 Lizard Squad logo | |
| Formation | August 18, 2014 |
|---|---|
| Type | Hacking |
| Membership | 7 |
Lizard Squad was ablack hat hacking group, mainly known for their claims ofdistributed denial-of-service (DDoS) attacks[1] primarily to disrupt gaming-related services.
On September 3, 2014, Lizard Squad seemingly announced that it had disbanded[2] only to return later on, claiming responsibility for a variety of attacks on prominent websites. The organization at one point participated in theDarkode hacking forums and shared hosting with them.[3][4]
On April 30, 2016,Cloudflare published a blog post detailing howcyber criminals using this group's name were issuing random threats of carrying out DDoS attacks. Despite these threats, Cloudflare claim they failed to carry through with a single attack.[5][6] As a result of this, the BritishNational Fraud Intelligence Bureau issued an alert warning businesses not to comply with ransom messages threatening DDoS attacks.[7][8]
Lizard Squad has claimed responsibility for launching a string ofDDoS attacks against high-profilegame-related services over the course of a few months in late 2014. On August 18, 2014,servers of the gameLeague of Legends were taken offline with aDDoS attack; this was claimed as Lizard Squad's first attack.[9] Days later, on August 24, thePlayStation Network was disrupted via a DDoS attack.[10] On November 23, the group claimed they attackedDestiny servers with a DDoS attack.[11] On December 1,Xbox Live was apparently attacked by Lizard Squad: users attempting to connect to use the service would be given the 80151909 error code.[12] On December 2, Lizard Squad defacedMachinima.com, replacing their front page withASCII art of their logo.[13] A week after, on December 8, Lizard Squad claimed responsibility for another PlayStation Network DDoS attack.[14][15] On December 22, though not game-related,Internet in North Korea was taken offline by a DDoS attack.[16] Lizard Squad claimed responsibility for the attack and linked to anIP address located inNorth Korea.[17] North Korean Internet services were restored on 23 December 2014.[18]
Lizard Squad had previously threatened to take down gaming services on Christmas.[19]
On December 25, 2014 (Christmas Day), Lizard Squad claimed to have performed aDDoS attack on the PlayStation Network and Xbox Live. On December 26, 2014, at 2:00 AM,[when?] Lizard Squad appeared to stop attacking PlayStation Network and Xbox Live.Gizmodo reported that the attacks may have ceased afterKim Dotcom offered Lizard Squad 3000 accounts on his upload serviceMEGA.[20]
On December 26, 2014, aSybil attack involving more than 3000 relays was attempted against theTor network.[21] Nodes with names beginning with "LizardNSA" began appearing, Lizard Squad claimed responsibility for this attack.[22]
The relevance of the attack was questioned. According to Tor relay node operatorThomas White, the consensus system made that Lizard Squad only managed to control "0.2743% of the network, equivalent to a tiny VPS".[23]
On January 26, 2015, the website ofMalaysia Airlines was attacked, apparently by Lizard Squad, calling itself a "cyber caliphate". Users were redirected to another page bearing an image of a tuxedo-wearing lizard, and reading "Hacked by Cyber Caliphate". Underneath this was text reading "follow the cyber caliphate on twitter" after which were the Twitter accounts of the owner of UMG, "@UMGRobert" and CEO of UMG, "@UMG_Chris". The page also carried the headline "404 - Plane Not Found", an apparent reference to the airline's loss of flightMH370 the previous year. Malaysia Airlines assured customers and clients that customer data had not been compromised.[24]
Media reports around the world said versions of the takeover in some regions included the wording "ISIS will prevail", which listed concerns of Lizard Squad's association with theIslamic State.[24]
On July 9, 2015, game servers operated byDaybreak Game Company, including those ofH1Z1 andPlanetSide 2, were disrupted by a DDoS attack that Lizard Squad claimed responsibility for.[25][26] The attack was performed in retaliation to legal threatsJohn Smedley, the company's CEO, had made after being targeted by the hacking group.[27]
On August 24, 2014, Lizard Squad claimed that a plane on which the president ofSony Online Entertainment,John Smedley, was flying (American Airlines Flight 362), had explosives on board.[28][29] The flight from Dallas to San Diego made an unscheduled landing in Phoenix, Arizona. Sony Online Entertainment announced that the FBI was investigating the incident.[29]
On January 26, 2015, several social media services includingFacebook andInstagram were unavailable to users.Tinder andHipChat were also affected. Lizard Squad claimed responsibility for the attacks, via a posting on aTwitter account previously used by the group.[30] The outage, originally speculated to be adistributed denial-of-service attack, lasted a little under an hour before services were restored.[31][32]
Facebook later released a statement saying its own engineers were to blame, and that the disruption to its services was not the result of a third-party attack, but instead occurred after they introduced a change that affected their configuration systems.[33]
On January 27, 2015, Lizard Squad claimed to have compromisedTaylor Swift's Twitter and Instagram accounts. Once they claimed to have access, they threatened to release nude photos in exchange forbitcoins. Taylor Swift, however, retorted that "there were no naked pics" and told the offenders to "have fun" finding any.[34]
On January 4, 2021, American lawyer and conspiracy theoristL. Lin Wood tweeted out baseless claims that a group of hackers named "the lizard squad" have evidence of a globalsex ring involving several high-profile Americans, similar to the discreditedconspiracy theoryQAnon.[35] There seems to be no relation between the "lizard squad" mentioned by Wood and theblack-hat hacking group Lizard Squad, and Vinnie Omari, a member of the Lizard Squad, denies any claim that his group may have information on a global sex-trafficking organization.[36]
Vinnie Omari is a member of the Lizard Squad who was arrested and bailed under the alleged offences of "Enter into/concerned in acquisition/retention/use or control criminal property, Fraud by false representation - Fraud Act 2006, Conspire to steal from another, unauthorized computer access with intent to commit other offences". He was used as a public face on television and as a spokesperson for the news to represent LizardSquad.[37][38]
Julius Kivimäki (zeekill) is a Finnish member of Lizard Squad convicted in July 2015 on over 50,000 counts of computer crime.[39] In 2022, he was also suspected of theVastaamo data breach, after having hacked around 50,000 psychotherapy patients' medical records and demanded ransoms for not publishing them.[40]
19-year-old Zachary Buchta (fbiarelosers) from Maryland, has been charged with computer crimes associated with a series of distributed denial-of-service (DDoS) attacks, stolen credit cards and selling DDoS-for-hire services. He was one of the members behind LizardSquad and also the Co-Group "PoodleCorp" which launched distributed denial-of-service (DDoS) attacks against multiple networks, YouTubers and gaming services. Buchta was hiding behind the Twitter alias @fbiarelosers, @xotehpoodle, and the online aliases "pein" and "lizard".[41][42][43][44]
19-year-old Bradley Jan Willem van Rooy (UchihaLS) from the Netherlands, has been charged with computer crimes associated with a series of distributed denial-of-service (DDoS) attacks, stolen credit cards and selling DDoS-for-hire services.He was one of the members behind LizardSquad who was mainly responsible for launching the DDoS-attacks announced by the group. Also he was one of the two managers behind the Twitter account @LizardLands which is the main Twitter account of LizardSquad since January 2015. He was normally hiding behind his Twitter alias @UchihaLS (which stands for Uchiha LizardSquad) and the online aliases "UchihaLS", "Uchiha" and "Dragon".[41][42][43][44]