CASE DOSSIER charged

U.S. v. Rui-Siang Siew (Incognito Market Darknet Extortion)

Docket: 1:24-cr-00305 Court: U.S. District Court for the Southern District of New York Opened: 2024-05-20 Sector: Consumer Privacy, Cryptocurrency

Key Facts

Status

CHARGED

Legal disposition

Loss Amount

$100.0 million

Processed over $100 million in illicit crypto sales and demanded extortion fees up to $20,000 per vendor.

Techniques

Verified mappings

Defendants

Named in charges

Legal Status: CHARGED in U.S. District Court for the Southern District of New York.
Primary Target Sector: Consumer Privacy, Cryptocurrency.
Documented Financial Loss: $100.0 million.
1 verified MITRE ATT&CK techniques substantiated with verbatim court excerpts.

Export structured case data and MITRE ATT&CK Navigator layer:

Download Navigator Layer (JSON) Case Data (JSON)

Case Summary

Owner and operator of Incognito Market who facilitated over $100 million in illicit darknet transactions before orchestrating an exit scam and extorting registered vendors and buyers with doxxing threats.

BOARDROOM EXECUTIVE BRIEF

Executive Summary for Board Members & Leadership

Plain-English Root Cause

Unauthorized intrusion originating from targeted infiltration directed against Consumer Privacy, Cryptocurrency networks. Owner and operator of Incognito Market who facilitated over $100 million in illicit darknet transactions before orchestrating an exit scam and extorting registered vendors and buyers with doxxing threats.

Operational & Financial Fallout

Processed over $100 million in illicit crypto sales and demanded extortion fees up to $20,000 per vendor. Impacted Consumer Privacy, Cryptocurrency infrastructure and associated victim operations.

3 Critical Boardroom Questions

1. Do 100% of our external portals enforce phishing-resistant hardware MFA?
2. Can compromised endpoint credentials traverse laterally to domain controllers or cloud storage?
3. Have our air-gapped immutable recovery backups been restored and tested within the last 90 days?

Disposition: CHARGED

Technical Threat Intelligence

Attack Anatomy & Incident Execution

Forensic analysis of initial intrusion vector, step-by-step kill chain, operational blast radius, and defensive controls.

Ground Zero / Infiltration Vector

Adversary Kill Chain Flow

2 Documented Phases

Phase 1: Infiltration Perimeter Ingress

MITRE ATT&CK T1190 →

Operatives secured access to victim infrastructure within the Consumer Privacy, Cryptocurrency sector.

Artifacts & Tooling: Network perimeter logs

Phase 2: Execution Payload Deployment

MITRE ATT&CK T1486 →

Artifacts & Tooling: Malicious payload

Real-World Blast Radius & Operational Fallout

Processed over $100 million in illicit crypto sales and demanded extortion fees up to $20,000 per vendor. Impacted Consumer Privacy, Cryptocurrency infrastructure and associated victim operations.

Defensive Engineering Takeaways

Recommended Hardening Controls

✓ Enforce phishing-resistant multifactor authentication (FIDO2) across all external remote access endpoints.

✓ Implement network microsegmentation to prevent unrestricted lateral traversal between internal subnets.

✓ Maintain isolated, immutable backups of critical directory services and transaction databases.

✓ Deploy real-time endpoint detection and response (EDR) agents with automated containment policies.

Procedural & Incident Timeline

2024-05-18 arrest

Siew arrested at JFK International Airport in New York upon arrival from Taiwan.

Named Defendants & Operatives

Defendant	Nationality	Status	Prison Term	Restitution	Notes
Rui-Siang Siew	Taiwan	charged	Pending	None	Operator of Incognito Market arrested at JFK Airport in May 2024.

Substantiated MITRE ATT&CK Techniques

Technique ID	Technique Name & Tactic	Primary Source Evidence Excerpt	Locator	Verification
T1090	Proxy Command and Control	"Operated hidden onion services over the Tor network equipped with automated cryptocurrency escrow mechanisms."	Criminal Complaint ¶ 8, Page 4	reviewed

Cite & Embed This Case Record

Public Domain / CC0

Bluebook Legal Citation:

Cyberattack Case Library, U.S. v. Rui-Siang Siew (Incognito Market Darknet Extortion), No. 1:24-cr-00305 (U.S. District Court for the Southern District of New York 2024), https://cybercaselibrary.com/cases/us-v-siew-incognito-market/

Embeddable Incident Card (HTML):