Israeli police traced two phony bomb threats back to a teenager currently awaiting trial for conveying more than 2,000 similar threats to Jewish Community Centers, police stations, and other public places. The calls, according to local news outlets, originated from the prison in Israel where the 19-year-old has been staying since his March 2017 arrest.
The teenager, according to court documents filed in his April 2017 indictment, earned more than $200,000 in Bitcoin by offering his services on Alphabay. His arrest raised several questions that remain unanswered. For instance, if he sold his services on the darknet, who targeted (ordered or purchased threats) primarily Jewish Community Centers? According to the documents filled last year, the Israeli-American teenager’s computer contained a number of text files that contained the login and password to various darknet market buyer and vendor accounts. Many of the accounts he had created and controlled, the FBI explained.
The names on the text documents and folders indicated that he had phished some of the accounts from Alphabay forum members. One file was titled “ALPHABAY FORUM VENDOR ACCOUNTS SCAM TO DELETE.” The FBI wrote that many of the accounts possibly been used to create fake feedback for the services he allegedly offered. While many of the files connected the teenager to Alphabay but proved insignificant in building a case, a small number of files both incriminated the suspect and revealed that he had accomplices.
That also revealed that he had, for a short period of time, distributed drugs on Alphabay as well.
An Alphabay vendor named “DarkNet Legend” offered a service where users supplied the vendor with a school to target and the vendor would email a bomb threat to an email address owned by the school. If the school failed to respond to the email, the vendor refunded the user. Israeli law enforcement, during the raid that led to the suspect’s arrest, discovered an incriminating folder called “My Stuff 8680/TARGETS/THE ARCHIVE OF TARGETS/2017.” Folders were nested within the folder that were categorized by month, country, and the target. Each target folder contained recordings of phony bomb threats, screenshots of emails, or text files of the same nature.
In the March 2017 folder, law enforcement discovered several folders with titles locations targeted by the suspect such as “the JCC of Louisville” and “Israeli embassy.” Many of the targets matched the time and date of fake threats attributed to the teenager. In addition, some of the reviews on the Alphabay listing matched the dates of events in real life that the teenager had recorded and saved on the computer seized by Israeli authorities. The majority of the phone calls had been placed via Google Voice phone numbers, investigators learned at the beginning of the investigation. Evidence indicated that the teenager had controlled the Google Voice accounts.
Authorities also found a text file with what looked like a first draft of the Alphabay listing. Save for minor additions (such as added clauses for school districts with more than 12 schools), the two files looked identical. Investigators discovered that the suspect had allegedly hired two co-workers to help manage his bomb-threat business. The FBI is currently working to identify his accomplices who may have helped the primary suspect call in roughly 100 bomb threats (and other threats of the same nature) while in custody.
So far, Israeli law enforcement have only managed to connect the suspect to two phone calls. Both warned police of bomb threats at schools in Tel Aviv and in Kfar Saba.