ISIL-Linked Kosovo Hacker Sentenced To 20 Years in Prison

The U.S. Justice Department released the below information:

WASHINGTON – Ardit Ferizi, aka Th3Dir3ctorY, 20, a citizen of Kosovo, was sentenced today to 20 years in prison for providing material support to the Islamic State of Iraq and the Levant (ISIL), a designated foreign terrorist organization, and accessing a protected computer without authorization and obtaining information in order to provide material support to ISIL.

Assistant Attorney General for National Security John P. Carlin, U.S. Attorney Dana J. Boente for the Eastern District of Virginia, Assistant Director in Charge Paul M. Abbate of the FBI’s Washington Field Office and Special Agent in Charge Charles P. Spencer of the FBI’s Jacksonville Field Office made the announcement after the defendant was sentenced by U.S. District Judge Leonie M. Brinkema.

"This case represents the first time we have seen the very real and dangerous national security cyber threat that results from the combination of terrorism and hacking,” said Assistant Attorney General Carlin. “This was a wake-up call not only to those of us in law enforcement, but also to those in private industry. This successful prosecution also sends a message to those around the world that, if you provide material support to designated foreign terrorist organizations and assist them with their deadly attack planning, you will have nowhere to hide.  As this case shows, we will reach half-way around the world if necessary to hold accountable those who engage in this type of activity. I want to thank the corporation that worked with law enforcement to solve this crime, and the agents, analysts and prosecutors who worked on this groundbreaking case."

Ferizi, who was detained by Malaysian authorities on a provisional arrest warrant on behalf of the U.S., was charged by criminal complaint on Oct. 6, 2015. The criminal complaint was unsealed on Oct. 15, 2015. Ferizi subsequently consented to extradition.

Ferizi pleaded guilty on June 15. According to court documents, Ferizi admitted that on or about June 13, 2015, he gained system administrator-level access to a server that hosted the website of a U.S. victim company. The website contained databases with personally identifiable information (PII) belonging to tens of thousands of the victim company’s customers, including members of the military and other government personnel. Ferizi subsequently culled the PII belonging to U.S. military members and other government personnel, which totaled approximately 1,300 individuals. That same day, on June 13, Ferizi provided the PII belonging to the 1,300 U.S. military members and government personnel to Junaid Hussain, a now-deceased ISIL recruiter and attack facilitator. Ferizi and Hussain discussed publishing the PII of those 1,300 victims in a hit list.

According to court documents, on Aug. 11, 2015, in the name of the Islamic State Hacking Division (ISHD), Hussain posted a tweet that contained a document with the PII of the approximately 1,300 U.S. military and other government personnel that Ferizi had taken from the victim company and provided to Hussain. The document stated, in part, that “we are in your emails and computer systems, watching and recording your every move, we have your names and addresses, we are in your emails and social media accounts, we are extracting confidential data and passing on your personal information to the soldiers of the khilafah, who soon with the permission of Allah will strike at your necks in your own lands!” Ferizi admitted that he provided the PII to ISIL with the understanding that ISIL would use the PII to “hit them hard.”

This case is being prosecuted by Special Assistant U.S. Attorney Brandon Van Grack of the Eastern District of Virginia and Trial Attorney Gregory Gonzalez of the National Security Division’s Counterterrorism Section. The Malaysian authorities and the Justice Department’s Office of International Affairs also provided significant assistance.

ISIL-Linked Hacker Pleads Guilty To Providing Material Support

The U.S. Justice Department released the below information:

Ardit Ferizi, aka Th3Dir3ctorY, 20, a citizen of Kosovo, pleaded guilty today before U.S. District Judge Leonie M. Brinkemaof the Eastern District of Virginia to providing material support to the Islamic State of Iraq and the Levant (ISIL), a designated foreign terrorist organization, and accessing a protected computer without authorization and obtaining information.

Assistant Attorney General for National Security John P. Carlin, U.S. Attorney Dana J. Boente of the Eastern District of Virginia, Assistant Director in Charge Paul M. Abbate of the FBI’s Washington Field Office and Special Agent in Charge Michelle S. Klimt of the FBI’s Jacksonville, Florida, Division made the announcement.

“Ferizi admitted to stealing the personally identifiable information of over 1,000 U.S. servicemembers and federal employees, and providing it to ISIL with the understanding that they would incite terrorist attacks against those individuals,” said Assistant Attorney General Carlin.  “The case against Ferizi is the first of its kind, representing the nexus of the terror and cyber threats.  The National Security Division will continue to use an all-tools approach to combat this ever-evolving blended threat, and we will identify, disrupt and prosecute any individual who provides material support to ISIL, no matter how they do so.”

“Ferizi endangered the lives of over 1,000 Americans,” said U.S. Attorney Boente.   “Cyber terrorism has become an increasingly prevalent and serious threat here in America, both to individuals and businesses. However, cyber terrorist are no different from other terrorists: No matter where they hide, we will track them down and seek to bring them to the United States to face justice.”

“Ardit Ferizi launched a cyberattack to gain access to the identities of U.S. military personnel, which he shared with members of ISIL in an attempt to incite terror attacks,” said Assistant Director in Charge Abbate.  “No matter how a person supports a terrorist group like ISIL, whether on the battlefield or in the cyber world, the FBI will identify, disrupt and bring them to justice for placing lives at risk.”

“This case demonstrates the importance of strong partnerships with law enforcement agencies worldwide,” said Special Agent in Charge Michelle S. Klimt.  “Cybercrime knows no boundaries and our efforts to dismantle these operations would be impossible without international collaboration.  The FBI will continue to vigorously investigate these crimes and work with our international partners to track down and arrest those who steal from our nation and citizens.”

Ferizi, who was detained by Malaysian authorities on a provisional arrest warrant on behalf of the United States, was charged by criminal complaint on Oct. 6, 2015.  The criminal complaint was unsealed on Oct. 15, 2015.  Ferizi subsequently waived extradition.

Ferizi admitted that on or about June 13, 2015, he gained administrator-level access to a server that maintained the website of a victim company located in the United States, which also contained databases with personally identifiable information (PII) belonging to tens of thousands of the victim company’s customers.  Between June and August 2015, Ferizi provided unlawfully-obtained PII to ISIL member Junaid Hussain, aka Abu Hussain al-Britani, he admitted.  According to the statement of facts, on Aug. 11, 2015, in the name of the Islamic State Hacking Division (ISHD), Hussain posted a tweet that contained a document with the PII of approximately 1,300 U.S. military and other personnel that Ferizi had taken from the victim company and provided to Hussain.  The document stated, in part, that “we are in your emails and computer systems, watching and recording your every move, we have your names and addresses, we are in your emails and social media accounts, we are extracting confidential data and passing on your personal information to the soldiers of the khilafah, who soon with the permission of Allah will strike at your necks in your own lands!”  Ferizi admitted that he provided the PII to ISIL with the understanding that ISIL would use the PII to “hit them hard.”

At sentencing on Sept. 16, 2016, Ferizi faces a maximum sentence of 20 years in prison for providing material support to ISIL and a maximum sentence of five years for accessing a protected computer without authorization and obtaining information.  The maximum statutory sentence is prescribed by Congress and is provided here for informational purposes, as the sentencing of the defendant will be determined by the court based on the advisory sentencing guidelines and other statutory factors.  As part of the plea, Ferizi also agreed to a stipulated order of removal to Kosovo, his country of citizenship, upon completion of his criminal sentence. 

The FBI’s Washington Field Office and Jacksonville Division investigated the case.  The case is being prosecuted by Special Assistant U.S. Attorney Brandon Van Grack of the Eastern District of Virginia and Trial Attorney Gregory Gonzalez of the National Security Division’s (NSD) Counterterrorism Section, with assistance from Trial Attorney Vincent A. Citro of NSD’s Counterterrorism Section and Trial Attorney Matthew Walczewski of NSD’s Counterintelligence and Export Control Section.  The Malaysian authorities and the Justice Department’s Office of International Affairs also provided significant assistance.

ISIL-Linked Hacker Arrested In Malaysia On U.S. Charges - Defendant Charged With Providing Material Support To ISIL And Computer Hacking Related To The Theft And Distribution Of U.S. Military And Federal Employee Personal Information

The U.S. Justice Department released the below information:

Malaysian authorities have detained Kosovo citizen Ardit Ferizi in Malaysia on a U.S. provisional arrest warrant alleging that he provided material support to the Islamic State of Iraq and the Levant (ISIL), a designated foreign terrorist organization, and committed computer hacking and identity theft violations in conjunction with the theft and release of personally identifiable information (PII) of U.S. service members and federal employees.  The criminal complaint was unsealed today.  The United States is seeking his extradition to the U.S. Attorney’s Office of the Eastern District of Virginia to stand trial.

The charges were announced by Assistant Attorney General for National Security John P. Carlin, U.S. Attorney Dana J. Boente of the Eastern District of Virginia and Assistant Director in Charge Paul Abbate of the FBI’s Washington, D.C.’s Field Office.

As alleged in the criminal complaint, Ferizi, also known by his hacking moniker “Th3Dir3ctorY,” is believed to be the leader of a Kosovar internet hacking group called Kosova Hacker’s Security (KHS).  Ferizi hacked into the computer system of a victim company located in the United States and stole the PII of thousands of individuals.  He then provided the PII of over 1,000 U.S. service members and federal employees to ISIL to be used against those employees.  Between June and August 2015, Ferizi provided unlawfully obtained PII to ISIL member Junaid Hussain, aka Abu Hussain al-Britani.  On Aug. 11, 2015, in the name of the Islamic State Hacking Division (ISHD), Hussain posted a tweet titled “NEW: U.S. Military AND Government HACKED by the Islamic State Hacking Division!” which contained a hyperlink to a 30-page document.  That document stated, in part, that “we are in your emails and computer systems, watching and recording your every move, we have your names and addresses, we are in your emails and social media accounts, we are extracting confidential data and passing on your personal information to the soldiers of the khilafah, who soon with the permission of Allah will strike at your necks in your own lands!”  The next 27 pages of the document contained the names, e-mail addresses, e-mail passwords, locations and phone numbers for approximately 1,351 U.S. military and other government personnel.  This posting was intended to provide ISIL supporters in the United States and elsewhere with the PII belonging to the listed government employees for the purpose of encouraging terrorist attacks against those individuals.

“As alleged, Ardit Ferizi is a terrorist hacker who provided material support to ISIL by stealing the personally identifiable information of U.S. service members and federal employees and providing it to ISIL for use against those employees,” said Assistant Attorney General Carlin.  “This case is a first of its kind and, with these charges, we seek to hold Ferizi accountable for his theft of this information and his role in ISIL’s targeting of U.S. government employees.  This arrest demonstrates our resolve to confront and disrupt ISIL’s efforts to target Americans, in whatever form and wherever they occur.”

“National security is compromised by computer intrusions, and Ferizi is charged with obtaining the personal identifying information of U.S. military and government personnel and providing it to ISIL,” said U.S. Attorney Boente.  “We will investigate and prosecute these cyber-attacks to fullest extent of the law.”

If convicted, the defendant faces up to 35 years.

The charges and allegations in the indictment are merely accusations, and the defendant is presumed innocent unless and until proven guilty.

The investigation is being conducted by the FBI.  The case is being prosecuted by Trial Attorney Gregory Gonzalez of the National Security Division’s Counterterrorism Section and Assistant U.S. Attorney Lynn Haaland of the Eastern District of Virginia.  The Assistant Attorney General, U.S. Attorney and FBI Assistant Director thanked the Malaysian authorities for their assistance in this matter.