Case involving ‘AlfabetoVirtual’ website defacements ends in guilty plea
A California man accused by federal prosecutors of defacing thousands of websites belonging to the U.S. government pleaded guilty on Tuesday to two felony counts of computer fraud, the Department of Justice announced.
The DOJ says that Billy Anderson, 41, admitted to more than 11,000 instances of hacking into and defacing websites belonging to the military and government, as well as businesses. Anderson allegedly conducted these operations under the alias “AlfabetoVirtual,” which would appear on the defaced websites.
“This case demonstrates that those who seek to commit cyber intrusions of government websites will be prosecuted to the fullest extent of the law,” said Geoffrey Berman, U.S. Attorney for the Southern District of New York, in a statement.
While the DOJ says he “took responsibility for” thousands of defacements, Anderson’s plea is for two counts in particular. In July 2015, prosecutors say he gained access to a website run by the New York City comptroller’s office and displayed the messages “#FREEPALESTINE” and “#FREEGAZA.” In October 2016, DOJ says that Anderson defaced a website belonging to Combating Terrorism Center at the U.S. Military Academy at West Point. In the West Point hack, he reportedly just displayed his pseudonym.
The DOJ says Anderson employed different methods for his defacements. In the NYC comptroller case, he reportedly exploited a bug in a plugin on the website. In the West Point case, prosecutors say Anderson bypassed access controls by using an “unauthorized administrative account” and exploiting “a known cross-site script vulnerability.”
Apart from the counts he faces in court, Anderson’s alias, AlfabetoVirtual, is mentioned in January 2018 Trend Micro report as one of the top participants in a series of defacements related to territorial disputes in the South China Sea.
Anderson was first charged in May. He faces a maximum sentence of 10 years for each of the two counts of computer fraud and is set to be sentenced in February 2019.
According to the DOJ announcement, the FBI, United States Army Criminal Investigation Command and the Brazilian Federal Police assisted in the investigation.
