Woman Admits Hiring a Hitman on the Darkweb
~4 min read | Published on 2019-08-21, tagged Murder-for-Hire using 870 words.
Yanyan Lesser pleaded guilty in a New York federal court to attempting to hire a hitman over the darkweb to put her ex-boyfriend in a wheelchair. According to information revealed in court, Lesser had paid the fake “murder-for-hire” site $7,000 in Bitcoin before Homeland Security Investigations Received a tip and launched an investigation into the Lesser.
The investigation began in February 2019 after the Homeland Security Investigations Field Office in St. Paul, Minnesota, “received information” from an undisclosed source about Lesser. This tipster, in February, sent HSI information about a user on a murder-for-hire website identified as “Tree1.” Tree1 had conspired with the operator of the website to “commit a crippling assault” of a target in Florida, Special Agent Charles Tolias wrote in the criminal complaint.
As usual, the investigators had access to the messages between the subject of their investigation and the purported hitman. These murder-for-hire sites–all set up by the same scammer–have a vulnerability that allows a certain cybercrime researcher to record the conversations between the scammer and his customers. Law enforcement could have received the chat logs from the researcher in question. But law enforcement themselves could have backdoored the site in question and obtained the messages without outside assistance.
Below is a sample of the messages sent from Tree1 to the purported hitman.
Because of a business dispute, I would like to give this guy a lesson:give him a good beating and legs broken, waist broken and even cripple the mark of his legs.It need to be looks like a robbery, looks like To rob of his money or property,NOT looks like revenge.
Please give him a good beating and let he always walk in wheelchair. Looks like a robbery his money, NOT revenge! That’s very important!
I will add $2500 more to cover the cost of beating, crippling and robbery look like job. Please remember must be looks like a ROBBERY! That’s very important! So that’s better without his house and community,not into his house to do the job.and also beating with crippling of his legs, no broken ribs because I won’t make he die. Just make sure that his legs will be crippling. Make sure do the job 100% with beating,crippling and robbery looks like a job! After jobs down and I make sure everything was perfect! will be pay full cost to you guys, If looks not like a robbery then I won’t pay full price
On February 16, 2019 Tree1 sent 1.26 Bitcoin to a Bitcoin wallet controlled by the scammer behind the murder-for-hire website. On February 19, the user sent another .694 Bitcoin to the same wallet. In addition to the Bitcoin transfers, the user provided a picture to the website owner of the target with the words “broken waist” written across the picture.
Based on the information Tree1 had provided the website, HSI identified and located the person Tree1 had targeted. On February 20, 2019, HSI Orlando interviewed the would-be victim at his house in Orlando, Florida. “He believed that his ex-girlfriend, Yanyan Cui, residing in Buffalo, New York, would be capable of doing something like this as she is unstable,” the Special Agent wrote in the criminal complaint. The ex-boyfriend gave investigators a name and phone number associated with his ex-girlfriend.
Investigators learned that Yanyan Cui still user her married name, Lesser, on official and legal documentation and registration. A DHS Summons to Verizon for the subscriber data associated with the phone number from Lesser’s ex-boyfriend provided law enforcement with accurate subscriber information under her married name.
A few days after investigators visited the ex-boyfriend in Florida, U.S. Customs and Border Protection (CBP)–another law enforcement branch of the Department of Homeland Security–stopped Lesser at a port of entry after she had traveled to Canada for lunch. CBP, aware of the investigation, alerted an HSI Special Agent of her presence. HSI arrived and interviewed Lesser. She gave them access to her phone (but would not give them her password).
See Also: Guilty Verdict Rendered in SLO Murder-for-Hire Case
A review of the home screen by SA Tolias revealed what appeared to be a TOR application as well as a VPN application. […]
HSI Special Agent Tolias conducted a preview of photographs contained on Lesser’s iPhone and saw what appeared to be the image of the unknown individual’s lower back area with the words “broken waist” written across it (as previously detailed above in paragraph. SA Tolias noted that it appeared to be the same exact photograph of the unknown individual’s lower back area, but that the photograph did not have the words “broken waist” written across it.
The iPhone screen then locked and law enforcement lost access to the contents on the phone.
After receiving a search warrant, investigators searched Lesser’s house and devices again. They found receipts that matched the bitcoin payments made to the murder-for-hire website. They also found text messages between Lessor and exchanges from Localbitcoins.
The investigation resulted in an arrest in March 2019 and subsequent guilty plea for one count of transmitting in interstate or foreign commerce a communication containing a threat to injure another person. The charge carries a maximum penalty of five years in prison.
Archived Press Release
The investigation began in February 2019 after the Homeland Security Investigations Field Office in St. Paul, Minnesota, “received information” from an undisclosed source about Lesser. This tipster, in February, sent HSI information about a user on a murder-for-hire website identified as “Tree1.” Tree1 had conspired with the operator of the website to “commit a crippling assault” of a target in Florida, Special Agent Charles Tolias wrote in the criminal complaint.
Besa Mafia is one of many scam sites the so-called hitman established on the darkweb.
As usual, the investigators had access to the messages between the subject of their investigation and the purported hitman. These murder-for-hire sites–all set up by the same scammer–have a vulnerability that allows a certain cybercrime researcher to record the conversations between the scammer and his customers. Law enforcement could have received the chat logs from the researcher in question. But law enforcement themselves could have backdoored the site in question and obtained the messages without outside assistance.
Below is a sample of the messages sent from Tree1 to the purported hitman.
Because of a business dispute, I would like to give this guy a lesson:give him a good beating and legs broken, waist broken and even cripple the mark of his legs.It need to be looks like a robbery, looks like To rob of his money or property,NOT looks like revenge.
Please give him a good beating and let he always walk in wheelchair. Looks like a robbery his money, NOT revenge! That’s very important!
I will add $2500 more to cover the cost of beating, crippling and robbery look like job. Please remember must be looks like a ROBBERY! That’s very important! So that’s better without his house and community,not into his house to do the job.and also beating with crippling of his legs, no broken ribs because I won’t make he die. Just make sure that his legs will be crippling. Make sure do the job 100% with beating,crippling and robbery looks like a job! After jobs down and I make sure everything was perfect! will be pay full cost to you guys, If looks not like a robbery then I won’t pay full price
On February 16, 2019 Tree1 sent 1.26 Bitcoin to a Bitcoin wallet controlled by the scammer behind the murder-for-hire website. On February 19, the user sent another .694 Bitcoin to the same wallet. In addition to the Bitcoin transfers, the user provided a picture to the website owner of the target with the words “broken waist” written across the picture.
Based on the information Tree1 had provided the website, HSI identified and located the person Tree1 had targeted. On February 20, 2019, HSI Orlando interviewed the would-be victim at his house in Orlando, Florida. “He believed that his ex-girlfriend, Yanyan Cui, residing in Buffalo, New York, would be capable of doing something like this as she is unstable,” the Special Agent wrote in the criminal complaint. The ex-boyfriend gave investigators a name and phone number associated with his ex-girlfriend.
Investigators learned that Yanyan Cui still user her married name, Lesser, on official and legal documentation and registration. A DHS Summons to Verizon for the subscriber data associated with the phone number from Lesser’s ex-boyfriend provided law enforcement with accurate subscriber information under her married name.
A few days after investigators visited the ex-boyfriend in Florida, U.S. Customs and Border Protection (CBP)–another law enforcement branch of the Department of Homeland Security–stopped Lesser at a port of entry after she had traveled to Canada for lunch. CBP, aware of the investigation, alerted an HSI Special Agent of her presence. HSI arrived and interviewed Lesser. She gave them access to her phone (but would not give them her password).
See Also: Guilty Verdict Rendered in SLO Murder-for-Hire Case
A review of the home screen by SA Tolias revealed what appeared to be a TOR application as well as a VPN application. […]
HSI Special Agent Tolias conducted a preview of photographs contained on Lesser’s iPhone and saw what appeared to be the image of the unknown individual’s lower back area with the words “broken waist” written across it (as previously detailed above in paragraph. SA Tolias noted that it appeared to be the same exact photograph of the unknown individual’s lower back area, but that the photograph did not have the words “broken waist” written across it.
The iPhone screen then locked and law enforcement lost access to the contents on the phone.
Text Messages Between Lessor and an Exchanger on Localbitcons.
After receiving a search warrant, investigators searched Lesser’s house and devices again. They found receipts that matched the bitcoin payments made to the murder-for-hire website. They also found text messages between Lessor and exchanges from Localbitcoins.
The investigation resulted in an arrest in March 2019 and subsequent guilty plea for one count of transmitting in interstate or foreign commerce a communication containing a threat to injure another person. The charge carries a maximum penalty of five years in prison.
Archived Press Release
