The Lord of the Rings<\/em> helped lead authorities to Filion\u2019s doorstep.<\/p>\nFlorida prosecutors charged Filion with four felony counts, including three related to allegedly making false reports to law enforcement and one for unlawful use of a two-way radio for \u201cfacilitating or furthering an act of terrorism\u201d that authorities say targeted people based on race, religion, or other protected classes. While prosecutors alleged that Filion \u201cis responsible for hundreds of swatting and bomb threat incidents throughout the United States,\u201d the charges Filion faces relate to a single May 12, 2023, swatting attack against the Masjid Al Hayy Mosque in Sanford, Florida.<\/p>\n
An attorney for Filion was not immediately available to respond to WIRED\u2019s request for comment.<\/p>\n
More than a year before the swatting attack on the Florida mosque, agents with the US Federal Bureau of Investigation interviewed Filion\u2019s father, William, at his home in Lancaster, California, according to court documents made public on Wednesday. The interview took place on April 21, 2022, the same day the owner of a Telegram channel linked to swatting activity posted, \u201cSOMEONE JUST REPORTED ME TO THE FBI\u2026 LOL!\u201d<\/p>\n
In October 2022, authorities investigating swatting incidents involving calls made to a school in Anacortes, Washington, came across a Telegram user associated with multiple swatting and doxing channels. The user, \u201cNazgul Swattings,\u201d had claimed responsibility in one of these channels for the threats to the Washington schools, according to the same court documents.<\/p>\n
Over the following months, court records say, the FBI monitored channels linked to this user. One of those, a channel called Torswats (formerly Nazgul Swats), had shared recordings of nearly 20 hoax calls threatening locations around the country, including schools in Iowa, Louisiana, Maryland, Oklahoma, Pennsylvania, and Texas.<\/p>\n
As the FBI tracked Torswats\u2019 public channels, Brad \u201cCafrozed\u201d Dennis, a private investigator, was running his own parallel investigation on behalf of high-profile Twitch streamers who\u2019d been swatted. In December, Dennis reached out to a user behind Torswats and asked to chat on a peer-to-peer chatting service called Tox under the guise of ordering a swat. According to records shared with WIRED, not mentioned in the arrest warrant, while interacting on Tox, Dennis used Wireshark to monitor his network traffic. In the process, he uncovered an IP address and the username \u201cPaimon Arnum,\u201d which was previously unknown to law enforcement.<\/p>\n
Matt Reynolds<\/span><\/span><\/p>\nVittoria Elliott<\/span><\/span><\/p>\nReece Rogers<\/span><\/span><\/p>\nKate O'Flaherty<\/span><\/span><\/p>\nA quick search on Google uncovered a YouTube account under that name that shared similarities with other Nazgul accounts. He sent this information to the FBI.<\/p>\n
\u201cNazgul,\u201d \u201cPaimon Arnum,\u201d and other usernames police claim are linked to online accounts Filion used are related to J.R.R. Tolkien\u2019s The Lord of the Rings<\/em>. For example, the owner of the Torswats Telegram channel posted images of a Nazgul, which translates to \u201cRing Wraith\u201d in Tolkein\u2019s \u201cblack speech\u201d language, according to court documents. Authorities say Filion used several usernames containing the phrase \u201cRing Wraith.\u201d In emails between Dennis and the FBI, the private investigator also flagged a Discord account with the username \u201cDushatar,\u201d which used a Nazgul as its profile image, court records say. The same Discord user previously used the handles \u201cPaimon Arnum,\u201d \u201cPaimon Arnum Onkmokhob,\u201d and \u201cPaimon Arnum Angmarob,\u201d according to court records, which investigators note are all \u201cdetailed, obscure ambiguations of words within Tolkein\u2019s \u2018black speech\u2019 language.\u201d Police say they also found Lord of the Rings<\/em>-related words and online content linked to six Google accounts that they claim Filion used.<\/p>\nIn April and May, the FBI sent subpoenas to Discord and Google requesting information about accounts linked to Dushatar on Discord and Paimon Arnum on YouTube. The records provided by the companies confirmed that a user had logged into both accounts using the same residential IP address in Lancaster California, court documents say.<\/p>\n
In June, the FBI sent another subpoena to Google asking for information about five other accounts that shared cookies with the Gmail account tied to Painum Arnum. The arrest records say these accounts had watched YouTube videos about hoax shootings and bomb threats to schools around the US and had looked up things like \u201cHow many Jews are in the US,\u201d \u201cCriminal mastermind swatting,\u201d \u201dArm a pipe bomb,\u201d and \u201cText to speech for phone call.\u201d<\/p>\n
On July 15, the FBI executed a search warrant on Filion\u2019s Lancaster home and seized his phones and computers. This includes a Samsung device on which investigators say they observed Telegram activity related to earlier swatting attacks, images shared to the Torswats Telegram channel, email addresses connected to the Google accounts authorities claim Filion used, and other activity allegedly linked to the teenager, according to the arrest warrant. It\u2019s unclear why the FBI waited until January to arrest Filion.<\/p>\n
At 2 pm EST on Wednesday, Filion shuffled into a Seminole County courtroom and stood quietly as the judge read the charges against him. He is currently being held without bond.<\/p>\n
https:\/\/www.wired.com\/category\/security\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"![](\"https:\/\/media.wired.com\/photos\/65baef8447aa8f479c6b08c7\/master\/pass\/013124-security-torswats-swatting-arrest-digital.jpg\"\/)
<\/p>\n
Credit to Author: Dhruv Mehrotra, Andrew Couts| Date: Thu, 01 Feb 2024 01:28:52 +0000<\/strong><\/p>\nFor nearly two years, police have been tracking down the culprit behind a wave of hoax threats. A digital trail took them to the door of a 17-year-old in California.<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10378,10607],"tags":[714,21357],"class_list":["post-23843","post","type-post","status-publish","format-standard","hentry","category-security","category-wired","tag-security","tag-security-security-news"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/23843","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=23843"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/23843\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=23843"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=23843"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=23843"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}