U.S. v. Brett Johnson (ShadowCrew Cybercrime Syndicate)
Key Facts
- Legal Status: SENTENCED in U.S. District Court for the District of New Jersey.
- Primary Target Sector: Banking, Consumer Identity, E-Commerce.
- Documented Financial Loss: $4.0 million.
- 1 verified MITRE ATT&CK techniques substantiated with verbatim court excerpts.
Incident Overview
Pioneering cybercriminal known as 'The Original Internet Godfather' who built and operated ShadowCrew, the prototypical dark web marketplace for trafficking in stolen identities and credit card data.
Root Cause & Infiltration Vector
Adversary gained initial access via Spearphishing Link: Johnson established early phishing operations that cloned PayPal and eBay authentication web pages to steal account credentials.
Operational Impact & Financial Blast Radius
Resulted in $4,000,000 in documented financial liabilities. Facilitated millions in fraudulent debit card cloning transactions.
Executive Risk Checklist
- 1. Are 100% of external and administrative access portals protected by phishing-resistant MFA?
- 2. Is network microsegmentation enforced between user workstations and core database enclaves?
- 3. Have immutable offline backups and incident escalation procedures been validated within 90 days?
Incident Execution & Kill-Chain Lifecycle
Sequential reconstruction of intrusion stages from initial infiltration to resolution.
Johnson established early phishing operations that cloned PayPal and eBay authentication web pages to steal account credentials.
Adversaries navigated internal subnets, elevating system permissions and harvesting credentials to expand administrative access across Banking, Consumer Identity, E-Commerce infrastructure.
Pioneering cybercriminal known as 'The Original Internet Godfather' who built and operated ShadowCrew, the prototypical dark web marketplace for trafficking in stolen identities and credit card data.
Standard of Care Remediation & Hardening
Empirical engineering takeaways and preventative controls derived from this incident.
Procedural & Incident Timeline
Johnson arrested by U.S. Secret Service in Operation Open Market.
Sentenced to 90 months (7.5 years) in federal prison.
Named Defendants & Operatives
| Defendant | Nationality | Status | Prison Term | Restitution | Notes |
|---|---|---|---|---|---|
| Brett Johnson | United States | sentenced | 90 mo | None | Creator of ShadowCrew dark web forum; sentenced to 90 months in federal prison. |
Substantiated MITRE ATT&CK Techniques
| Technique ID | Technique Name & Tactic | Primary Source Evidence Excerpt | Locator | Verification |
|---|---|---|---|---|
| T1566.002 | Spearphishing Link Initial Access | "Johnson established early phishing operations that cloned PayPal and eBay authentication web pages to steal account credentials." | Indictment ¶ 11, Page 6 | reviewed |