The two defendants in the sextortion trial are turning the tables on each other

They were the best friends in the world. Here they are side by side in front of the correctional court, or rather face to face. Prosecuted for extortion by falsely consulting pornographic websites, Augustin I. and Jordan R. are now playing their score solo. The two 25-year-old men, who had met in online gaming, had nevertheless become inseparable over the years, going on vacation to Europe together before settling for three months in Odessa, Ukraine. A city from where they launched, they explain, their massive campaigns of crypto-porn scams that targeted French Internet users in the first half of 2019.

But this friendship did not survive the legal proceedings that targeted them. “While in police custody, I put everything on my back, there was no point in sending two people to prison,” Augustin, a tall, slender man with a machine gun speed, explains to the court. Then he decided to murder the person I was, I thought it was low. I thought he was my friend. I decided to set the record straight.”In other words, for the designer of the Varenyky malware, a malicious software that made it possible to constitute a botnet of infected machines to launch extortion messages en masse, to restore a balance on everyone’s responsibilities.

Show in custody

Thus, if Augustin had swaggered in police custody, it was only to make a show, even if he had to invent a criminal record that he did not have. A grandiloquence that contrasted with Jordan’s low profile. The latter had explained during the judicial investigation that he had only received a small fraction of the loot – estimated by the two defendants at the equivalent of about 150,000 euros – and only gave advice on the management of the botnet servers. Before then, mockingly, to point out to the investigating judge that Augustin must have been very happy to be in prison, fed and housed.

“This is wrong”

Result: during the first two days of the trial, the defendants regularly contradicted each other. “Who is Viktoriia?”, a young woman involved in the laundering of extorted bitcoins, asks the president of the court, Florence Lasserre-Jeannin. “I didn’t know her,” Jordan replies. “And you, Augustine?”, asks the magistrate. “Of course I knew her, she was his girlfriend”” he replies immediately. “That’s not true,” Jordan immediately retorts, “it was Timur’s girlfriend, who exchanged euros for bitcoins for me.”Augustine will admit the next day was mistaken. “We have the impression that you want to push it in at all costs”” scolds Guillaume Halbique, Jordan’s lawyer.

But despite these regular exchanges of arms between the two defendants, the division of tasks seems quite clear. Thus giving instructive indications on the daily life of a small SME in cybercrime. After first considering making money with “advertising” – understand the massive sending of spam – the two young men explain that they embarked on the crypto-porn scam at the dawn of their twenties. An operation almost ready in September 2018, the date on which Augustin joins Jordan in Odessa. As for their target, the French Internet users, it would be purely opportunistic: the two defendants have found a trick to deceive the Orange anti-spam filter – Jordan had however signaled during the investigation his fear of American justice.

A feature he didn’t approve of

Anyway, it was Augustin who had previously taken care of developing the Varenyky malware. A malicious software inspired by TinyNuke, his previous creation, but redacted copied parts of code that he did not master and which were at the origin of bugs. But then, he tells the magistrates, he did not touch the management of the botnet servers. Nor chose the keywords for the remote activation feature of the malware’s webcam, launched for a few days before being stopped, a project that he did not approve of. Finally, Augustin assures that he only had access to one crypto wallet, which was not the account receiving the collected ransoms.

It’s Jordan’s turn to give his version. And not surprisingly, he takes up his old friend on several points. No, they both had access to the botnet servers. “At first, Augustin tried, but he wasn’t very good, he knows less about waiters than I do,” he tells the magistrates, for example. This malicious tool cost them, he estimates, never more than 1000 dollars a month. A sum to compare to the addition of the transactions observed on the crypto addresses linked to the scam made by the investigators, or about 1.3 million euros.

As for the webcam activation feature, it was “a common idea”. ”We had been thinking about how we could make more money, for example by trapping pedophiles,” Jordan details. “The keywords have nothing to do with pedophilia,” the magistrate is surprised. “People who watch this kind of content type ‘teenage girls’ or ‘young people’, they will not type on their keyboard directly the word pedophile”” retorts Jordan. An assertion undermined a little later by the display of the list of keywords coded in the malware: the word young does appear there, but among about thirty other words with sexual connotations and pornographic sites.