WASHINGTON — Digital sabotage had knocked a Somalian news website and email accounts offline in August.
"I can still feel the frustration," reporter Abdalle Ahmed Mumin told Reuters. "Our link to the outside world, to the international media, is our website."
It was only after getting help from Qurium, a Swedish nonprofit that does digital defense work for news organizations and nonprofits, that Mumin was able to get his site back on its feet.
When Qurium investigated, it eventually traced a source of the outage to a surprising place: Wyoming.
Although Qurium said it wasn't able to get to a lock on who pulled the trigger on the cyberattack, it did discover that the sabotage was carried out with the help of a limited liability company based out of the vast western state.
Reuters has found it was one of at least three instances in the past four months in which digital defenders have implicated Wyoming LLCs in high-profile hacking activity. Interviews with half a dozen tech and compliance experts and hacking victims like Mumin suggest that the state once known as the rugged refuge for 19th-century bandits is now catering to 21st-century outlaws.
"It's the virtual Wild, Wild West," said Sarah Beth Felix, who runs Palmera Consulting, an anti-money laundering advisory firm. She said the state made registering anonymous shell companies so easy that foreign crooks "don't have to be physically in Wyoming to hide out in Wyoming."
Joe Rubino, the general counsel for the Wyoming Secretary of State's Office, which is responsible for registering the state's business entities, said his colleagues were taking the information flagged by Reuters "for further review and investigation."
He added that Wyoming's Secretary of State, Chuck Gray, supports the idea of new laws "to prevent abuses of Wyoming's corporate filing system by foreign entities" but that the state legislature had yet to take the matter up.
Wyoming isn't alone in allowing anonymous shell companies — Delaware and Nevada have similar offerings — but Qurium said hackers particularly favored Wyoming LLCs because they were advertised as cost-effective and user-friendly.
'Brazen and direct attack'
The act of cyber sabotage that knocked the Somali Journalists Syndicate offline in August is known as a distributed denial of service, which clobbers targeted sites with a firehose of malicious traffic.
Experts say a single shell company can serve as the springboard for widespread abuse.
In 2017 a pair of cybersecurity researchers traced waves of digital break-ins and spam targeting a host of organizations to an online proxy service run by Russian IT entrepreneur Ilia Trusov.
Despite the public exposure — and a subsequent report by Qurium also tying him to denial of service operations — Trusov registered two Wyoming LLCs, Security Servers and Traffictransitsolution, in 2019.
In video calls with Reuters, Trusov said the allegations were unfair. He said he had no tolerance for cybercrime and often worked with police agencies to fight it. He flashed his passport and U.S. and European visas as proof that he wasn't trying to mask his identity and had never been in trouble with the law.
Trusov did acknowledge setting up shell companies in Wyoming so that his clients' web traffic would look American. He said having a U.S. shell company was also helpful in terms of fielding legal requests. Another bonus: anonymity.
"In Wyoming, you can't go and check owners," he said.
Trusov's LLCs have since been dissolved, but another Wyoming shell company has faced scrutiny more recently.
In August of this year, the anti-ransomware firm Halcyon accused an Iran-linked internet company called Cloudzy of providing services to "a rogue's gallery" of digital spies and cybercriminals, in part through Sheridan-based RouterHosting LLC.
Cloudzy chief executive Hannan Nozari denied turning a blind eye to malicious activity, which he said was "a serious problem all of us face." He told Reuters he was based in Dubai and registered RouterHosting under the mistaken assumption that he needed it to buy internet infrastructure in North America. He said he had recently enhanced his service's security and had the Wyoming company dissolved.
As foreigners living abroad, neither Nozari nor Trusov nor Khan would have been able to set up Wyoming LLCs were it not for registered agents.
RouterHosting was set up with the help of a Sheridan-based registered agent called Cloud Peak Law Group. Aliat, HostCram and Trusov's LLCs were represented by a firm called Registered Agents, which also lists a Sheridan address.
Cloud Peak didn't respond to questions. Registered Agents said in a statement that, while the company didn't comment on specific client relationships, it followed relevant state rules and due diligence requirements.
"Commercial registered agents are not policing agencies," the company added.
Mumin, the head of the Somali journalists' syndicate, said no one had been held accountable for the cyber sabotage that crippled his organization in August. He had no sympathy with the notion that Wyoming's registered agents weren't required to police their clients.
"They should be ashamed, these companies in Wyoming, that they haven't been able to — or they don't care to — check who their customers are," Mumin said.
