By Lorena Amaro
May 30, 2020
at 14:00
Since 2013, many official websites owned by governments around the world have been hacked and defaced by a hacker who identified himself as “VandaTheGod”. In total, about 5,000 sites were hacked in 40 countries. In addition, the hacker also announced the sale of data captured by Bitcoin.
But now, seven years after the attacks began, researchers at Check Point Software Technologies claim to have located VandaTheGod in Uberlândia, Minas Gerais.
Hacktivism or just hacking?
According to information from the security company, the hacker targeted governments of countries such as Brazil, the United States, New Zealand, Argentina and several others. Thus, he acted by disfiguring pages with ideological messages, motivated by anti-government sentiments.
His aim was to “combat social injustices” resulting from government corruption. However, he also stole credit card data and leaked sensitive personal credentials.
"However, by looking closely at these attacks, we were able to map VandaTheGod's activity over the years and eventually discover the real identity of the attacker," said Check Point Software Technologies.
The hacker publicized his attacks on social networks, mainly on Twitter, where he wrote many tweets in Portuguese. On the social network, he also claimed to be part of the “Brazilian Cyber Army”.
Medical data in exchange for BTC
In addition to hacking government websites, he also targeted other institutions. In one case, VandaTheGod claimed to have access to the medical records of 1 million New Zealand patients. He offered the data in exchange for a $ 200 Bitcoin payment:
Personal goals
According to Check Point, he also targeted a target of 5,000 attacks:
“This goal was almost achieved, as there are currently 4,820 hacked website records linked to VandaTheGod.”
Hackers left clues
However, the details shared online by VandaTheGod provided information about his identity:
"The WHOIS registration for VandaTheGod.com showed that the site was registered for a person from Brazil, more specifically from Uberlândia, using the email address fathernazi@gmail.com".
With this and other information left by the hacker on social networks, the investigators managed to reach him. Check Point reported that it reported these findings to the appropriate authorities.