Actually incredible cover of the overall story. I love your final thought "We do it for the love of the hunt, not for the thrill of the kill". I think it is rather easy to sometimes fall in these bad places because we are so deep in the "hunt" that we may think that the reward is the only thing that there is left. But there will always be a bigger and more amazing hunt.

John went dad mode for a second there. Kinda scary ngl

when John made direct contact with destroyer in the video, loved the seriousness and the stiff rightfulness on your face brother.

We want a collab between John and Jack Rhysider ❤️

This is proof not to mess with cyber security professionals. You literally found out everything!

This is a fantastic video and investigation!! Thank you to all involved.

in russian timoxa can be read as timoha, short for timofej(Тимофей)

I love the breakdown of this and would love to see more like it. Thanks John!

This is solid OSINT work from SkeletalDemise and foilman, and great reporting emphasizing the appropriate caveats to this work. This was very enriching educational content. One way I think it could have been moreso is if those caveats were explored and extended to their logical conclusions, as in explaining how if at any point the assumptions made were incorrect, how it could unravel the (very convincing) narrative, which for the record I believe. Great video, John!

Cool to see you covering this topic! I'm on my cyber security journey. I find all your videos super interesting! :)

I don't think I'd ever make content like this where I personally call out a threat actor and put my face to it; even just someone making game hacks. In any case, your heart seems in the right place and it made an interesting watch. Thanks for the video John. Stay safe.

Very interesting. Great covering of this.

Thank you John, I really enjoy all of your content. I must admit, I think of hacking in tournaments a bit like athletes using PED's in sports. In sports they utilize drug testing to try to deter those from using PED's and I equate that to online gaming using anti-cheat software in an attempt to deter cheating. Ultimately it is up to the developers to make sure the gameplay is secure as can be. You will always have those looking for the competitive advantage and we must do everything to combat that.

I thought Destroyer2009 stated that he did this specifically during a large event to force EA to fix the vulnerability?

In the end, even if you identify him, he's Russian, so you'll never be able to sue him

Keep up the good work* been watching you a long time: learning a lot".

It was so fun to watch John! Great investigation! :)

Maybe I missed something, but who confirmed that destroyer2009 actually did this whole thing? I might just be someone using their handle.

Curious, what website/service did you used at 9:33? I kinda want to search my own email with this.

what a fantastic video and an absolutely remarkable investigation - hats off! just a few clarifications on this topic from a native russian-speaking perspective: 1. timoxa is actually pronounced as timoha, with an accent on "o". it serves as a shorthand for the russian name Timofey. 2. it's essential to recognize that not everyone who speaks the russian language identifies as "russian" (with aprox. 380kk speakers worldwide). 3. this one is mostly related to the Mande's mistake (who made that inverview video) - dude explicitly stated "I'm Russian". it's worth noting that Belarus (as mentioned in the subtitles) is distinct from Russia. this distinction is further supported by your gmaps activity review, which only spotted locations in Russia. Belarus lies far away from the left pointer on the map.

As an apex legends player who grinds it a lot, thank you for making this video. Super entertaining and educational. I watched yours and pirate softerwares vids, so awesome!!! Ty Ty Ty❤️❤️❤️🔥🔥🔥

This just opened my eyes to how wildly easy it is to find this information

EA will probably never go into detail about what happened but there are interesting threads on UC on this topic going back to 2019.

after EA deleted my accounts for not logging in for a while because I did have internet at the time, and expect me to buy the games again, I'm siding with destroyer2009

Holy f, this was a beatiful job John. Thank youuu

Seems like he did a public service. This is how you get big companies to make changes. I'm still interested to know if the 2 affected gamers are squeaky clean or not.

Yessss thanks for doing this!

Hacking video games should be allowed in dedicated cheater-allowed servers. Hackers will not disappear by just saying it's not allowed. This would allow hackers to have fun, and the game developers to try to fix exploited bugs. Cheating in competitive games will always happen, so the developers needs to keep up with the hackers on detection software.

I mean a witch hunt and potential dox or an 18 yo kid is not really worth bragging about. As you said yourself he did it for the shits and giggles and not to gain any monetary income, if your game's security is so bad that an 18 yo can execute server-side commands and give streamers in-game currency and packs you should be happy that all they choose to do is play a stupid prank on a tournament instead of capitalising it to ruin the game. Corporations are not your friends.

You know what you the best? Because you talk slowly and explain from zero, thank you❤

had fun watching the stream with PS, gotta ask him for more colabs lol. and as usual, great video.

John Hammond covering this story? Im intrigued.

How did you get access to the data breaches that had his information? Are those publicly available?

The thing is that apparently these hacks have been going on for quite a while. Apex doesn't seem like they actually want to patch the bugs

thanjs Joe Cyber

Knowing how his hack worked, would be fascinating 🤨

great investigation !

Honestly this wouldn't be an issue in ALGS if they had the tournament on a LAN and then streamed from another PC that isn't directly connected to the game somehow and would make the game more fair due to connection issues.

When John H. joined Thor (PirateSoftware) and said: "OH I guess this is just going to be a talk" ... at that point, I knew this video was around the corner.

Props to foilman and demise for figuring all this out, fantastic detective work

I did not know I wanted a true crime like thing for cyber sec... but now I need it.

bros gone track him down to the last thing he has eaten

Hands down favorite part was the discord conversations and making your avatar an Anime avatar 😂 why did you choose to do that?

Timoxa watching this video:

it's hard to believe that there was no motivation other than for the lulz. I mean i understand that, as a kid I was oppening my friends CD rom on LAN using some trojan for the lulz, but that was against a friend and very innocent in comparison to this apex hack.

If these big game companies don't wanna listen about cve, then they get burned by hacker's memory foam.

Great work to the two guys spending time on this, it’s not always fun and a lot of resources and time goes into it. Also don’t forget - Don’t fact drive (dive) under the influence of speculation 😊 OSINT’ers only real hangover 😅

are you not making the xz video ?

Having bad opsec and then there's an osint investigation: "That man is playing Galaga. Thought we wouldn't notice, but we did" (Avengers)

I don't think he deserves to be doxxef

he's probably (& rightfully) proud of his achievements. kid has skills

Personally any type of hack that is used to gain advantage over the normal person should be a crime, whether you are the buyer or the seller, it should be treated the same. its to easy for kids these days to pick up a cheat and run with it coz whats the worst that can happen in most games? you get banned, start a new account and just continue. if the youth start to learn that your decisions and actions have actual lawful repercussions then they might think twice before doing this shit. Thank you very much for the video, i just subscribed

Russian is not the only language that is written with the Cyrillic script. It can be perfectly Belarusian language.

I used to play OSINT ctfs but had to quit because of school, but man this video makes me want to get back into it

This was a great video but my real question is... picoCTF 2024 series? 👀🤣

This video was so good, it felt like 5 minutes :D

Do we know if like he possibly used some cross site scripting? I’m not like full immersed into Coding and Such but I did understand that, cross site scripting I wasn’t sure if it would have anything to do with it

love to see how the hacks actually work. like an overlay on just that users machine?

Judging by the way he speaks russian - he's not from russia, based purely on his accent he's either from belarus or ukraine, and since he said he's from belarus, I would be inclined to believe that I guess

What games do you play John

He's probably open about this because game hacking isn't as serious as stealing user data or money, etc. I've never heard of a cheat dev being arrested

can we get some timestamps John? thank you

I mean, we can't do anything, but other Russians can. Lol

The moment that Regulators or Federal law makers touch gaming or online gaming is the moment it dies. BT

The video covered one image saying the IP connection was through a RAT so does that mean they SSH into their PCs from obtaining their IP before the live tournament, or did the end user downloaded something before hand?

If someone manages to get their hands on destroyer, I'm really torn between offering them a position in an internal offensive security team for either EAC/Apex and enforcing punishment

You’re amazing 🙌🏾

Has it been ruled out that the players weren't using cheats created by Destroyer/Temoxa containing a backdoor and he just trolled them hard publicly? It seems strange that a global event involving millions of dollars in prize money isn't being conducted on private servers on a segmented network. Or are multimillion dollar gaming tournaments just hosted on public internet where they can be hacked by anyone? Is that because the servers always have to be connected to the internet for dynamic anti-piracy/anti-cheat stuff? I guess it doesn't matter anyway, cause cheaters are gonna cheat and hackers gonna hack. Unless you fully lock down tournaments with segmented networks, no external devices allowed and player searches it's going to keep happening.

No video on the xz backdoor hack yet?

sir my Gmail account has been recently hacked which was linked with youtube so how could i recover it can you please help me in doing this

Well, as far as I am aware, he hasnt broken any laws. The guy is cheating at video games FFS.

as someone with over 1k hours in apex im glad he hacked the game because he proved that respawn and EA dont care about the game or people playing the game when the hack happened they put out a sale in the in game shop to say sorry who the fuck cares we dont feel safe having our banking info on the game anymore I am happy he did this and i hope he does it again to stop a mega billion dollar corparation form exploiting their players

I know it’s cliche to say but he had to be smarter than this regarding his cyber trail right? Why wouldn’t he go through a transfer/offloading phase for all of his work and potential PII?? And we all have multiple emails, accounts, etc…. Once he was done preparing his attack or developing it, he should have isolated and masked all of the potentially identifiable information for ANY entity involved while falsifying things like locations, IPs, VMs etc. Also seems that Destroyer2009 understands his position in Russia is beneficial for hacking purposes to say the least..

This is a masterclass in OSINT

bro's email is the most obvious thing a hacker would guess

very good I will be waiting for the report on doxbin

whoever done the osint that guy is beast

I think what he did is exposing most of corporation or game ondustry of how their games pretty much has lot of security exploits on it

btw, that alphabet is Cyrillic, it's the alphabet used for Russian, but it's not only for Russian.

John Wick, when does he get on board?

Although I agree with the general outlook has what he did was incorrect, I wouldn't go as far as consider this kid a malicious threat actor. Honestly he's a bit more of a hacktivist if anything. His actions brought out a huge spotlight to a pre-existing, much larger issue that EA (Respawn) have continually failed to address with any level of efficacy. There has been, and continues to be, a ridiculously rampant hacking problem in Apex Legends. It is the most apparent in the highest ranked bracket (predators) where they all tend to congregate once ranks have stabilized. out of probably sheer desperation, players of apex have gone as far as dig into the anti-cheat system and found that Apex Legends uses the cheapest anti-cheat plan possible with EAC. from the outside looking in which is the sentiment that a lot of their dedicated playerbase feels, it appears that EA just doesn't really care and is so behind on taking action that their efforts just simply aren't effective. this, in conjunction with the outlandishly priced cosmetic items in the game that release frequently and on a strict schedule, maddens the community to no end. if this kid is trying to embarrass EA and expose their MO, honestly I feel like he's done a pretty good job at achieving his goals. he's caused some pretty tangible reputational damage.

He's Kristimoxa, AS WRITTEN! Apex Al-Ghaib!

Apex should discipline the hackers. But not with jail time, or fines. Block access to all their Servers for the Hackers. What Apex now should do, is learn from that mistake and upgrade their security, ASAP.

Honestly on one hand I hate cheaters. However on the other hand if doing so in such a public way forces EA's hand into putting resources behind fixing the cheating problems in Apex, I'm for that.

5:45 There is a high probability that Timoxa is a name derived from shortened russian name Тимоха pronounced as Timokha. It might indicate that the guys full name is Timofey which is Тимофей in russian.

I take the old gamer stance... GET GOOD! Security just needs to step up.

I just thought I would say this, when you said it was just for kicks, that is only partially true. While I am sure he did do it for fun, the other reason for him pulling off these large super public hacks was to raise awareness of how terrible ea's anticheat is as cheating has been a huge issue in the apex legends scene recently. In higher ranked lobbies, you run into cheaters so often.

You hear about the XZ utils backdoor yet?

I 100% agree that this is cybercrime, gaining unauthorized access to systems and also cyber disruption. The way the person executed their hack on a live stream fully knowing it would be exposed to millions of people says it all, their intent was to get attention and "credibility" for their action. This being exposed to the public would and could just bring more harm to the people involved, nothing ethical or morally correct about it.

You could argue that exposing their shitty security to the world is a good thing, but yes there are better ways to do it

Im glad he cant get caught. Its EA fault for running a 5 mil tournament with bad security. Thats negligent, plain and simple. Yes he did damage, but in the way I would do damage to my muscles to make them stronger.

11:16 how do you know youtube channel's google account's email?

You juz gave how to do real time analysis for free there But that’s was juz classic!!

Man, I kind of feel like pulling the kid behind me, putting my hands forward and say "hey hey, chill the fuck out guys".

Good intention? There is one. EA should fix their shit and not be that greedy

I applaud this guy for showing how much work anticheat needs to a larger community. Timoxa is a hero for trolling these publishers with the garbage regular players deal with every day. EAC is a joke right now.

As someone who does security for a living, I can't say that I blame the hacker. Sure, they did the hack and it caused problems, but the issue is about that they shouldn't have been able to do the hack in the first place. You're always going to have to deal with threat actors, but they only exist because of the holes in the security.

John Hammond

Lmao I love you John 🐐 you’re like the Liam Neason of the cyber security and the other 2 researchers ofc

18:47 I can’t beleive Respawn as a company can’t sue him For doing that that’s crazy.