Canadian arrested over hacking of Yahoo
22-YEAR-OLD ALLEGEDLY WORKED FOR RUSSIAN HACKERS
At 22, Karim Baratov was already living the high life. Despite having been expelled from high school in Ancaster, Ont., he owned luxury cars, a large home and an online business called Elite Space Corporation.
Photos on social media showed him holding a fan-shaped pile of $100 bills, skydiving, eating a $255 steak, hoisting a bottle of Grey Goose vodka and posing in front of a convertible, women in tight skirts in each arm.
But at 8:05 a.m. Tuesday, the Toronto police fugitive squad arrived to arrest Baratov and hand him to the RCMP to face extradition to the United States, where he is wanted for allegedly working for Russian agents.
On Wednesday, U.S. officials said Baratov was one of four alleged co-conspirators indicted following what officials called one of the largest data breaches in history, the hack of Yahoo which exposed 500 million user accounts.
Described by the U.S. as a citizen of Canada and Kazakhstan, Baratov had allegedly been working as a hacker for the Russian Federal Security Service, or FSB, which paid him bounties for the passwords and email accounts of individuals they were targeting.
Two FSB officers have been indicted for economic espionage and a slew of other charges for directing the massive hacking operation. A notorious Russian hacker wanted since 2012 on an Interpol notice, Alexsey Belan, has also been charged.
The operation was allegedly run by Dmitry Dokuchaev and Igor Sushchin, members of an FSB unit called the Center for Information Security, or Center 18. According to the allegations, the FSB officers used Belan to hack Yahoo.
In late 2014, he stole part of Yahoo’s User Database, which contained subscriber information for more than a half-billion accounts. He also obtained access to Yahoo’s Account Management Tool, used to log changes to user accounts.
The FSB officers then had Baratov target specific Gmail accounts they had learned about through the Yahoo hack, the indictment said. The Canadian was allegedly tasked “with obtaining unauthorized access to more than 80 accounts in exchange for commissions.”
Using a technique known as “spear phishing,” Baratov allegedly went after dozens of accounts for the FSB.
“Specifically, Baratov sought and gained unauthorized access to Google and other webmail provider accounts as requested by Dokuchaev, sometimes after Dokuchaev’s discussions with Sushchin,” the indictment said, noting he was paid a “bounty” when successful.
“I’m 22. Workaholic. Occasional drawer. Gym rat. Cars are everything. Sleep is optional. Don’t follow me, I’m boring,” reads Baratov’s profile on Instagram, where photos of his sketches, one depicting Arnold Schwarzenegger, are posted.
But while on social media Baratov could be seen flexing tattooed muscles and driving expensive sports cars, at Ancaster High School he was not the slick, body-conscious cool guy he later projected, fellow students said.
“He was an introvert, he didn’t really talk much,” said Avian Yuen, who sat next to Baratov in a computer science class in 2011-12 and watched his computer skills firsthand. “He was the nerdy kid at the back of the class with glasses.”
He said Baratov would read Russian-language news sites in class and Yuen, who was also studying Russian, would read them over his shoulder. (The Kazakhstan embassy in Ottawa said Baratov lost his Kazakh citizenship in 2011.)
Even in high school, Baratov seemed to have a lot of money.
“When I asked him how he made so much money he said he sold movies on Russian websites. After that, he looked like he didn’t want to talk about it any more.”
By his own descriptions on social media, Baratov was a chubby, weak kid. In one Instagram post two years ago, he reproduced a photo of himself wearing glasses and noting he was 240 pounds. But he described a subsequent “transformation,” one that involved daily visits to the gym.
On Facebook, Baratov wrote he was suspended from high school four years ago for “threatening to kill my ex-friend as a joke.” But he said being out of school gave him time to work on his “online projects 24/7, and really move my business to the next level.”
He paid off his mortgage and bought a BMW 7, the post said.
“By the time my suspension was done, I changed my whole life plan!”
Asked by the principal if he had learned his lesson, he told her to “f--k off,” it said.
“He’s not a bad person,” said another friend.
“I can tell you that, just a 22-year-old who has a lot of brains,” the friend said, saying he didn’t want his name published.
Whether Baratov felt things were going awry or by sheer coincidence, the day before he was arrested, his home — a classic suburban new-build, with three bedrooms and three bathrooms — went up for sale for $929,000.
The sale was halted Wednesday, the day the arrest was made public. U.S. authorities are seeking to seize some of Baratov’s assets, including a PayPal account in the name Elite Space Corporation, a black MercedesBenz and an Aston Martin.