MLT (hacktivist)

MLT, real name Matt Telfer,^[1] (born 1994) is a former black hat computer hacker and member of TeaMp0isoN. MLT was arrested in May 2012 in relation to his activities within TeaMp0isoN, a computer-hacking group which claimed responsibility for many high-profile attacks, including website defacements of the United Nations, Facebook, NATO, BlackBerry, T-Mobile USA and several other large sites in addition to high-profile denial-of-service attacks and leaks of confidential data.^[2][3]

Believed to be the co-leader and spokesperson of TeaMp0isoN^[4], MLT, along with Junaid Hussain and other hackers targeted many large websites and corporations over a two year period, from 2010 up until 2012 when both individuals were arrested. The group first gained popularity after targeting infamous hacking collective LulzSec, releasing personal information on their members and purporting to have hacked their websites, they then went on to target sites such as NATO, and various government officials from the United Kingdom and United States of America ^[5]. The arrests finally came as a result of the probe into the alleged hacking and wiretapping of the British Security Services Anti-Terrorism Hotline^[6].

MLT was suspected of having direct ties to the global hacking collective, Anonymous^[7], and states that he started his hacking career from an early age of around 12 or 13.^[8]. The popular computer vigilante known as The Jester has accused MLT of having ties to Crackas With Attitude^[9], a blackhat group that leaked several government documents pertaining to the CIA and FBI^[10]. MLT was also suspected of having ties to the blackhat hacking group known as Lizard Squad, as suggested by cybersecurity intelligence firm IntelCrawler LLC in a threat intelligence report that was released^[11]. These claims were also supported by The Jester^[12]

MLT was the former hacking partner^[13] of Junaid Hussain, who later went on to join ISIS and was killed in a drone strike^[14] by the US Government after becoming the third highest target on their 'kill list' due to his role in inspiring international lone-wolf terrorism alongside his hacking activities for ISIS under the banner of Islamic State Hacking Division. It was reported by Vice that Junaid Hussain remained in contact with MLT while in Syria, and that he used to occasionally ask for advice relating to hacking or would sometimes even openly boast about his activities within ISIS to MLT.^[15]

On Wednesday 9 May 2012, MLT was arrested in Newcastle upon Tyne by the Metropolitan Police who released a statement saying: "The suspect, who is believed to use the online 'nic' 'MLT', is allegedly a member of and spokesperson for TeaMp0isoN ('TeamPoison')--a group which has claimed responsibility for more than 1,400 offences including denial of service and network intrusions where personal and private information has been illegally extracted from victims in the U.K. and around the world,"^[16]

It was reported that MLT could have faced up to 10 years in prison for the events leading to his arrest.^[17] Junaid Hussain who was also arrested in relation to the same offences received a 6 month sentence under the Computer Misuse Act and the Malicious Communications Act after pleading guilty to hacking the email account of Tony Blair, the former British Prime Minister.^[18]

After his arrest, MLT has focused his attention on legitimate security research as opposed to illegal hacking activity. He has identified and reported critical vulnerabilities in sites such as eBay^[19] and the U.S. Department of Defense^[20] and states that he avoids illegal activities and instead dedicates his time to participating in Bug Bounty Programs.^[21] However, there is evidence that he is continuing black hat activities, including scamming, and phishing attacks.

In May 2015, someone purporting to be MLT featured on CNN, speaking to them about Junaid Hussain and claiming that he witnessed him appear on video chat once as a 'black power ranger' while wielding an AK-47.^[22] In August 2015, MLT featured on Episode 5 of the TV show Viceland Cyberwar where he spoke about subjects ranging from the security of autonomous cars to the death of his former hacking partner.^[23][24]

In 2017, MLT appears to have shifted his focus to exploit development, publishing several zero-day vulnerabilities online under the banner of a group known as Project Insecurity^[25].

In 2017, MLT founded a computer security research organization and education platform known as Project Insecurity. According to the website, the organization has around 20 active members and offers a variety of services including private mentoring sessions, penetration tests, custom application development, and security awareness training designed to allow corporations to employ good security habits and how to spot scams or phishing attacks. MLT works alongside reformed blackhat hackers within this group, with many of the members having previously been convicted under the Computer Misuse Act. MLT's stance on this is that those who have hacked maliciously have a deeper understanding of such concepts, and that their talent should not be put to waste.^[26]

When the organization originally surfaced, an assortment of security exploits were publicly disclosed; primarily exposing flaws in Content Management Systems and Forum Board Software. Some examples of these include XenForo, MyBB, phpBB, X-Cart, OsCommerce, concrete5, and Invision Power Board^[27]. Project Insecurity also released the exploit code for Hangzhou XiaongMai Technologies CCTV Cameras^[28], demonstrating how it was possible for hackers to take control of over two million vulnerable devices and use them as part of a Botnet. These devices were believed to have been used to partially power the Mirai Botnet, resulting in what was (at the time) the most powerful Denial of Service attack in the history of the internet.^[29]

In late 2017, Corben Leo of Project Insecurity published several exploits affecting the Pulse Connect Secure VPN client developed by Juniper Networks, this client is primarily used within intranet environments, but many sites used this and were affected, notably Twitter.^[30] Around this same time period, Project Insecurity released several exploits affecting popular plugins for WordPress and Joomla.

In April 2018, Project Insecurity released two exploits affecting live chat systems used by various Internet Service Providers and Financial corporations around the world. Nuance Communications and LiveChat were the affected software vendors, both of which appeared to be vulnerable to bugs of a similar nature. These bugs allowed a malicious hacker to glean information on employees relating to the affected companies, such as the name, email, and employee ID of the chat agent, alongside other information such as the backend systems in use, allowing a malicious hacker to potentially gain a foothold within these networks. Some of the affected companies included Google, PayPal, Bank of America, Verizon, Sony, Tesla, Orange, Kaspersky, BitDefender, AT&T, and many other large corporations^[31] . One of the founders of this exploit was Kane Gamble, who was convicted and given a two-year prison sentence shortly after these exploits were disclosed. Kane's sentencing was unrelated to any activities involving Project Insecurity and was instead due to his involvement with Crackas With Attitude, a group responsible for purportedly hacking the CIA, FBI and Department of Homeland Security^[32]. Prior to his sentencing, Kane Gamble had been attempting to show that he had reformed his character, not only working alongside Project Insecurity to help secure the above affected systems, but also by reporting vulnerabilities to companies such as T-Mobile USA of his own accord^[33].

In May 2018, Project Insecurity member Six gained access to an administrative portal for EE, the largest telecommunications provider in the UK. This allowed him to view more than two million lines of their source code, including private developer API keys and Amazon Web Services secret keys.^[34]