Illinois man's hacking conspiracy tied to 2016 Franklin Regional cyberattack

An Illinois man was sent to in prison last week for his role in providing access to illegal “booter” services, including one said to have been used in a 2016 hacking attack on the Franklin Regional School District and several other regional computer systems.

Sergiy P. Usatyuk, 20, of Orland Park, Ill., helped develop, control and operate a number of “booter” services and websites between August 2015 and November 2017, according to court documents. Those services and website were used to launch millions of “distributed denial-of-service,” or DDoS, attacks, which disrupted internet connections of targeted computers, deliberately slowed or crashed targeted websites and interrupted normal business operations, according to the U.S. Justice Department.

Booters, or stressers, are publicly-available, web-based services that allow cybercriminals to overwhelm a computer system with un-requested traffic. Prosecutors said Usatyuk created a corporation called OKServers LLC in Delaware and essentially offered a variety of hacking services for a subscription fee.

In November 2016, county prosecutors contend that Michaela G. King, then an 18-year-old senior at Franklin Regional High School, bought one of the programs and uploaded it to flood the school’s computer system with data, police said.

King was charged with two felony counts for the unlawful use of a communication device to disrupt computer functions. Her trial is scheduled to start Dec. 2 before Common Pleas Court Judge Timothy Krieger.

The “booter” attack disrupted not just Franklin Regional’s computer system but also the systems of 17 other organizations which shared the same computer infrastructure, including other school districts, the county government and its career and technology centers, and the Greensburg Catholic Diocese.

A person can launch a DDoS attack often with only a web browser and online payment along with instructions for attacking a victim computer system, justice department officials said.

“DDoS-for-hire services pose a malicious threat to the citizens of our district, as well as districts across the country, by impeding critical access to the internet and jeopardizing safety and security in the process,” said U.S. Attorney Robert J. Higdon Jr., who is located in Raleigh, N.C., where the case against Usatyuk was prosecuted. “The operation and use of these services to disrupt the operations of our businesses and other institutions cannot be tolerated. Anyone who weaponizes web traffic in this manner will be vigorously pursued and prosecuted by my office.”

The illegal services included ExoStress.in (“ExoStresser”), QuezStresser.com, Databooter.com, Instabooter.com, Polystress.com, Zstress.net and Betabooter.com (“Betabooter”), which King is accused of using.

Usatyuk and a co-conspirator gained in excess of $550,000 from charging subscriber fees to paying customers of their booter services and selling advertising space to other booter operators, according to the justice department.

Over the past five years, booter and stresser services have grown as an increasingly prevalent class of DDoS attack tools.

“Booter-based DDoS attack tools offer a low barrier to entry for users looking to engage in cybercrime,” justice department officials said in a news release.