Connect with us

Hi, what are you looking for?


US accuses Venezuela doctor of selling ransomware to cybercriminals

Ransomware allegedly sold by a Venezuelan-French doctor would encrypt information on the computers that had been hacked, then the attackers would demand money to decrypt it

A French-Venezuelan cardiologist was accused Monday by the US of selling ransomware to cybercriminals and instructing them on how to extort money from the victims they hacked. 

The Brooklyn district attorney’s office said Moises Luis Zagala, 55, who lives in the Venezuelan city of Ciudad Bolivar, “not only created and sold ransomware products to hackers, but also trained them in their use.” 

It said the French-Venezuelan doctor “sold the tools for conducting ransomware attacks, trained the attackers about how to extort victims, and then boasted about successful attacks, including by malicious actors associated with the government of Iran.”

The ransomware would encrypt information on the computers that had been hacked, then the attackers would demand money to decrypt it. 

One of the first products developed by Zagala was a data hijacking program called “Jigsaw v. 2”, which had a “doomsday” counter that kept track of the times the user had tried to destroy it.

“If the user kills the ransomware too many times, then it’s clear he won’t pay so better erase the whole hard drive,” Zagala instructed his clients, according to the US authorities.

In early 2019, Zagala began advertising his new tool on the web, a “Private Ransomware Builder” which he named “Thanos” after the Marvel Comics villain responsible for destroying the half of life in the universe, as well as Thanatos in Greek mythology, associated with death. 

The “multi-tasking doctor,” as the Brooklyn DA described him, allowed criminals to either buy the program — and create their own customized ransom notes — or to join an “affiliate program” to gain access to the program in exchange for a share of the ill-gotten gains, which could be paid in cryptocurrency or regular cash. 

His preferred aliases were “Aesculapius,” referring to the ancient Greek god of medicine, and “Nosophoros,” which means “sickness” in Greek.

Zagala allegedly boasted in specialized hacker forums that the Thanos program was practically undetectable by antivirus programs and that once the encryption was finished the program would self-delete, making it almost impossible for the victim to be able to detect it and retrieve their documents. 

Zagala even asked his clients “if you have time and it’s not too much trouble” to rate their experience online.  

If found guilty, he could be sentenced to 10 years in jail.

Written By

With 2,400 staff representing 100 different nationalities, AFP covers the world as a leading global news agency. AFP provides fast, comprehensive and verified coverage of the issues affecting our daily lives.

You may also like:


I therefore strongly suggest shutting up and letting the Ukrainians get on with it.


From autonomous bug zappers to android pianists and driverless ice-cream trucks, machines rule the world at China's Asian Games.


A picture released three days after the blast shows the release of gas emanating from a leak on the Nord Stream 2 pipeline -...


NATO is seeking several ways to tackle drones on the battlefield - Copyright AFP/File FRED TANNEAUOlivier BAUBEA small drone flits over opened earth, and...