Read the Beforeitsnews.com story here. Advertise at Before It's News here.

By Alexander Higgins (Reporter)
Contributor profile | More stories

Story Views
Now:
Last hour:
Last 24 hours:
Total:

A-Team Hacker Group Leaks Alleged Identities Of 10 LulzSec And Anonymous Hacker Group Members

Sunday, June 26, 2011 16:00

% of readers think this story is Fact. Add your two cents.

A hacker group known as the A-Team claims to have discovered the identity of all members of the LulzSec Hacker group, releasing identifying information on 10 members of the LulzSec and Anonymous.

As I reported yesterday, the LulzSec hacker group issued one final data release titled 50 Days of Lulz, and said their 50 day hacking spree had come to and end promising to disappear into some dark corner in the internet.

Today, the “A-Team” claims to have discovered the identity of all members of the LulzSec Hacker group along with the identities of some members of the Anonymous hacker group and has posted their identities online. The data release also includes irc chat logs which allege to show the members of the groups participating in hacks or admitting to certain roles within the group along with additional attachments encrypted with PGP embedded within the file.

What remains to be revealed however, if the leaked identities are indeed correct, is if the A-TEAM is a hacker group as they claim. There remains another, and more likely possibility. The FEDS maybe in fact releasing the data in this manner, after recently arresting an alleged member of the group, based on data that was illegally sucked up and stored in the FBI and NSA vaccuum cleaner monitoring of the internet. Or perhaps, the hackers ISP’s may have be storing the internet conversations of all online users and turned it over to the Feds.

To sidestep any issues of constitutionality or lawsuits, the Feds would indeed turn over any illegally captured data in this manner because it seems highly odd that after 50 days of trying to catch LulzSec and after years of trying to catch Anonymous members the data with past IRC chat logs and attachments ousting the group is suddenly unvieled and released.

The release begins by revealing the background information on the group in relation to the time-line in the graphic below.

Timeline of The Anonymous Hacker Attacks

Specifically it begins

Identities Of Entire LulzSec Hacker Group Along With Anonymous Members Revealed

To understand who/what lulzsec/gn0sis are/is you need to understand where they came from. Everything
originates from the *chan (4chan/711chan/etc.) culture. This internet subculture is pretty much the
dregs of the internet. It’s a culture built around the anonymity of the internet. If your anonymous
no one can find you. No one can hurt you, so your invincable. The problem with this idealogy, is it’s
on the internet. The internet by definition is not anonymous. Computers have to have attribution.
If you trace something back far enough you can find its origins. So let’s give a brief event timeline
on how these groups got together:

1. Anonymous rises up from 4chan against CoS.
2. Anonymous starts DDoSing stuff.
3. Various lower level hacking groups get involved.
4. Anonymous stagnates for a while.
5. Uprisings in the world Attract Anonymous.
6. ProjectPM Looser Barrett Brown becomes mouth piece of Anon.
7. Anonymous shifts focus toward “Worldy” Affairs.
8. Aaron Barr desides he’s tired of his job and targets Anon.
9. gn0sis (Uncommon) comes out of no where and releases the Gawker data.
10. gn0sis teams up with anon hackers with all the OP crap.
11. gn0sis (nigg, eekdacat, uncommon, kayla, lauralie) and sabu (from OP Anon shit) hack HBGary.
12. This is where Topiary comes in. They all form lulzsec to be “hacktivists”.
13. Lulzsec (now a mix of gn0sis and opanon people) hack SONY and other stuff.

The problem with Lulzsec/gn0sis’s “Hacktivist” mantra is that they lack the skills to keep it going.
As such after SONY they couldn’t get into anything. So they switched their focus to just releasing
random crap that didn’t mean anything. Then they started running out of things they could hack. So
they put out requests for people to join them. That got them a few hits, and now they’ve switched
their gears again to be “ANTI-SEC”. Whether or not this was an attempt at bring other groups out of
the shadows (el8, h0no, zf0, etc), you can only speculate. But as of this writing: 6/24/2011 Sabu
and Topiary are the only two people updating the twitter and releasing shit. Kayla is MIA. The
gn0sis kids are gone in hiding somewhere.

From what we’ve seen these lulzsec/gn0sis kids aren’t really that good at hacking. They troll the internet
and search for sqlinjection vulnerabilities as well as Remote File Include/Local File Include bugs. Once
found they try to download databases or pull down usernames and passwords. Their releases have nothing
to do with their goals or their lulz. It’s purely based on whatever they find with their “google hacking”
queries and then release it.

What’s funny to us is that these kids are all “Anti-Sec” yet by releasing their hacks they are forcing these
companies to have to hire security professionals which keeps the Security Industry that they are trying to
expose and shut down, in business. I guess they will realise that later in life when they get out of skid
school.

So we’ve been tracking and infiltrating these kids since the gawker hack. We have the D0x (as they call it)
on everyone except Sabu and Kayla. First we’ll go with the kid who did the gawker hack: Uncommon.

The Release ends:

Now we know that some other people have passed some stuff (senate.gov) to lulzsec (you will be owned soon mindwar).
We think that with these kid’s exposed as long as other people stop passing lulzsec hacks that it will eventually die off.
Kayla and sabu lack the skill to do anything more then go after the low hanging fruit. Now keep in mind lulzsec will try
to claim that gn0sis isn’t part of lulzsec or that no one is lulzsec. They will also try to claim that these d0x are corrent.
If you look at these attacks demonstrated here, this is all the stuff that lulzsec hasn’t released yet and probably wont release
because as of this writing gn0sis has split from lulzsec. Which is why lulzsec is request help from outside sources. Because
Sabu and Kayla lack the skills to hack anything on their own. Sabu and Kayla are the ones responsible for HBGary (gn0sis found
the vulnerability vector though). This is evident in kayla’s dumping part of the shadow file to our spies:

(08:03:13 PM) kayla: root:$1$XvkHbOb.$hEB8k8G/YXcQadaGFCcsS0:15011:0:99999:7:::
(08:03:13 PM) kayla: jussi:$1$N0aKf9ao$.AZNp8UbP2JXDpaes64iG.:13378:0:99999:7:::
(08:03:14 PM) kayla: hoglund:$1$rfGprb5A$7hpSt9DW82ihOZEk3L3px.:15011:0:99999:7:::
(08:03:14 PM) kayla: dateach:$1$LNORLcjK$IB1elonAPmGJLdwCOQoR0/:13225:0:99999:7:::
(08:03:14 PM) kayla: pedram:$1$4oKzMX1n$IL36cXiKvnW4S8HpgmOS91:13208:0:99999:7:::
(08:03:14 PM) kayla: darawk:$1$pDY/ltrQ$sGPmCZqOU509g36CwctkD/:13217:0:99999:7:::

If any law enforcment agency would like all the raw logs of everything please feel free to email THE A-TEAM!

ALPHA MIKE FOXTROT,

THE A-TEAM

And in between it identifies the following members of the group

Uncommon
EE or EEKDACAT
Laurelai
Nigg
Madclown aka BERRI
Topiary
Avunit
Sabu
TFlow
Joepie91

Uncommon – Richard Fontaine.

How to find Uncommon:

His USER/IP: Richard Fontaine [email protected]

ks354873.kimsufi.com is the server that hosts: http://cfyp.org.uk/

http://cfyp.org.uk/ is admined by: Daniel Rhodes-Mumby (http://cfyp.org.uk/2010/07/technical-issues-21st-july-2010/)

Daniel Rhodes-Mumby and Richard Fontaine are friends from school (check their facebooks).

We do not know if Daniel Rhodes-Mumby has anything to do with hacking, but he does allow Richard to bounce from his box...

Daniel Rhodes-Mumby (https://www.facebook.com/drhodesmumby):

Cashier at BrightHouse
Studying BA (Hons) Politics at University of Salford
Lives in City of Salford
In a relationship with Alisha 'Magikarp' Barton
Knows English, German, French
From Grimsby, North East Lincolnshire, United Kingdom
Born on December 4, 1991

Richard Fontaine (Uncommon)(https://www.facebook.com/jarofdoom):

Studying Chemistry MChem at University College of Wales, Bangor
Lives in Bangor, Gwynedd
From Grimsby, North East Lincolnshire, United Kingdom

Sister's:

Charlotte Fontaine:

Bartender at Cleethopes Bowling Alley
Studied at Nottingham Trent
Lives in Grimsby, North East Lincolnshire, United Kingdom
Married to Melissa Scott - LESBOZ!!!
From Grimsby, North East Lincolnshire, United Kingdom

Natalie Fontaine:

Transport Manager at Ski France
Went to Caistor Grammar School
In a relationship

Richard Fontaine is also deaf and wears a hearing aid.

EE or EEKDACAT:

How to find EEKDACAT:

EE Uses those Busy Box Bounces that were dropped in the lulzsec/gn0sis private channel logs (which were leaked).

bounce: 89-38-2-102.tcnet.com.br (189.38.2.102) Hacked Busy Box IP (from Nigg).

We back hacked him all the way back to his Home IP in Sartoga NY.

originating ip: 74.67.45.11 cpe-74-67-45-11.nycap.res.rr.com (saratoga ny)

Now this kid actually hacks stuff.  He goes around and does his little google query hacking thing.  Fing's his SQLinjections
He then goes and downloads the databases.  This is the kid who helped Uncommon with the attack on Gawker.

Here is a big log of all the things he's hacked and is hacking.  Along with proof that he was using a stolen router (which we back hacked him from)

Laurelai:

Next we have Laurelai.  He is another transgendered non-hacker.  He is also very ugly.

Name: Laurelai Bailey AKA Wesley Bailey
Born: 15 January 1982
Location:
	Davenport, Iowa (Quad Cities Metro Area) [Current]
	Fayetteville, AR [Previous]
	Austin, TX [Previous]
Job: Tech Team Global
Phone: 563-505-6082

Computer:
	Handles: Laurelai, artixstorm
	IP: [email protected] ( Frantech VPS )
	Phone: Android
	Tablet: iPad
	OS: CentOS

Profiles:

https://www.facebook.com/laurelai.bailey

http://disqus.com/facebook-771323265/

http://www.linkedin.com/pub/laurelai-bailey/31/995/5b5

http://www.scribd.com/laurelaib/info

http://www.xfire.com/profile/wesleyraziel/

http://steamcommunity.com/id/artixstorm

https://github.com/Laurelai

http://www.janimes.com/forum/index.php?/user/35904-laurelai/

http://twitter.com/#!/ArtixStorm

http://www.stickam.com/artixstorm

http://www.myspace.com/artixstorm/

Sites:
	paralox.org ?
	oneechan.org

Notes:
	Transgendered woman name she chose means 'temptress' yet she is hideous
	Location confirmed by phone location/linkedin/facebook and also mentions quad city area on reddit
	Name confirmed by facebook
	Pics confirmed by facebook/oneechan.org
	She Leaked #hq logs before gnosis/hbgary hackers became Lulzsec

--- identification ---
About: "Laurelai" is a failed chanology troll with a vendetta against Gregg Housh and AnonOps
Legal Name: Wesley Bailey
Occupation: Systems Administrator
Aliases:
  - Laurelai Storm
  - Laurelai Bailey
  - Trinity Bailey
  - Raziel
Twitter: @stuxnetsource
Domains:
  - oneechan.org: setup as "trans support"
Irc:
  - irc.oneechan.org: #oneechan
  - botnet.biz: #tr0ll
Email Addresses:
  - [email protected]
  - [email protected]
Facebook: http://facebook.com/laurelai.bailey
AIM: lulzchan
ED: http://encyclopediadramatica.com/Raziel+wesley+bailey+chanology
Affiliations:
  - Gnosis (Hacker group responsible for Gawker hack)
  - AnonOps Oper: 18:16 [tsukihi] -OperServ([email protected])- Laurelai         -  Oper + Services Root Administrator
DOB: 1-15-82
Residence: Waterloo, Iowa
Home Internet: 173.23.30.122
Hometown: Killeen, TX
Bio: 10 year army veteran: stations in Killeen and Korea
Personal: Laurelai is a pre-operative "transsexual"
--- systems ---
- vps-node1: Laurelai:x:525:525::/home/Laurelai:/bin/bash
--- Gnosis ---
- members: kayla,garrett,Laurelai,pw,Uncommon,Eekdacat,Fubar,berry,egeste,insid,nigg,tflow
--- connections ---
- uncommon (UncommonGN on twitter) is responsible for the google dork that lead to the gawker compromise
- kayla according to laurelai is laurelai's protege
- jennifer emick and him were involved in the same troll group: http://encyclopediadramatica.com/Jennifer_Emick
- sabu: soley responsible for the attack on HBGary no matter what Kayla sells you it was all Sabu; he's 'anti-sec 4 life dood'

NIGG

Now we have NIGG.  His real name is TOM.
His real Name, Username, PC Name, and Home IP is: Tom Tom@Tom-PC 92.20.236.78

He is a minor hacker in the group.  He is the one who got all the stolen routers that everyone is useing.

madclown aka BERRI

Now we have madclown aka BERRI.  His real name is Peter.  He claims to be Trans Gendered.

His real Name, Username, PC Name, and Home IP is: Peter [email protected]

He doesn't really do anything except have gender identity issues.

originating ip: CPE-124-183-112-15.lns14.ken.bigpond.net.au (124.183.112.15)

Topiary

Now we have Topiary.  Probably the lamest one of the bunch.  He doesn't actually do anything except give interviews.
There are plenty of logs of him all over the internet being a complete idiot.  His "d0x" are all over the internet also.
He tries to deny it but there are logs of him bitching about being d0x'ed int he #hq logs that Laurelai leaked.

Name: Daniel Ackerman Sandberg
Location: Sweden

Computer:
	Handles: Atopiary, Gardenslayer, whirlpool

Profiles:

http://www.youtube.com/watch?v=0UmdcNqZmw8

Avunit

Dox:
	Name: Christopher Ellison
	Location: Colchester, Essex
	Business: avunit(.com) as Media Manager 00441473705206

Computer:

Profiles:

http://uk.linkedin.com/pub/christopher-ellison/31/611/684

	http://www.facebook.com/profile.php?id=701043505 ?

Sites:

Notes:
	Dox confirmed by #hq logs where he says the dox posted are true

Sabu

Dox:
	Name: Hector Xavier Montsegur
	Location: New York, New York
	Race: Puerto Rican ?
	E-Mail: [email protected]

Computer:
	Handles: 548U, hectic_les, leon
	IP: 199.68.198.129 (ssh-only.recklesstheory.com)

Profiles:
	http://www.facebook.com/lesmujahideen ?

Sites:
	prvt.org

Notes:
	dox confirmed by archived whois entries for prvt.org (his personal site according to #hq logs which he anonymized DNS after release)

tFlow

Dox:
	Name: Solomon Saleh
	Location: London, UK
	Job: Web Developer at Wikijob.co.uk

Computer:
	Handles: timeflow, bottle_of_rum

Profiles:

https://www.facebook.com/dormitree

http://about.me/solomon2

http://www.linkedin.com/in/solomonsaleh

http://blog.kornar.com/

Sites:

Notes:
	dox refinforced by facebook (computer science interests) and about.me (claims to be a hacker, londoner)

Joepie91

Dox:
	Name: Sven Slootweg
	Location: Wijnstraat 211 3311BV Dordrecht, Netherlands
	Phone: (+31) 06 - 26 51 99 55
	E-Mail: [email protected]
			[email protected]
			[email protected]

Computer:
	IP: @an-2A2E2EE5.adsl.wanadoo.nl

Profiles:

http://twitter.com/#!/joepie91

Sites:
	www.yunicc.ws
	www.chinacheep.com
	www.anonnews.org
	www.sven-slootweg.nl

Notes:
	Name reinforced by #hq logs (he claims his personal site) and confirmed by LulzSec Exposed logs (mentions theyre his sites)
	Name confirmed by twitter
	Phone confirmed by gmail
	Location reinforced by Lulzsec Exposed logs
	Lulzsec affiliate, friend of Ryan

Since pastebin posts are only temporary, I posted a copy of the complete LulzSec and Anonymous “dox” release here , which also includes IRC chat logs and various attachments encrypted with PGP.

Source: A-Team Hacker Group Leaks Alleged Identities Of 10 LulzSec And Anonymous Hacker Group Members ©
Copying or redistribution of this material requires that this license must remain intact with attribution to the content source.