CASE DOSSIER sentenced

U.S. v. Gal Vallerius (Dream Market OxyMonster Administrator)

Name: U.S. v. Gal Vallerius (Dream Market OxyMonster Administrator) Technical Evidence & ATT&CK Dataset
Creator: Cyberattack Case Library
License: https://creativecommons.org/publicdomain/zero/1.0/

Docket: 1:17-cr-20648-RNS Court: U.S. District Court for the Southern District of Florida Opened: 2017-09-01 Sector: Darknet Marketplace & Narcotics

Key Facts

Status

SENTENCED

Legal disposition

Loss Amount

$20.0 million

Forfeiture of 100 Bitcoins and 121 Bitcoin Cash to the United States Marshals Service.

Techniques

Verified mappings

Defendants

Named in charges

Legal Status: SENTENCED in U.S. District Court for the Southern District of Florida.
Primary Target Sector: Darknet Marketplace & Narcotics.
Documented Financial Loss: $20.0 million.
2 verified MITRE ATT&CK techniques substantiated with verbatim court excerpts.

Export structured case data and MITRE ATT&CK Navigator layer:

Download Navigator Layer (JSON) Case Data (JSON)

Case Summary

Federal prosecution of French cybercriminal Gal Vallerius (known as OxyMonster), senior administrator and escrow vendor for Dream Market darknet marketplace, arrested at Atlanta Hartsfield-Jackson airport while traveling to the World Beard Championships and sentenced to 20 years in federal prison.

BOARDROOM EXECUTIVE BRIEF

Executive Summary for Board Members & Leadership

Plain-English Root Cause

Darknet marketplace administration and vendor escrow operations conducted across Tor hidden services by Dream Market senior moderator OxyMonster.

Operational & Financial Fallout

International darknet narcotics distribution hub dismantled, resulting in a 20-year federal prison sentence and forfeiture of 100 Bitcoins.

3 Critical Boardroom Questions

1. Do 100% of our external portals enforce phishing-resistant hardware MFA?
2. Can compromised endpoint credentials traverse laterally to domain controllers or cloud storage?
3. Have our air-gapped immutable recovery backups been restored and tested within the last 90 days?

Disposition: SENTENCED

Technical Threat Intelligence

Attack Anatomy & Incident Execution

Forensic analysis of initial intrusion vector, step-by-step kill chain, operational blast radius, and defensive controls.

Ground Zero / Infiltration Vector

Darknet marketplace administration and vendor escrow operations conducted across Tor hidden services by Dream Market senior moderator OxyMonster.

Adversary Kill Chain Flow

5 Documented Phases

Darknet Operation Tor Hidden Service Administration

MITRE ATT&CK T1090 →

Gal Vallerius operated encrypted Tor onion services to manage vendor disputes, escrow accounts, and narcotics sales on Dream Market.

Artifacts & Tooling: Tor onion service configs Dream Market moderator console

PGP Attribution Cryptographic Key Attribution

MITRE ATT&CK T1557 →

Federal investigators matched PGP public keys and Bitcoin tip addresses from public forums to Vallerius online persona OxyMonster.

Artifacts & Tooling: PGP public key fingerprints Blockchain transaction graphs

Physical Interception Airport Detainment & Laptop Seizure

MITRE ATT&CK T1078 →

DEA agents detained Vallerius at Atlanta Hartsfield-Jackson airport en route to the World Beard Championships, seizing his encrypted laptop.

Artifacts & Tooling: Seized MacBook Border search inspection

Forensic Confirmation Decrypted Tor Session Evidence

MITRE ATT&CK T1005 →

Forensic analysis of the seized machine confirmed active Dream Market administrative credentials and Tor browser configuration artifacts.

Artifacts & Tooling: Tor browser profile data Local PGP private keys

Federal Conviction 20-Year Prison Sentence & Crypto Forfeiture

MITRE ATT&CK T1078 →

Vallerius pleaded guilty in Miami federal court to drug trafficking and money laundering conspiracies, forfeiting 100 Bitcoins.

Artifacts & Tooling: DOJ plea agreement Cryptocurrency forfeiture order

Real-World Blast Radius & Operational Fallout

International darknet narcotics distribution hub dismantled, resulting in a 20-year federal prison sentence and forfeiture of 100 Bitcoins.

Defensive Engineering Takeaways

Recommended Hardening Controls

✓ Never reuse cryptographic public keys or Bitcoin wallet addresses between commercial and anonymous identities.

✓ Implement full-disk hardware encryption and air-gapped signing keys for high-value administrative accounts.

✓ Recognize that network-layer Tor anonymity is defeated by operational security metadata linkage.

✓ Deploy multi-signature cold storage wallets for enterprise cryptocurrency custodial balances.

Procedural & Incident Timeline

2017-08-31 arrest

DEA agents arrest Vallerius at Atlanta International Airport, finding PGP keys and Dream Market logins on his laptop.

2018-06-12 guilty_plea

Vallerius pleads guilty to drug trafficking conspiracy and money laundering conspiracy.

2018-10-02 sentencing

Federal judge sentences Vallerius to 20 years in prison and orders forfeiture of cryptocurrency.

Substantiated MITRE ATT&CK Techniques

Technique ID	Technique Name & Tactic	Primary Source Evidence Excerpt	Locator	Verification
T1090	Proxy Command and Control	"Vallerius operated hidden Tor onion services to conceal server hosting locations while conducting darknet administration and cryptocurrency transactions."	DEA Criminal Complaint ¶ 14, Page 5	reviewed
T1557		"Operatives verified user credentials and moderated illicit vendor disputes through encrypted PGP signatures and darknet escrow balances."	DOJ Plea Agreement ¶ 9	reviewed

Cite & Embed This Case Record

Public Domain / CC0

Bluebook Legal Citation:

Cyberattack Case Library, U.S. v. Gal Vallerius (Dream Market OxyMonster Administrator), No. 1:17-cr-20648-RNS (U.S. District Court for the Southern District of Florida 2017), https://cybercaselibrary.com/cases/us-v-vallerius-oxymonster-dream-market/

Embeddable Incident Card (HTML):