A UK judge has sentenced Arion Kurtaj, a member of the Lapsus$ cybercrime and extortion ring, to an indefinite stay in a “secure hospital.” One of the main Lapsus$ threat actors is Kurtaj, an 18-year-old autistic man who was engaged in the Grand Theft Auto VI video game asset leak.
Sentenced in a Secured Hospital
As per the BBC article, a British judge sentenced Arion Kurtaj, a member of the Lapsus$ cybercrime organization, to an indefinite stay in a secure hospital. Kurtaj, an Oxford native, was a crucial member of Lapsus$ who released video snippets from Grand Theft Auto VI, the next game being developed by Rockstar Games. Kurtaj’s aptitude and motivation for cybercrime made him a “high risk” to the public, the judge declared.
He will thus continue to be in a safe hospital until medical professionals determine that he is no longer a threat. The hacker engaged in cybercrime, but the court also heard that the hacker had been aggressive while being held, resulting in several claims of injuries or property damage.
Healthcare experts had determined Kurtaj was not able to face trial due to his autism, leaving it up to the jury to determine whether or not his alleged activities were carried out with criminal intent. According to a mental health evaluation done in connection with the sentencing hearing, Kurtaj is still very motivated to “return to cyber-crime as soon as possible,” the BBC stated.
At Southwark Crown Court in London, another 17-year-old Lapsus$ member whose identity is withheld for legal reasons was found guilty during the six-week trial. The youngster, whose identity is unknown, worked with Kurtaj and other gang members to compromise IT companies NVIDIA and telecoms BT/EE. They then tried to demand a $4 million ransom, which was not paid. The kid faces an 18-month term under a Youth Rehabilitation Order that includes strict monitoring and a “ban on using VPNs online.”
Kurtaj Past cases
Kurtaj was previously caught red-handed breaking his bail terms, according to the prosecution, when his hotel room TV was discovered to have an Amazon Fire Stick attached to it, allowing him to access cloud computing services via his smartphone, keyboard, and mouse. That’s how, despite having his laptop seized, he managed to carry out the GTA 6 leak. Arion Kurtaj, who is thought to be one of the group’s leaders, was detained twice in 2022 in January and March in relation to Lapsus$ hacking operations.
Lapsu$: A teenage hacker group
Despite the fact that the Lapsus$ gang is allegedly made up of kids, it could be foolish to undervalue their skills or the danger that the group poses to an organization’s online infrastructure. The Lapsus$ cybercrime group has previously claimed responsibility for a number of high-profile hacks, including those at Okta, Uber, and the fintech behemoth Revolut. They also claimed responsibility for the attack on Microsoft’s internal Azure server, wherein the group allegedly released 37 GB of stolen source code for Microsoft products, including Bing and Cortana.
Actors engaged in data extortion, such as Lapsus$, exploit victims by stealing and retaining their private data, which they then disseminate if their demands are not fulfilled. This is in contrast to ransomware operators who encrypt sensitive files.
