Cybercrime , Fraud Management & Cybercrime

Middleman in Climate Email Hacks Gets 80-Month Sentence

An Israeli private eye faces nearly seven years in U.S. prison after admitting he had overseen a hacking campaign against climate change activists. Federal prosecutors said documents obtained by the hackers were leaked to the media, resulting in coverage that ExxonMobile used in federal court filings to fight off state attorney lawsuits alleging the petroleum giant misled investors about global warming.

See Also: The Healthcare CISO’s Guide to Medical IoT Security

A Manhattan federal judge on Thursday sentenced Aviram Azari to 80 months in prison after he pleaded guilty in April 2022 to conspiracy, wire fraud and identity theft - three out of the four counts in his criminal indictment. He must also forfeit $4,844,968.

Azari owned and operated an intelligence firm and earned $4.8 million from November 2014 to September 2019 by offering hacking-for-hire services. He outsourced the actual campaigns to third parties, including "a particular group of individuals based in India," the government said in its sentencing memo. Reuters in 2022 identified the Indian hacking group as BellTroX InfoTech Services. A grand jury indicted company founder Sumit Gupta in 2015 for hacking for hire.

U.S. authorities detained Azari in September 2019 while he was in John F. Kennedy International Airport with two of his children, on his way to Disneyland. He has since been held in jail.

Federal investigators have identified more than 200 targets of the hacking projects managed by Azari, although the true count "numbers in the thousands and spans the globe."

Among the targets were Peter Frumhoff, then a climate scientist at the Union of Concerned Scientists, and Kert Davies, then the director of the Climate Investigations Center. Davies told prosecutors he received more than 80 distinct spear-phishing emails disguised as messages from friends and colleagues. The campaign caused "anxiety, paranoia, depression, sleeplessness and fear," he said.

Documents stolen from climate activists were leaked to the media, resulting in articles that "appeared designed to undermine" investigations by the attorney generals of New York and Massachusetts into whether ExxonMobile misled investors about its understanding of human-caused climate change. The company incorporated those documents into court filings challenging the investigations. Prior reporting has found that ExxonMobile has privately known about global warming since 1977 despite a decadeslong campaign to undermine confidence in scientific findings.

Azari's client list remains a secret, with the exception of Wirecard, a now-defunct German payment processor.

An Exxon spokeswoman told The Wall Street Journal earlier this year that the company "has no knowledge of Azari, had no involvement in any hacking activities and has not been accused of any wrongdoing. To be clear, ExxonMobil has done nothing wrong."

Azari's defense attorneys sought a sentence of just five years, telling court officials that his pre-sentencing detention occurred under "utterly inhuman conditions."

"For nearly one year, Mr. Azari was on lockdown, confined to a mold-infested, windowless cell for 23+ hours per day without showers, hot meals, or the ability to exercise or socialize," they wrote.