The nice Scientologist who was caught writing code for ransomware scammers

[Alla Witte]

We recently became aware of a rather strange situation and we’re not sure what to think about it. But we thought we’d just lay it out and give our commenters a chance to discuss it.

Last year, a number of stories appeared at news organizations and websites that cover the murky world of international hacking cartels. They reported the surprising news that an arrest had been made of someone involved in one of the most notorious of those online gangs, the “Trickbot” cartel.

Growing out of an earlier gang in Russia, the Trickbot Group used sophisticated malware and ransomware that the gang used to infect and cripple computer networks at places like schools, country clubs, and other businesses, culling those networks for bank information and demanding cash ransoms.

It was a lucrative enterprise, with the Trickbot gang estimated to have been pulling in hundreds of millions of dollars from victims around the country and around the world.

And now, to the surprise of the security media, a 55-year old woman had been arrested in Miami and was transferred to Cleveland while she awaits trial.

Her name is Alla Witte, she is originally from Russia and is now a Latvian national, and she had been living in Suriname for several years before she made an unwise trip to Miami, where she was apprehended.

The thought that the hacker stealing your passwords and disabling whole networks at schools and golf courses was a mild-mannered woman who looked like someone’s aunt or grandmother was obviously rather astonishing to the reporters covering the story.

“By every account, even from cybercriminals themselves, she’s just a nice human being,” wrote one security expert, who likened her to the gang’s receptionist, who had got caught because she was making simple security mistakes.

She’s now facing decades in prison, and according to a 61-page federal indictment, she was well aware of what she was doing for the Trickbot gang, developing web applications for the burglars that would make it easier for them to work their enterprise…

WITTE provided code to the Trickbot Group for a web panel used to access victim data stored in a database. The database contained a large number of credit card numbers and stolen credentials from the Trickbot botnet. This database also included a repository of information about infected machines available as bots. WITTE provided code to this repository that showed an infected computer or ‘bot’ status in different colors based on the colors of a traffic light and allowed other Trickbot Group members to know when their co-conspirators were working on a particular infected machme. On or about January 14, 2020, WITTE conducted internet searches for “laravel faker bitcoin address,” a reference to creating a fake Bitcoin address to use to test the ransomware payment system.

And from the Department of Justice’s press release about her arrest…

Witte worked as a malware developer for the Trickbot Group and wrote code related to the control, deployment, and payments of ransomware. The ransomware informed victims that their computer was encrypted, and that they would need to purchase special software through a Bitcoin address controlled by the Trickbot Group to decrypt their files. In addition, Witte allegedly provided code to the Trickbot Group that monitored and tracked authorized users of the malware and developed tools and protocols to store stolen login credentials.

She’s facing decades in prison if she’s convicted.

However, although numerous stories about Witte showed up in the security press, none of them mentioned that she had been a longtime Scientology Sea Org worker, and then had spent years as an “independent Scientologist” in a Europe-based network known as “Ron’s Org.”

We learned that because a few days ago, an interesting email was forwarded to us, put out by Ron’s Org leader Max Hauri, who appealed to his fellow independent Scientologists to raise money to bail out and support Witte while she’s waiting for trial.

From the beginnings of the Scientology movement in the early 1950s, there have always been fans of L. Ron Hubbard’s ideas who have split away from the official Church of Scientology in order to practice Scientology on their own. Variously known as “independents” or the “Freezone” and by other names of small groups and associations, there are about as many interpretations of Hubbard’s ideas in these groups as there are individuals. (And that’s something we’ve kept an eye on with our daily “Overheard in the Freezone” feature.)

But this is one of the more unusual things we’ve seen come out of the independent field. Here’s the bulk of Hauri’s letter, after a brief introduction of the situation…

Suriname is rather a poor country and it is difficult to make a living there esp. when you want to do the Bridge. Traveling to Europe already is expensive for them. Alla tried to make her living with programming and she unknowingly and unaware connected with the wrong people who hired her and she was programming some codes for a bigger program she didn’t knew what it was. So far an innocent job.

However this “company” was a criminal one and Alla was not aware what she was doing and hence an easy prey for the FBI. I have added a friend lawyer and he and I still don’t understand with what trick she was on 2 February 2021 brought to Miami where she got arrested for jail. Month waiting for the trial she was brought to Cleveland, Ohio, has been there in different jails and is still waiting for the trail. She has a public defender who told her the trial will be autumn 2021 but because of Corona and because of this and that nothing happened since.

From at least two people who got involved in to the case (one is my friend lawyer and is helping Alla a lot, all for free!) said she is having a good chance to get released on bail, and that she was on “the wrong time at the wrong place”. In the jail she is now she has very limited possibilities. It is even a problem to get some books to read. In a prison it would be much better.

The problem I face is that we don’t have money for her at all. I have no idea what the bail would be, and if released on bail she needs to have an apartment and needs to finance her day to day life. We calculated the second would be maybe max. $1600 per month.

Nothing is decided now. Even if she gets an OK to be released on bail it doesn’t need to be taken and she can go back to jail if she cannot make her living. Many things have to be cleared also regarding internet access as she is supposed to be a hacker. (But personally I know she is far from being a crack.)

My question is would you be willing to support Alla?

Right now I don’t ask for money but if she gets released I need to put it on many shoulders. If you say now yes, I would then come back to you.

If we do not receive enough pledges we will certainly not apply for bail and then say “sorry, we can’t afford it.”

If you want to support Alla please let me know how much you want to give once or monthly, or both.

And there is another important question: If anyone knows someone who could give her a place to stay in Youngstown or in the state Ohio that would reduce the monthly costs remarkably. Of course we have no idea within what range she has to stay to Cleveland or Youngstown.

Erica and I have had her living in our apartment several times and I can tell you that Alla she is easy going; I consider her certainly ethical and in-exchange. Of course she can help with house chores etc, but with her immigration status she is not allowed to work, paid or unpaid.

We sent an email to Hauri, asking him if he’d tell us more about Witte’s involvement in Ron’s Org, and to inquire about the response he’s received to his email.

We’ll let you know if he gets back to us, and if he’s heard anything about whether Witte can get out of jail while she’s awaiting trial.

What a strange situation.

---

Thank you for reading today’s story here at Substack. For the full picture of what’s happening today in the world of Scientology, please join the conversation at tonyortega.org, where we’ve been reporting daily on David Miscavige’s cabal since 2012. There you’ll find additional stories, and our popular regular daily features:

Source Code: Actual things founder L. Ron Hubbard said on this date in history

Avast, Ye Mateys: Snapshots from Scientology’s years at sea

Overheard in the Freezone: Indie Hubbardism, one thought at a time

Past is Prologue: From this week in history at alt.religion.scientology

Random Howdy: Your daily dose of the Captain

Here’s the link to today’s post at tonyortega.org

And whatever you do, subscribe to this Substack so you get our breaking stories and daily features right to your email inbox every morning…

---

Now available: Bonus for our supporters

Episode 3 of the Underground Bunker podcast has been sent out to paid subscribers, and it’s a conversation about the Scientology litigation we’re keeping a close eye on. Our LA correspondent Jeffrey Augustine helps us keep track of what’s going on in court right now. Meanwhile, we’ve made episodes 1 and 2 available to everyone, with Claire Headley exposing Tom Cruise, and Marc Headley on what it must be like for David Miscavige living in Clearwater, Florida. Go here to get the episodes!