How a Nigerian influencer, North Korean hacker and Canadian scammer committed fraud worldwide
A giant, gleaming palace of luxury overlooking the Dubai Creek, the Palazzo Versace is fighting hard to be one of the world’s most glamorous hotels – a place where every meal is snapped for Instagram, and the rubbernecking for celebrity guests never stops.
An entry-level room here costs a few hundred pounds a night. Or you can rent an entire suite for a thousand or so. But for those with stratospheric budgets there’s an even more opulent option: a year-long tenancy. The uber-wealthy can make the Palazzo their permanent home.
In June 2020, one such resident was Ramon Olorunwa Abbas. As the 37-year-old Nigerian sat on his Versace sofa and gazed at his wardrobes full of Fendi clothes and Gucci shoes, Abbas probably felt the warm glow of a man who’d climbed the mountain of wealth and now sat at its peak, gazing down.
Then the door burst open. A team of armed Dubai police officers wearing ski masks and body armour rushed inside, grabbing laptops and phones, photographing and bagging everything they found. Abbas stood in the middle of it all, his arms pinned by a black-clad police officer. On his face was the look of a man suddenly remembering all the bodies he’d climbed over to get to the top.
It was the dramatic denouement of a rags-to-riches tale that had taken Abbas on a wild journey, from the depths of poverty to a powerful role as a criminal mastermind working with one of the world’s most dangerous regimes. Then it all came crashing down.
Abbas was born on 11 October 1982 in Bariga, a poor area of Lagos. Like many smart youngsters in Nigeria at the time, he struggled to gain steady employment. He joined the ‘Yahoo boys’ – the small but increasingly powerful minority of Nigerians who’d turned to online scamming to make ends meet. Abbas’s future lay far beyond the country, however, and his fate would be intertwined with that of a man living thousands of miles away.
Ghaleb Alaumary was born two years after Abbas into a world which could not have been more different to the Nigerian’s.
Alaumary lived with his family in Montreal, Canada, where they owned the eight-bedroom property Château Olivier. From its back garden (complete with hot tub), a private entrance led directly into a lush public park. As Abbas was dodging Lagos’s grinding traffic, Alaumary could simply open his back gate and disappear into the greenery.
By 2009, however, Alaumary’s privileged life had started to go off the rails. After a string of relatively low-level fraud and credit-card crimes he moved online and discovered the dark web, a hidden corner of the internet, where he offered his financial crime services to other cybercriminals. The underworld nickname he chose for himself demonstrates his hubris: Alaumary became ‘Big Boss’.
He wasn’t the only one reinventing himself. Ramon Abbas was also forging an online persona. In Abbas’s case, however, his emergence into a new identity would take place under the full glare of social media. In 2012 he created the Instagram account through which millions would come to know him – like Madonna or Prince – by just one name: ‘Hushpuppi’.
He would go on to ascend the ranks of the social media influencers – amassing hordes of online followers by constantly posting photos of his increasingly glamorous lifestyle, hanging out with Premier League footballers and splurging cash on luxury goods. But behind the scenes, in tandem with his public persona, Abbas’s secret fraud career was growing to become a multimillion-dollar enterprise.
By 2017, Abbas had moved to the location that would become not only the perfect canvas for the ever-increasing promotion of his wealth, but also the scene of his greatest crimes: Dubai, and the glitz of the Palazzo Versace.
From the outside, he looked like the ultimate social media influencer success story. In reality, his extravagant lifestyle was funded by crime. He hadn’t left behind his roots as a scam artist – he’d just got better at hiding them.
Meanwhile, Alaumary’s criminal aspirations were growing.
In 2017, MacEwan University in Edmonton, Canada, was undergoing a major refurbishment, and bills and invoices were flooding into its finance department. On 27 June an email arrived, apparently from one of the contractors, requesting payment into a new account. The email was a fake, sent not from the contractor but from a fraudster. The bank account belonged to Ghaleb Alaumary. The university was conned out of a million Canadian dollars, which Alaumary duly laundered. Thanks to schemes like this, Alaumary – under his dark web identity Big Boss – was becoming a big-time crook. But a lucky break for the police was about to put them on his trail.
In November 2017 the US Secret Service arrested a man who’d been caught trying to fraudulently claim a loan at a bank in Dallas, Texas. He was questioned by an agent named Glen Kessler. He explained to Kessler that he’d been recruited by a fraud gang to impersonate victims and try to take out loans in their names. As he talked, the story got wilder. He told Kessler that the gang involved a global conspiracy of players, including a nation state. Kessler was sceptical. ‘It just seemed very far-fetched,’ he says.
Nonetheless, the Secret Service put the gang under surveillance, and discovered that much of the work was being controlled by someone who went by the nickname Ockie. He organised travel and accommodation for the identity thieves, and supervised their illicit work.
Ockie was extremely careful to disguise his identity. But finally, after almost a year of working, the Secret Service got a breakthrough: a photo of a credit card Ockie had sent to one of his accomplices. He’d made a slip-up: one of his fingers was visible in the shot. They sent it to the forensics lab. Incredibly, they managed to pull a fingerprint. They compared it to the US national criminal database and came back with a match. The name on the file was Ghaleb Alaumary.
But Alaumary was in Canada, beyond the Service’s jurisdiction. They would have to sit and watch him, waiting for their chance. They could not have predicted what would happen next. Big Boss was about to become a key money-laundering accomplice in a giant cybercrime campaign by one of the world’s most terrifying countries.
In August 2018, hundreds of people across the globe, from the US to the UK, Turkey to Japan, set out on a secret mission. Walking from cashpoint to cashpoint, they each used a stack of ATM cards to withdraw as much money as they could. The ATM cards did not belong to them. Neither did the cash. It was the proceeds of a carefully orchestrated hack. This network of ‘money mules’ pulled out $16.3 million in 12,000 withdrawals across 28 different countries. It took two hours and 13 minutes.
The ATM cards were linked to accounts at an Indian bank called Cosmos Co-operative. Over the preceding months, the bank had been infiltrated by some of the world’s most effective hackers, who had squirrelled their way into its ATM software, giving them power to authorise any cashpoint withdrawal made using a Cosmos bank card, anywhere in the world. But before they could use this extraordinary power, they needed two things: a stash of Cosmos cards and a network of people to take them to cashpoints. And that’s what led them to Ghaleb Alaumary.
Word of his growing abilities had spread, and after the hackers penetrated Cosmos Bank, Alaumary had started getting requests for assistance from someone who went by the pseudonym Sweet. Sweet wanted Alaumary to help create ‘cloned’ cards attached to Cosmos accounts and coordinate a network of people to use the cards at ATMs in North America. Sweet was setting up similar operations in more than two dozen other countries.
Alaumary’s work clearly impressed Sweet. A few months later they worked together to raid BankIslami, a Pakistan-based institution, hitting it with a similar ATM hack and pulling out $6.1 million.
Sweet had not revealed his identity, but through their online chats, Alaumary discerned that his hacker accomplice was in a country considered hostile by the US. In fact, Sweet’s homeland was not just an adversary of America, but its sworn enemy: North Korea.
Thanks to its belligerent pursuit of nuclear weapons and missile technology, North Korea is now subject to rigid sanctions isolating it from international trade and finance. According to US researchers, the United Nations and various tech security firms, part of North Korea’s solution to this economic straitjacket has been to task its government hackers with stealing money. (The North Korean regime has consistently denied any connection to cyberattacks, calling them a ‘smear campaign’ by its enemies, notably the Americans.)
According to the US government, Sweet is a key member of a state-led computer-hacking team known as the Lazarus Group which conducts these cyber heists. They claim his real name is Kim Il, and that he and the Lazarus Group were behind the hack on BankIslami and ‘another incident in 2018’ when ATMs were raided in two dozen different countries – widely believed to be a reference to the hit on Cosmos Co-op Bank.
Thanks to his work on those heists, the hackers now requested Ghaleb Alaumary’s help for another scheme. And this time a switch in tactics would bring Ramon Abbas, aka Hushpuppi, into the game.
In early 2019, the Lazarus Group hacked into the Bank of Valletta, one of Malta’s key financial institutions. Instead of the ATM network, they targeted the bank’s SWIFT system, the software used to make transfers between financial institutions. SWIFT is a tempting target for thieves as it can be used to move millions, but it has a drawback: the transfers leave a trail, meaning transactions can potentially be stopped or reversed. To prevent this, the hackers needed accounts through which to move the money quickly, making it harder for investigators to claw back.
Sweet dialled up Alaumary. Did he know anyone who could help? Alaumary knew exactly who to ask, thanks to his dark web money-laundering contacts: a man listed in his iPhone contacts only as ‘Hush’. Thousands of miles away in Dubai, Ramon Abbas’s phone pinged into life.
On 16 January 2019, a message from Alaumary arrived on Abbas’s phone asking if he could provide bank accounts to receive millions of euros from the impending raid on the Bank of Valletta. Abbas didn’t hesitate, replying with details of two accounts which he said could be used for ‘large amounts’. Hushpuppi was now working alongside Alaumary and Sweet. It was to become a highly lucrative but ultimately ruinous triangular relationship.
On 12 February, the hackers began using their viruses to pull out money via SWIFT transfers. Alaumary texted the good news to Abbas: ‘We did it. 500k euro. Should be on ur side by now.’ And the hack wasn’t over yet. Alaumary texted: ‘Brother, we still have access and they didn’t realize, we gonna shoot again tomoro am.’
But the hackers’ machinations were causing chaos inside the bank’s networks. Shopkeepers in Malta started experiencing problems taking payments with the machines issued by Bank of Valletta. Then the bank’s cards stopped working in shops and restaurants. By the next day, the bank had discovered the hack and began to claw back the money.
‘Today they noticed and pressed a recall on it,’ Alaumary wrote.
Abbas’s reply was brusque: ‘damn’.
‘To[o] bad they caught on or it would been a nice payout,’ wrote Alaumary.
Clearly, the money-laundering duo were disappointed with their take from the hack. Alaumary, however, was undaunted. As the Malta job petered out, he messaged Abbas: ‘Next one is in few weeks will let U know when it’s ready.’ With Abbas’s accounts apparently able to wash millions, Alaumary could work with his fraudster accomplices to target even more victims for even greater profits; he told Abbas of a scheme to defraud a Premier League football club of £100 million.
All the while, Abbas continued his double life as Hushpuppi, hitting the shops with Premiership footballer Benjamin Mendy, then flying off to Paris Fashion Week to attend a Louis Vuitton show. And despite his frustration over the Bank of Valletta heist, Abbas clearly saw Alaumary’s potential as a profitable accomplice.
Towards the end of 2019, the pair got together to pull off what should have been a nice, neat job. No North Koreans, no complicated bank hacking, no international accounts. Instead, it would be a small crew, hitting a juicy target with a straightforward scam for a fat sum of money, with the profits all laundered through North America. But things would turn out very differently. Unknown to Abbas and Alaumary, this would be their final job together.
In October 2019, a law firm in New York state was working with a client to set up a refinancing deal for their property. The firm was about to send almost $1 million of the client’s money to their bank. But unbeknown to the law firm, they had been targeted by scammers working with Abbas and Alaumary. Using a similar email address to the bank’s they tricked one of the employees into corresponding with them, rather than the bank. Instead of sending the money to the client’s account, she sent the $922,857 payment to the crooks. Alaumary and Abbas were braced to launder the money. Finally, after all the snags and misfires, this promised to be a successful collaboration.
Abbas texted Alaumary: ‘Money came in?’
‘Yes,’ replied Alaumary.
‘Give me a screenshot,’ demanded Abbas. Alaumary said he couldn’t – he’d just landed from a flight, and his Wi-Fi signal wasn’t strong enough – but promised confirmation soon.
So Abbas waited, patiently biding his time for news. But the screenshot never came. Because minutes after his plane landed, Alaumary was standing in Atlanta airport, his wrists cuffed, surrounded by Secret Service agents. The agency’s years-long waiting game had come to an end.
Ever since they’d first exposed Alaumary as the real face of Ockie back in 2017, the Secret Service had been painstakingly tracking his movements, waiting for their chance. They discovered that the Canadian was planning a birthday break at the luxurious Atlantis resort in the Bahamas at the end of 2019. It offered the perfect opportunity to capture him.
Shortly before Alaumary was due to arrive, a small Secret Service team had flown to the Bahamas. They waited nervously. Despite all the preparations, no one was quite sure how it would go down. Meanwhile, agent Glen Kessler was getting ready to fly in from Atlanta airport. He intended to ‘roll’ Alaumary; convincing him to work with the Secret Service.
On 17 October 2019 the Secret Service agents watched as Alaumary arrived at Grand Bahama International. They had set a trap for their target.
The Secret Service had tipped off the Bahamian authorities to Alaumary’s arrival, so the immigration staff would refuse him entry. He then faced two options: a night in the airport jail (the only accommodation on offer) while he waited for a flight back to Canada the next day, or a flight to the US leaving that evening. It was a gamble, but he chose the latter.
By total coincidence, that was a flight heading to Atlanta, the very same place from where Glen Kessler was waiting to depart for the Bahamas. Alaumary had inadvertently bought himself a one-way ticket straight into the hands of US law enforcement. When he landed at Atlanta, he was immediately placed in handcuffs and guided to an interview room where Kessler was waiting. The meeting did not go the way Kessler expected.
‘I showed him all the evidence linking him to a variety of international cybercrimes. I offered him the opportunity to go to work for the Secret Service immediately,’ says Kessler. ‘He leant back in his chair and said, “It’s been a very long day. I need you to put me up at the Ritz Carlton tonight in Atlanta. Then you come by at 10 o’clock tomorrow morning, and you and I can discuss what’s going to happen to me and how I’m going to help you out.”’
Even in this dire situation, it seems Alaumary still felt he was the Big Boss.
But Kessler had news for him. ‘I just laughed and said, “You don’t understand. I’m about to throw you in the Atlanta City Jail with some of the worst criminals on the planet.”’
Still, Kessler persevered with his plan to roll Alaumary, giving him a laptop and setting him to work. But Alaumary had been offline for several days and Sweet had grown suspicious. He demanded Alaumary turn on his webcam to show his location. Clearly, if Alaumary revealed his incarceration it would be game over for their collaboration.
So Kessler bought furniture, pictures and plants and turned an empty office in the jail into a convincing-looking apartment for Alaumary. Every time Sweet requested webcam footage, the agents would leave the room while Alaumary gave the North Koreans a virtual tour.
Meanwhile, officers analysed Alaumary’s iPhone and discovered his collaboration with the contact he’d stored under the name ‘Hush’. Abbas was now in their sights.
In hindsight, Hushpuppi’s final Instagram post is poignant in lots of ways. ‘Thank you, Lord, for the many blessings in my life. Continue to shame those waiting for me to be shamed,’ it reads. The post also featured a photo of a white Rolls-Royce Cullinan, worth around $300,000, alongside the hashtag ‘AllMine’.
Just three days later, on 9 June 2020, Dubai police arrived at the Palazzo Versace. They were escorted up to number 1706, Abbas’s residence, by hotel staff. Appropriately enough for a man who documented much of his life online, the drama of Abbas’s arrest was all caught on camera by Dubai police and later released on YouTube. The video ends with a Fast & Furious-movie-style tracking shot of the luxury vehicles they seized – including a brand-new white Rolls-Royce Cullinan.
Three weeks later, Abbas arrived in the US to face charges. It was an ignominious end to the career of a man who started life hustling in the backstreets of Lagos and worked his way to the penthouses of Dubai. In prison awaiting trial, Abbas worked cleaning windows and showers. He also took classes including, hilariously, ‘Navigating the Internet’.
In his native Nigeria his downfall was greeted by some with an outpouring of Schadenfreude. But on social media it was a different story – after his arrest, his Instagram account gained half a million followers.
In the end, Abbas and Alaumary both pleaded guilty. Alaumary admitted two counts of money-laundering conspiracy and got 11 years and eight months in prison. Just over a year later, Abbas was sentenced to 11 years and three months for one count of money-laundering conspiracy.
In an odd twist of fate, both ended up in the same jail: Federal Correctional Institution Fort Dix in New Jersey. It’s possible that prison was the first place they had ever come face to face. One can imagine them wearing the clichéd, Hollywood-movie orange jumpsuits, comparing notes about their radically different upbringings and trying to work out where it all went wrong.
The ones who aren’t behind bars, of course, are the North Koreans who are accused of hacking into Cosmos Co-operative Bank, Bank of Valletta and a host of other financial institutions, and using the likes of Abbas and
Alaumary to help them wash the money. The duo may have ended up behind bars, but the dozens of other money-laundering collaborators used by the Lazarus Group – and many other cybercrime gangs – remain at large.
We tend to think of online crime as ethereal, taking place inside the ones and zeros of the digital realm. But like any successful organised crime campaign, the hackers often rely on a network of physical accomplices to execute their heists. And with billions of pounds worth of illicit funds to be moved, there’s no shortage of Hushpuppis and Big Bosses waiting to help.
Rinsed: From Cartels to Crypto: How the Tech Industry Washes Money for the World’s Deadliest Crooks, by Geoff White, is out on 13 June (Penguin Business, £20); pre-order at The Telegraph Bookshop