Gollumfun SAME_AS Brett Johnson
Jack identifies Brett Johnson as the person known online as Gollumfun.
Explicit Confidence 99% · Jack Rhysider EP 128 Details
“Brett, or Gollumfun”
Threat actor
threat_actor:gollumfun
Also: Brett Johnson
Online alias used by Brett Johnson in criminal forums and chat communities.
Online alias used by Brett Johnson in criminal forums and chat communities.
“Brett was using the name Gollumfun on these online forums”
“Brett, or Gollumfun, was a moderator and admin of ShadowCrew”
Brett Johnson’s online criminal identity and forum alias, later used while he cooperated with law enforcement.
“Brett, or Gollumfun”
“the name Gollumfun will never be back”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | SAME_AS | Brett Johnson | Explicit | 128 |
| outgoing | USES | eBay | Explicit | 128 |
| outgoing | USES | PayPal | Explicit | 128 |
| outgoing | USES | ICQ | Explicit | 128 |
| outgoing | USES | Counterfeit Library | Explicit | 128 |
| outgoing | ASSOCIATED_WITH | Counterfeit Library | Explicit | 129 |
| outgoing | USES | social engineering | Explicit | 128 |
| outgoing | USES | social engineering | Explicit | 129 |
| outgoing | USES | carding | Explicit | 128 |
| outgoing | USES | Tax-refund fraud | Explicit | 128 |
| outgoing | USES | Database dumps | Explicit | 128 |
| outgoing | USES | California State Death Index | Explicit | 128 |
| outgoing | USES | keylogger | Explicit | 128 |
| outgoing | USES | ShadowCrew | Explicit | 128 |
| outgoing | ASSOCIATED_WITH | ShadowCrew | Explicit | 129 |
| outgoing | USES | Magstripe writer | Derived | 128 |
| outgoing | USES | Blank credit cards | Derived | 128 |
| outgoing | USES | Money mules | Explicit | 128 |
| outgoing | USES | Forum vouching and reputation system | Explicit | 128 |
| outgoing | USES | stolen credit-card fraud | Explicit | 129 |
| outgoing | USES | tax return identity theft | Explicit | 129 |
| outgoing | USES | counterfeit cashier’s checks | Explicit | 129 |
| outgoing | USES | controlled delivery | Explicit | 129 |
| outgoing | USES | prepaid debit cards | Explicit | 129 |
| incoming | OPERATED_BY | ShadowCrew | Explicit | 128 |
| incoming | SAME_AS | Brett Johnson | Explicit | 129 |
| incoming | MEMBER_OF | Albert Gonzalez | Derived | 129 |
Gollumfun SAME_AS Brett Johnson
Jack identifies Brett Johnson as the person known online as Gollumfun.
Explicit Confidence 99% · Jack Rhysider EP 128 Details
“Brett, or Gollumfun”
Brett says that finding eBay led him into further online criminal activity and that he used eBay for scams and sales.
Explicit Confidence 98% · Brett Johnson EP 128 Details
“that’s when I find eBay, and then eBay leads into all this other stuff”
“I was selling it all on eBay”
Brett says he used PayPal to receive payments and later committed PayPal fraud.
Explicit Confidence 99% · Brett Johnson EP 128 Details
“PayPal really becomes popular”
“We were pretty big on fake driver’s licenses, eBay, PayPal fraud”
Brett used ICQ to communicate with criminal associates and operate online relationships.
Explicit Confidence 98% · Brett Johnson EP 128 Details
“We also start talking on ICQ”
“we always talked on Sunday night on ICQ”
Gollumfun USES Counterfeit Library
Brett used Counterfeit Library as a forum for communicating with other criminals, learning scams, and conducting criminal commerce.
Explicit Confidence 98% · Brett Johnson EP 128 Details
“I get on the forum”
“I was pretty much friends with the people who run Counterfeit Library”
Gollumfun USES social engineering
Brett explicitly characterizes himself as a social engineer and manipulator while deceiving his wife and victims.
Explicit Confidence 99% · Brett Johnson EP 128 Details
“I was the social engineer and I was a manipulator”
Brett describes himself as a carder and participated in the credit-card fraud activity centered on Counterfeit Library and ShadowCrew.
Explicit Confidence 99% · Brett Johnson EP 128 Details
“A good carder – and I term myself a good carder”
Gollumfun USES Tax-refund fraud
Brett says he filed fraudulent income-tax returns for dead people and cashed out the resulting funds.
Explicit Confidence 99% · Brett Johnson EP 128 Details
“I started filing income tax returns, fraudulent income tax returns, on dead people”
Gollumfun USES Database dumps
Brett used database dumps found on ShadowCrew to search for information useful in opening accounts under other people’s names.
Explicit Confidence 96% · Brett Johnson EP 128 Details
“I started looking through these to see if there’s anything useful for me in that data”
“Sometimes I’d find some data to be able to open accounts under other people’s names”
Gollumfun USES California State Death Index
Brett says he obtained access to the California State Death Index and researched ways to exploit its information.
Explicit Confidence 99% · Brett Johnson EP 128 Details
“I got was the California State Death Index. So, I had access to that”
Brett placed keyloggers on a computer to monitor his wife’s activity.
Explicit Confidence 99% · Brett Johnson EP 128 Details
“I had placed key-loggers on the computer”
ShadowCrew OPERATED_BY Gollumfun
Brett became an administrator and later took over operation and ownership of ShadowCrew after Seth quit.
Explicit Confidence 99% · Jack Rhysider EP 128 Details
“Brett, or Gollumfun, was a moderator and admin of ShadowCrew”
“So, Brett took over shadowcrew.com”
Gollumfun USES ShadowCrew
Brett operated ShadowCrew as an online criminal marketplace and used it to coordinate carding and other criminal activity.
Explicit Confidence 98% · Jack Rhysider EP 128 Details
“Brett took over shadowcrew.com”
“ShadowCrew was a marketplace for illegal things”
Gollumfun USES Magstripe writer
Brett describes the carding operation’s use of magstripe writers to write stolen card data onto blank cards; the episode presents this as activity on the forums and by carders.
Derived Confidence 78% · Jack Rhysider EP 128 Details
“Counterfeit Library began exploding with chatter about how to get magstripe writers”
Gollumfun USES Blank credit cards
Brett describes carders writing stolen data onto blank credit cards for ATM cash-outs.
Derived Confidence 80% · Jack Rhysider EP 128 Details
“ways to write the data to the card”
“write them to blank cards, and then go to ATMs and cash out”
Gollumfun USES Money mules
The carding operation relied on money mules because the Ukrainian participants could not cash out the stolen card data themselves.
Explicit Confidence 90% · Brett Johnson EP 128 Details
“The Ukrainians simply could not put cash in pocket literally themselves, so they had to rely on money mules”
Gollumfun USES Forum vouching and reputation system
Brett participated in the forum’s seller-screening and reputation process, including reviewing whether sellers could operate on the site.
Explicit Confidence 90% · Jack Rhysider EP 128 Details
“all sellers had to be checked out by him before they could sell on the site”
Brett Johnson SAME_AS Gollumfun
Jack explicitly refers to Brett as Gollumfun, and the episode presents the two identities as the same person.
Explicit Confidence 99% · Jack Rhysider EP 129 Details
“Brett, or Gollumfun”
Gollumfun USES stolen credit-card fraud
Gollumfun is described as engaging in stolen-credit-card activity.
Explicit Confidence 98% · Jack Rhysider EP 129 Details
“ordering things with stolen credit cards, cashing out on stolen credit cards”
Gollumfun USES tax return identity theft
Brett says he repeatedly committed tax-return fraud and tax-return identity theft.
Explicit Confidence 99% · Brett Johnson EP 129 Details
“I was probably stealing – probably $20,000 a week doing that on tax return fraud”
Gollumfun USES counterfeit cashier’s checks
After ShadowCrew was shut down, Brett says he used counterfeit cashier’s checks to survive.
Explicit Confidence 99% · Brett Johnson EP 129 Details
“the only thing I’m left doing is running counterfeit cashier’s checks”
Gollumfun USES social engineering
Brett used social engineering to distract Secret Service agents during an apartment search and conceal illegal items.
Explicit Confidence 99% · Jack Rhysider EP 129 Details
“Brett tricked the Secret Service agents and took advantage of their trust to social engineer them”
Gollumfun USES controlled delivery
A controlled delivery was used to arrest Brett after he ordered food with stolen credit cards.
Explicit Confidence 99% · Brett Johnson EP 129 Details
“So they – it was controlled delivery. I go to pick up the steaks”
Gollumfun USES prepaid debit cards
Brett repeatedly used prepaid debit cards in connection with tax-refund fraud.
Explicit Confidence 98% · Brett Johnson EP 129 Details
“I take that $30 and I walk my ass to Walmart and I buy a prepaid debit card”
“I’ve got prepaid debit cards”
Gollumfun ASSOCIATED_WITH Counterfeit Library
Brett says Counterfeit Library was one of the criminal collaboration sites that enabled this type of fraud.
Explicit Confidence 95% · Brett Johnson EP 129 Details
“before those sites we were talking about, Counterfeit Library and ShadowCrew”
Gollumfun ASSOCIATED_WITH ShadowCrew
Brett says he posted tutorials on ShadowCrew explaining how to commit eBay fraud and walked people through it.
Explicit Confidence 99% · Brett Johnson EP 129 Details
“I remember clearly posting many tutorials on how to do this type of fraud on eBay, and even walking people through it”
Albert Gonzalez MEMBER_OF Gollumfun
Albert Gonzalez is described as a member of ShadowCrew; the catalog identifies ShadowCrew’s criminal-actor entity as Gollumfun.
Derived Confidence 72% · Jack Rhysider EP 129 Details
“He was a member on ShadowCrew and eventually became the forum techie”