Overview
- Feras Khalil Ahmad Albashiti, known online as r1z, admitted in U.S. court to trafficking unauthorized logins that provided access to at least 50 companies’ networks.
- An undercover operation on May 19, 2023 documented his sale for cryptocurrency, followed by additional purchases that included EDR‑bypassing and privilege‑escalation tools.
- During a malware demonstration to the FBI, he exposed an IP address that court filings say ties him to a ransomware attack causing about $50 million in losses at a U.S. manufacturer.
- He was extradited from the Republic of Georgia in July 2024, and prosecutors say he faces up to 10 years in prison and fines under 18 U.S.C. §1029, with forfeiture of proceeds sought.
- Investigators linked the r1z persona to Albashiti using seized XSS forum data, a 2016 U.S. visa application email, and Google Pay records, with researchers previously noting his ads for exploits and mass access lists.