Sam Wildman reports that a Wellingborough, U.K. man who has been linked to TheDarkOverlord has been sentenced to jail for three years, but for crimes that do not unequivocally appear to be the work of the blackhat hacking collective.
“Crafty Cockney,” whose real name is Nathan Wyatt, had pleaded guilty in September to 20 counts of fraud by false representation, two counts of blackmail and one count of possession of an identity document with intent to deceive (a false passport). Among the charges that he confessed to was using his dead stepfather’s credit card for months to make fraudulent purchases.
As I reported last year, on September 24, 2016, Wyatt was arrested on suspicion of Computer Misuse Act offences for allegedly attempting to broker the sale of what he claimed were pictures of Pippa Middleton that had been hacked from her iPhone. He was later released without any charges stemming from that incident, and he never publicly identified who the actual hacker was who had hacked Middleton’s iPhone. He repeatedly denied that he was the hacker.
As Wildman explains, however, once law enforcement seized Wyatt’s computer and other devices, they found evidence of other crimes, including his attempt to extort money from an unnamed law firm for the return of files he had allegedly obtained by using malware. You can read more of Wildman’s coverage on Northamptonshire Telegraph.
The Daily Mail provides some interesting additional details, including that the ransom letter to the law firm was signed “Regards, The Dark Overlords.” It is difficult to imagine the hacking group getting their name wrong, so if that was not a typo by the news outlet, then there may be some reason to wonder whether the extortion attempt really was by the TheDarkOverlord or if it was just Wyatt trying to capitalize on any fear their brand might generate. Neither Wyatt nor any spokesperson for TheDarkOverlord have ever claimed to this journalist that Wyatt was ever any kind of core member of the hacking collective.
Although Wyatt may or may not have been a core member of TDO, the judge sentencing him seems to have recognized that Wyatt is likely responsible for many more crimes than were charged. According to Richard Spillett’s report in the Daily Mail, Judge Martin Griffiths sounded somewhat skeptical that Wyatt had been held to account for everything: “A rather more sceptical mind would say there was a great deal more to this behaviour than there is in these counts.” He reportedly added: “I consider this was a sophisticated piece of offending by you.”
Wyatt has not been charged criminally in the U.S. (or at least no charges have been made public as yet), but he has been linked to hacks by TheDarkOverlord of one or more Georgia clinics.
At various times, Wyatt told this journalist about a phone call he was supposed to make to a hacking victim to pressure him to pay the ransom demanded by TheDarkOverlord. As best as this journalist could determine, that victim was Athens Orthopedic Clinic. But did Wyatt actually make the phone call or not?
At one point, he claimed to this journalist that although he was supposed to make the call and had told his contact from TheDarkOverlord that he had made it, he hadn’t made it. DataBreaches.net was never able to obtain any direct communication with the clinic owner, and therefore does not know whether he claimed to have received any corresponding call, but here is the recording of the call that Wyatt informed me was his work. It was uploaded to YouTube on July 10, 2016.
Wyatt had also linked to the recording in a post on a now-defunct AlphaBay forum.
In addition to allegedly making a call to pressure a U.S. hacking victim into paying ransom, Wyatt allegedly served other functions for TheDarkOverlord, including setting up bank accounts in the U.K. where U.S. victims would then wire ransom payments.
Somewhat amazingly, perhaps, information obtained by DataBreaches.net revealed that Wyatt may have actually opened at least one of those accounts in 2016 using his real name. He also seems to have used his live-in partner’s real name for another one of the accounts. Although she, too, had been charged criminally in some matters, his partner was later acquitted after no evidence was reportedly produced by prosecutors at trial.
It is not clear whether Wyatt might be eligible for parole at some point or if he will have to serve the entire three years in jail. Perhaps someone more familiar with the U.K. criminal justice system can address that question. And as to whether he will ever face charges over any U.S. crimes, I guess we’ll all have to just wait and see.
Correction: A previous version of this report indicated that the owner of Athens Orthopedic is named James Kayo. That was an error, and DataBreaches.net apologizes for the confusion. Kayo Elliott is the CEO of the clinic.
Now this is interesting stuff! Is there anyway to confirm that the person saying hello in the recording is actually James Kayo? Has Kayo confirmed he received this call? If so, that’s a very strong connection. Was this Wyatt guy just some sort of mule or patsy for TDO? I would assume the feds have already been all over this long ago, but you can’t assume anything with those guys.