A 23-year-old hacker from Utah, Austin Thompson, known online as “DerpTroll,” has received a 27-month prison sentence for orchestrating a series of Distributed Denial of Service (DDoS) attacks targeting various online services, websites, and gaming companies from December 2013 to January 2014. His attacks notably affected major gaming platforms during the Christmas period.
Thompson admitted to participating in a hacker group called DerpTrolling, which was involved in significant DDoS operations against high-profile gaming services—including Electronic Arts’ Origin, Sony’s PlayStation Network, and Valve’s Steam. According to a press release from the U.S. Department of Justice, his actions resulted in damages exceeding $95,000 for the targeted companies. Arrested in the summer preceding his sentencing, Thompson’s guilty plea in November 2018 marked the conclusion of a protracted investigation.
The Department of Justice indicated that Thompson utilized a Twitter account, @DerpTrolling, to announce impending attacks and would often showcase “scalps,” or visuals indicating the impacts of his assaults, post-attack. In addition to his prison term, Thompson has been ordered to pay restitution to Daybreak Games, formerly known as Sony Online Entertainment, further emphasizing the financial repercussions of his criminal actions.
U.S. Attorney Robert Brewer underscored the broad economic impact of denial-of-service attacks, which collectively cost businesses and individuals millions each year. The prosecution of hackers who intentionally disrupt online services remains a priority for law enforcement agencies.
Thompson’s case is a stark reminder of the ongoing threats faced by online gaming companies and broader online service providers. While DerpTrolling was a key player in the chaos of 2014, other groups, notably Lizard Squad, also made headlines for similar DDoS attacks targeting platforms such as Microsoft’s Xbox Live and Sony’s PlayStation Network during the same time frame.
Lizard Squad members have faced legal consequences as well; some teenagers involved in their operations have been arrested and charged. Notably, one member, Julius Kivimaki, received a suspended two-year prison sentence in Finland for his actions linked to the group’s DDoS campaigns, calling attention to the international reach and ramifications of such cybercrimes.
In analyzing Thompson’s methods through the lens of the MITRE ATT&CK framework, tactics such as initial access and disruption can be identified as fundamental to the execution of his DDoS operations. By impairing service availability, Thompson and his cohorts effectively exploited vulnerabilities in internet infrastructure, illustrating the need for comprehensive cybersecurity strategies within organizations actively leveraging online platforms, especially during peak traffic periods like the holidays.
As cybersecurity threats continue to evolve, the necessity for businesses to adopt proactive measures—including robust denial-of-service mitigation strategies—remains critical to safeguard against similar future incidents.
