CASE DOSSIER sentenced

U.S. v. Brett Johnson (ShadowCrew Cybercrime Syndicate)

Docket: 2:04-cr-00725 Court: U.S. District Court for the District of New Jersey Opened: 2004-10-26 Sector: Banking, Consumer Identity, E-Commerce

Key Facts

Status

SENTENCED

Legal disposition

Loss Amount

$4.0 million

Facilitated millions in fraudulent debit card cloning transactions.

Techniques

Verified mappings

Defendants

Named in charges

Legal Status: SENTENCED in U.S. District Court for the District of New Jersey.
Primary Target Sector: Banking, Consumer Identity, E-Commerce.
Documented Financial Loss: $4.0 million.
1 verified MITRE ATT&CK techniques substantiated with verbatim court excerpts.

Export structured case data and MITRE ATT&CK Navigator layer:

Download Navigator Layer (JSON) Case Data (JSON)

Case Summary

Pioneering cybercriminal known as 'The Original Internet Godfather' who built and operated ShadowCrew, the prototypical dark web marketplace for trafficking in stolen identities and credit card data.

BOARDROOM EXECUTIVE BRIEF

Executive Summary for Board Members & Leadership

Plain-English Root Cause

Adversary breached the target network via Spearphishing Link. Johnson established early phishing operations that cloned PayPal and eBay authentication web pages to steal account credentials.

Operational & Financial Fallout

Facilitated millions in fraudulent debit card cloning transactions. Impacted Banking, Consumer Identity, E-Commerce infrastructure and associated victim operations.

3 Critical Boardroom Questions

1. Do 100% of our external portals enforce phishing-resistant hardware MFA?
2. Can compromised endpoint credentials traverse laterally to domain controllers or cloud storage?
3. Have our air-gapped immutable recovery backups been restored and tested within the last 90 days?

Disposition: SENTENCED

Technical Threat Intelligence

Attack Anatomy & Incident Execution

Forensic analysis of initial intrusion vector, step-by-step kill chain, operational blast radius, and defensive controls.

Ground Zero / Infiltration Vector

Adversary breached the target network via Spearphishing Link. Johnson established early phishing operations that cloned PayPal and eBay authentication web pages to steal account credentials.

Adversary Kill Chain Flow

1 Documented Phases

Phase 1: Initial Access Initial Perimeter Infiltration

MITRE ATT&CK T1566.002 →

Johnson established early phishing operations that cloned PayPal and eBay authentication web pages to steal account credentials.

Artifacts & Tooling: T1566.002 Spearphishing Link

Real-World Blast Radius & Operational Fallout

Facilitated millions in fraudulent debit card cloning transactions. Impacted Banking, Consumer Identity, E-Commerce infrastructure and associated victim operations.

Defensive Engineering Takeaways

Recommended Hardening Controls

✓ Enforce phishing-resistant multifactor authentication (FIDO2) across all external remote access endpoints.

✓ Implement network microsegmentation to prevent unrestricted lateral traversal between internal subnets.

✓ Maintain isolated, immutable backups of critical directory services and transaction databases.

✓ Deploy real-time endpoint detection and response (EDR) agents with automated containment policies.

Procedural & Incident Timeline

2005-02-08 arrest

Johnson arrested by U.S. Secret Service in Operation Open Market.

2007-06-20 sentencing

Sentenced to 90 months (7.5 years) in federal prison.

Named Defendants & Operatives

Defendant	Nationality	Status	Prison Term	Restitution	Notes
Brett Johnson	United States	sentenced	90 mo	None	Creator of ShadowCrew dark web forum; sentenced to 90 months in federal prison.

Substantiated MITRE ATT&CK Techniques

Technique ID	Technique Name & Tactic	Primary Source Evidence Excerpt	Locator	Verification
T1566.002	Spearphishing Link Initial Access	"Johnson established early phishing operations that cloned PayPal and eBay authentication web pages to steal account credentials."	Indictment ¶ 11, Page 6	reviewed

Cite & Embed This Case Record

Public Domain / CC0

Bluebook Legal Citation:

Cyberattack Case Library, U.S. v. Brett Johnson (ShadowCrew Cybercrime Syndicate), No. 2:04-cr-00725 (U.S. District Court for the District of New Jersey 2004), https://cybercaselibrary.com/cases/us-v-johnson-shadowcrew/

Embeddable Incident Card (HTML):