MLT (hacktivist)

Believed to be the former co-leader and spokesperson of TeaMp0isoN,[14] MLT, along with Junaid Hussain and other hackers targeted many large websites and corporations over a two year period, from 2010 up until 2012 when both individuals were arrested. The group first gained popularity after targeting infamous hacking collective LulzSec, releasing personal information on their members and purporting to have hacked their websites, they then went on to target sites such as NATO, and various government officials from the United Kingdom and United States of America .[15] The arrests finally came as a result of the probe into the alleged hacking and wiretapping of the British Security Services Anti-Terrorism Hotline.[16]

MLT also operated a Black Hat hacking group known as bitst0rm which targeted the Computer Security industry in particular. It appears bitst0rm had a similar Modus operandi to that of other hacking groups within the Anti-Security Movement. Some of the targets of bitst0rm were individuals such as Kevin Mitnick and Dan Kaminsky as well as companies including Norton, F-Secure, Stack Exchange and Stack Overflow Q&A sites, hak5.org, and Metasploit Project.[17] After MLT's arrest, bitst0rm finally disbanded.

MLT was suspected of having direct ties to the global hacking collective, Anonymous,[18] and states that he started his hacking career from an early age of around 12 or 13.[19] The popular computer vigilante known as The Jester has accused MLT of having ties to Crackas With Attitude,[20] a blackhat group that leaked several government documents pertaining to the CIA and FBI.[21] MLT was also suspected of having ties to the blackhat hacking group known as Lizard Squad, as suggested by cybersecurity intelligence firm IntelCrawler LLC in a threat intelligence report that was released.[22] These claims were also supported by The Jester.[23]

MLT was the former hacking partner[24] of Junaid Hussain, who later went on to join ISIS and was killed in a drone strike[25] by the US Government after becoming the third highest target on their 'kill list' due to his role in inspiring international lone-wolf terrorism alongside his hacking activities for ISIS under the banner of Islamic State Hacking Division. It was reported by Vice that Junaid Hussain remained in contact with MLT while in Syria, and that he used to occasionally ask for advice relating to hacking or would sometimes even openly boast about his activities within ISIS to MLT.[26]

MLT states that his "Greatest hacking challenge" was gaining administrative access to Facebook as it required him to think outside of the box and employ techniques that he usually would not attempt. He also states that the "funniest hack" he carried out was gaining access to a United States Army Web Server by reading the contents of the publicly disclosed passwd file then simply using the password to login to a publicly-accessible Secure Shell interface in order to connect to the server back-end as a Superuser (Also known as a root user, the highest possible user permissions on a Linux-Based or Unix-Based system)[27][28].

On Wednesday 9 May 2012, MLT was arrested in Newcastle upon Tyne by the Metropolitan Police who released a statement saying: "The suspect, who is believed to use the online 'nic' 'MLT', is allegedly a member of and spokesperson for TeaMp0isoN ('TeamPoison')--a group which has claimed responsibility for more than 1,400 offences including denial of service and network intrusions where personal and private information has been illegally extracted from victims in the U.K. and around the world,"[29]

It was reported that MLT could have faced up to 10 years in prison for the events leading to his arrest.[30] Junaid Hussain who was also arrested in relation to the same offences received a 6 month sentence under the Computer Misuse Act and the Malicious Communications Act after pleading guilty to hacking the email account of Tony Blair, the former British Prime Minister.[31]

In more recent years, Matthew Telfer has focused his attention on legitimate security research rather than malicious Black Hat hacking. He has identified and reported critical vulnerabilities in sites such as eBay[32] and the U.S. Department of Defense[33] and states that he avoids illegal activities and instead dedicates his time to participating in Bug Bounty Programs.[34]

In May 2015, someone purporting to be MLT featured on CNN, speaking to them about Junaid Hussain and claiming that he witnessed him appear on video chat once as a 'black power ranger' while wielding an AK-47.[35] In August 2015, MLT featured on Episode 5 of the TV show Viceland Cyberwar where he spoke about subjects ranging from the security of autonomous cars to the death of his former hacking partner.[36][37]

In early 2016, MLT released a blog post titled "An intro to advanced Phishing techniques" which appears to have contained the first ever publicly documented mention of the method to bypass Punycode protections put in place to prevent IDN Homograph Attacks (A form of URL spoofing attack also known as Script Spoofing) from being carried out in all major web browsers.[38] Although a Chinese Security Researcher named Xudong Zheng was credited for discovering this particular bypass method, he did not post it until April 2017, indicating that it was discovered and publicly disclosed by MLT fourteen months prior to the discovery by Xudong Zheng.[39]

In 2017, MLT appears to have shifted his focus to exploit development, publishing several zero-day vulnerabilities online under the banner of a group known as Project Insecurity.[40]

In 2019, he opened a Q&A on Reddit, where he answered questions from users.

After his arrest, Matthew Telfer shifted his focus towards legitimate security research rather than illegal activities.

Matthew Telfer is the founder and Chief Executive Officer of Project Insecurity LTD, an exploit research group and educational platform responsible for identifying security flaws in software used by a number of high-profile websites, some examples being Google, Twitter, PayPal, Bank of America, Kaspersky, AT&T, Tesla, Verizon Media, and Sony, among many other websites.

In addition to this, Matthew Telfer is widely known for his work within the Bug Bounty Community, having identified and reported flaws in websites such as PayPal, Microsoft, eBay, Imgur Amazon, FBI, CIA, Sony, United States Department of Defense, Federal Government of the United States, and several-thousand other high-profile websites.[41]

Matthew Telfer is listed as the UK Chapter Lead for GDI Foundation, a non-profit international humanitarian group operated by Victor Gervers.[42] The purpose of GDI Foundation is to defend the free and open internet through means of responsible disclosure and remediation of security flaws. It is a global foundation with its headquarters in The Netherlands[43] and its goal is to safe-guard and protect the open internet through responsible disclosure carried out by a number of volunteers.[44] This organization has helped many researchers disclose a large number of critical security flaws, and has also shed light on surveillance by the Chinese Government through various breaking news stories[45][46]. GDI Foundation also exposed to the public the fact that various high-profile dating applications were collecting data from users' chat history.[47]

Matthew Telfer also does Freelance writing for SecJuice Magazine, with informative tutorials covering topics such as how to secure yourself online and how to identify security vulnerabilities.[48]