The Department of Justice has charged the two men with carrying out distributed denial of service (DDoS) attacks against online gaming sites and media companies, as well as selling DDoS-for-hire tools and fraudulent credit cards.
The two suspects are named as Zachary Buchta from Maryland and Bradley Jan Willem van Rooy from the Netherlands, but the two were reportedly known under a number of online pseudonyms like “@fbiarelosers,” “lizard,” “Uchiha,” and “dragon.” Both were arrested as part of an international operation and are accused of conspiring with others to carry out cyberattacks. Van Rooy was arrested by U.S. agents’ Dutch counterparts and remains in custody in the Netherlands.
Along with the arrests, the federal officials also seized four domain names supposedly associated with the Lizard Squad and PoodleCorp groups. They are: shenron.lizardsquad.org, lizardsquad.org, stresser.poodlecorp.org, and poodlecorp.org.
The two teenagers are facing up to 10 years in prison based on the charges, according to the DOJ.
Per the authorities, the two also operated a scam called phonebomber.net, which allowed customers to pay for threatening phone calls to be made to people from spoofed numbers.
The full complaint includes an example of one of the messages the cops recorded where an individual launches a profanity-laced tirade that made threats to burn another person’s house down and harm him and his family.
“During October and November 2015, two Twitter accounts identified as belonging to members of Lizard Squad — @LizardLands and @UchihaLS (i.e., van Rooy) — were used to disseminate information about phonebomber.net,” said the DOJ.
The investigation into these practices led the authorities to Lizard Squad and ultimately van Rooy and Buchta, they said. The complaint adds the two young men would regularly boast on their pseudonymous social media accounts about the DDoS attacks they carried out.
The arrests are the latest in a number of charges laid against supposed members of the hacking gangs or related to their services. Last year, police in the U.K. arrested six teenagers for using DDoS-for-hire software developed and sold by Lizard Squad, while a Finnish man associated with the group was met with 50,000 computer abuse charges but somehow avoided prison time.
