the BBC, Kurtaj's mental fitness for trial was questioned, leading the jury to focus on establishing whether he indeed committed the actions as accused, rather than determining criminal intent.

The list of achievements by the gang encompassed notable names like Uber, Nvidia, Microsoft, Samsung, Ubisoft, Rockstar Games, among others. Additionally, the gang was suspected of orchestrating unconventional data breaches, leveraging compromised law enforcement email accounts to illicitly request data from corporations such as Apple, Meta, and Snapchat.

The Verge reported that another 17-year-old member of Lapsus$, whose identity remains protected due to age, was also found guilty by the jury. Over the past year, London law enforcement apprehended multiple other teenagers associated with Lapsus$.

Revealing the Identity of the Hackers

Engaging in a series of cyberattacks between late 2021 and early 2022, Kurtaj, who is diagnosed with autism, played an active role in the Lapsus$ gang's operations.

Despite his identity being exposed online by a rival cybercrime group, authorities refrained from public identification due to his age until this recent revelation. Psychiatrists, assessing his condition as unsuitable for trial, led to his absence in court proceedings.

Likewise, another minor with autism, whose identity remains undisclosed due to their age, was also convicted by the court as a significant member of the gang.