Two teenagers charged for alleged hacking on behalf of PoodleCorp and Lizard Squad

The US Department of Justice has charged two teenagers for alleged connections to notorious hacking groups Lizard Squad and PoodleCorp and operating "hacking-for-hire" websites that targeted companies and individuals across the globe. On Wednesday (5 October), US authorities said 19-year-olds Zachary Buchta from Maryland and Bradley Jan Willem van Rooy from the Netherlands were charged with "conspiring to cause damage to protected computers".

Following an international investigation into Lizard Squad and PoodleCorp, the duo allegedly conspired with others to launch a series of distributed denial of service (DDoS) attacks worldwide, dating back to 2015, designed to knock servers offline. The teens also trafficked stolen payment card information of thousands, the complaint states. The charges are among the first brought in the US against alleged members of Lizard Squad.

Lizard Squad gained notoriety for its attacks on gaming companies' servers including Blizzard earlier this year as well as both Sony and Microsoft's PlayStation Network and Xbox Live during the holiday season in 2014.

PoodleCorp has also targeted major gaming companies' servers including multiple attacks on Overwatch and World of Warcraft developer Blizzard. The group previously claimed responsibility for crippling EA's online servers, Rockstar Games' Grand Theft Auto Online servers and Niantic's Pokémon Go servers this year.

Federal officials also seized four domain names associated with the hacker groups including shenron.lizardsquad.org, lizardsquad.org, stresser.poodlecorp.org and poodlecorp.org. Authorities said the duo also operated a scam called phonebomber.net, allowing customers to pay for repeated, harassing phone calls to be made from spoofed numbers targeting select victims.

In October 2015, they boasted that a person in Illinois became their "first victim" and received a phone call every hour for 30 days.

The complaint states that when the victim answered the phone, an audio recording played saying "better look over your [expletive] back because I don't flying [expletive] if we have to burn your [expletive] house down, if we have to [expletive] track your [expletive] family down, we will [expletive] your [expletive] up [expletive]".

Shortly after the launch of phonebomber.net, Buchta, van Rooy and other Lizard Squad members started launching DDoS attacks against various "gaming, entertainment and media companies" while boasting about their achievements on social media.

The complaint states that Buchta used the online screen names "@fbiarelosers," "pein," "xotehpoodle" and "lizard," while van Rooy used the names "Uchiha," "@UchihaLS," "dragon" and "fox."

Buchta was arrested in September in Maryland. Van Rooy was arrested in the Netherlands last month and is still in custody there. The conspiracy charge carries a maximum of 10 years in prison.