Three hackers pleaded guilty to helping take down some of the most popular websites on the Internet.
In the U.S. District Court for Alaska, Paras Jha pleaded guilty to six charges on Nov. 28 related to creating and operating the Mirai botnet. His partners, Dalton Norman and Josiah White, pleaded guilty on Nov. 28 and Nov. 29, respectively. Court documents ended up unsealed Tuesday.
Jha admitted to writing the source code for Mirai — malware that created a botnet by taking over hundreds of thousands of computers and connected devices like security cameras and DVRs — and using it commit attacks and online fraud. Norman also said he helped write the code, as well as directing click fraud and online attacks.
White told prosecutors he created Mirai’s scanner in August 2016, which scoured the web for vulnerable devices the malware could hijack. He also hosted the servers the malware operated on and hijacked a computer in France in an attempt to disguise the source of the attacks.
One of the most notorious attacks came in 2016, after the botnet — Mirai’s army of hijacked machines — set its targets on Dyn, an Internet management company based in New Hampshire. It sent a massive amount of traffic to Dyn’s servers in a Distributed Denial of Service (DDoS) attack, causing websites like Netflix, Spotify, Reddit, Twitter and Github to go down.
Prosecutors said Jha sold the botnet to other criminals online and threatened companies with similar DDoS attacks unless they paid. From September to October 2016, Jha made Mirai’s source code public on forums for cybercriminals, allowing anyone to use it.
Jha maintained the botnet, which hijacked more than 300,000 devices, while looking for new victims to attack and infect, according to court documents.
The botnet also ended up used for click fraud. The scheme netted Jha and his crew nearly 100 bitcoin, which was valued at $180,000 on Jan. 29. It’s now worth more than $1.7 million.
As part of Jha’s plea agreement, he’ll have to give up 13 bitcoin to the U.S. government, currently valued at about $226,500. White is giving up 33 bitcoin, valued at $571,000.
The three attackers each face up to five years in prison and a fine of at least $250,000.