Who is Avunit? The Hunt for LulzSec's Ghostly Sixth Member

With three of the six core members of LulzSec being sentenced last week in the UK, questions about the identity of the only anonymous member resurface.

LulzSec - or the Lulz Security hacking collective - started out life as a small offshoot of the bigger Anonymous group. It quickly gained cult status online and came to mainstream attention during its 50 Days of Lulz cyber-attacks in 2011 on a diverse range of targets including PBS, Sega and Fox.

However it was its attacks on police authorities and intelligence agencies like the CIA and the UK's Serious Organised Crime Agency which earned it the most attention - and ultimately led to the arrest of five of the six founding members.

However it is the sixth member, who went by the nickname Avunit in online chatrooms, who remains the most intriguing aspect of LulzSec having remained unidentified for the last two years while his colleagues face jail time for their parts in the cyber-attacks.

Avunit, fingered as one of the six core members according to IRC chat logs, has never been identified and abandoned the LulzSec group following a campaign dubbed "F**k the FBI Friday" which saw the group begin an attack on US government servers.

Unravelling

The group disbanded as a whole soon after that but it was the revelation in March of 2012 that the 'leader' of LulzSec had been an FBI informant for more than nine months which saw the unravelling of the group.

It was during his time as an FBI informant that Hector Monsegur, aka Sabu, was able to lead the FBI to other leading members of the group. It resulted in four of the remaining five key players in LulzSec being arrested and charged, with the mysterious Avunit remaining at large.

Three of the LulzSec Six were sentenced in Southwark Crown Court last week for their parts in attacks on EA, Sony Pictures and The Sun newspaper. Jake Davis (aka Topiary), Mustafa Al-Bassam (aka T-Flow) and Ryan Ackroyd (aka Kayla) were sentenced alongside Ryan Cleary (aka Viral) who was a botnet master associated with the group.

Monsegur is still awaiting sentencing in the US, while Darren Martyn (aka Pwnsauce) from Ireland was indicted last March and is still awaiting sentencing.

Avunit remains at large and has not been seen online since he tweeted on the 12 October last under his @AvunitAnon Twitter name.

English language

Nothing is known about his identity and in a world where Anonymous members span the globe it is virtually impossible to narrow his location down with any degree of accuracy. The five LulzSec members identified came from the US and Ireland with three coming from the UK. It would therefore make sense to suggest Avunit comes from a country with English as its first language.

It is also fair to suggest Avunit is a man, though this again doesn't narrow down the choice too much.

It was claimed in June of last year that Avunit was a media manager from Essex but in the same release which claimed to identify him, it incorrectly identifies Topiary as a man from Sweden.

Following the revelation that Sabu was working with the FBI, website Ars Technica published an article based on a conversation it claimed took place with Avunit in one of the secure online chat rooms used by LulzSec. In the article Avunit said he was a "bag of nerves" and was now using a new laptop with everything incriminating having been "burned."

However on Twitter @AvunitAnon claimed that this conversation never took place and the person in the chatroom was simply impersonating him.

Cobble together

These are the meagre pieces of information we have to try and cobble together an identity for Avunit. Security expert Mikko Hypponen from F-Secure, who has been following Anonymous since its very beginnings in the threads of infamous website 4chan, is as baffled as anyone else:

"We have no idea who Avunit is. We have no identity. We don't even know which continent he is from."

The real mystery however is how Avunit has been able to avoid detection despite all his other colleagues being arrested and at least one of them actively working with the FBI to help out his colleagues.

Another piece of information about the group which remains shrouded in mystery is related to the Bitcoins which were donated to the group during its 50 consecutive days hacking in 2011. Charles Arthur in the Guardian estimates these Bitcoins are now worth £120,000 with Hypponen saying they are all held in a single online wallet, controlled by one person.

Could it be that Avunit is remaining unamed by his colleagues because he controls the purse strings and is therefore sitting on a potential large pay-off for those involved whenever they are finally released?

Whatever the reason, its seems that of all LulzSec members, Avunit did the most to cover his digital fingerprints when taking part in any cyber-attacks. It is a practice which has paid off, with the trail going cold and police authorities having bigger fish to fry in cyberspace, it could be that Avunit has got away with it.