Frat brothers linked to J.P. Morgan hack

When Anthony Murgio and Josh Aaron ran the place, the Phi Kappa Sigma house a block from Florida State University’s Tallahassee campus was a hive of digital moneymaking. Led by Mr. Murgio (chapter president) and Mr. Aaron (secretary), dozens of fraternity brothers paid their way through school writing Google ads that persuaded people to click links for everything from dating websites to electronics. Working in shifts, the brothers brought in thousands of dollars a month in commissions. For Mr. Murgio and Mr. Aaron, college life was an education in making fast cash online.
Federal prosecutors say the 31-year-olds have since used their skills unlawfully. In indictments unsealed on July 21, Mr. Murgio is accused of running a Bitcoin exchange that laundered money for hackers. Mr. Aaron is accused of a pump-and-dump scam that used expertly crafted spam e-mails to lure investors into worthless penny stock purchases, generating $2.8 million in illicit profits. Although those indictments don’t involve hacking, an FBI memo reviewed by Bloomberg also links the two men to last summer’s cyber attack on JPMorgan Chase, one of the largest bank hacks in U.S. history.
(More: Know the cyberrisks to thwart them)
No one has pieced together how Mr. Aaron and Mr. Murgio may have gone from being promising business students to top-drawer cyber criminals, but there are hints of what may have happened along the way. Mr. Murgio racked up more than $500,000 in debt while trying to become a nightlife mogul, and Mr. Aaron moved to Israel and linked up with an alleged stock scammer.
Friends and family say they’re shocked by the charges. “They were always very business-minded but always very ethical and good people,” says Drew White, a video producer and fraternity brother. Lawyers for Mr. Murgio declined to comment. It’s unclear whether Mr. Aaron, who’s still a fugitive, has an attorney.
BRICK COLONIAL
Mr. Murgio and Mr. Aaron met in 2002, their freshman year at Florida State. Mr. Aaron grew up in a brick colonial on a corner lot in the affluent Washington suburb of Potomac, Md. Mr. Murgio’s family home sits on an acre abutting a private 18-hole golf course in West Palm Beach, Fla. Mr. Aaron’s parents, Bob and Marsha, learned about the indictment hours after its unsealing and declined to comment. Mr. Murgio’s father, Mike, a former high school principal who serves on the county school board, said friends would vouch for his son’s “trustworthy and kind” character.
Both men had grown-up sensibilities at a young age, friends say: Neither did drugs, they were usually the designated drivers on nights out, and they were determined to become successful entrepreneurs. Mr. Murgio was outgoing and hammy, while Mr. Aaron was serious and reserved. In social media posts, Mr. Murgio called him “the Don.”
After a brief stint selling kitchen knives door-to-door, Mr. Aaron introduced Mr. Murgio and their fraternity brothers to “affiliate marketing,” a then-nascent business in which they crafted Google ads for companies willing to pay for traffic, taking a cut when people clicked. Friends say it was a popular job on campus, and Mr. Murgio later wrote on a personal Web page that he’d “started working for major corporations. Was flown all over the world, taken out to dinners all day and night … lots of fun.”
Mr. Murgio, who also built vacation-rental websites, later said he’d made $800,000 in college. He poured it into opening a restaurant and nightclub three blocks from campus after graduating in 2007. He was profiled in Tallahassee Magazine in 2010, and YouTube videos show long lines of students waiting to get into the club.
Mr. Aaron dropped out in 2005 and relocated to Miami, where he started a series of companies in pricey Palmetto Bay. Among them were a maker of air purifiers, a home-security business, and an Internet marketing firm. He and Mr. Murgio stayed close. “I still work with Josh, and we currently market many products on the Internet for various companies around the world,” Mr. Murgio wrote on his personal Web page in 2013.
FEW TRACES ONLINE
Mr. Aaron left few traces online, unusual for an Internet marketer. His partner in a marketing firm he started in 2010 was a former securities broker previously banned for life by the Financial Industry Regulatory Authority Inc. for violations including marketing worthless technology stocks.
According to Mr. Aaron’s indictment, a year after starting the firm he was deep in a stock-fraud scheme with an Israeli friend, which continued into this year. Mr. Aaron had moved to Israel and married a tax lawyer he met there. His bachelor party in Amsterdam reunited some of the frat brothers, including Mr. Murgio. The wedding was Sept. 10, 2014, two weeks after it became public that the FBI was investigating a breach at JPMorgan.
Starting around 2010, Mr. Murgio’s nightlife business crumbled. He was in litigation with his landlord and was arrested in October 2011 after clashing with police over noise complaints. He filed for bankruptcy protection six months later, citing $545,000 in debt, and in early 2013 was arrested on charges that he stole $111,000 in unreported sales taxes his businesses collected. Mr. Murgio told friends it was a paperwork mistake, and the charges were dropped after he paid the taxes.
Soon he was back on his feet. Mr. Murgio, who often posted about libertarian causes and uses a photo of himself with Ron Paul as his Facebook profile, registered the Coin.mx domain in October 2013 and started a Bitcoin exchange. “He is a bit ADD when it comes to new ideas. Comes up with a new one every day, then on to the next,” says Taylor Wilson, an ex-girlfriend. “He liked the idea of Bitcoin, liked the principle behind it, but I don’t know that it was his end-all. He is an entrepreneur, always will be.”
Prosecutors allege the Bitcoin exchange laundered illicit funds, including extortion payments made to hackers. In a 16-month period it exchanged a total of at least $1.8 million, according to court documents. “Anyone who really knows him believes this is all a misunderstanding,” Ms. Wilson says.
Neither Mr. Murgio nor Mr. Aaron is accused of directly hacking JPMorgan. But the October FBI memo outlined some evidence linking them to the attack, including records of Mr. Aaron logging in to servers associated with the breach of the bank’s main data center, where the hackers made off with personal data of 83 million customers over three months. Only relatively low-value data were removed, such as names, addresses, and e-mail addresses — exactly what you’d want for a pump-and-dump scheme, say three people familiar with the investigation. A group of elite Russian hackers that the people say teamed with the Florida State alums appears to have done the actual hacking, and the FBI hopes to use Mr. Murgio and Mr. Aaron to build the larger case.
RENDEVOUS IN RUSSIA
Mr. Murgio and Mr. Aaron saw each other less after Mr. Aaron moved to Israel, but they did rendezvous in Russia. Mr. Murgio visited Moscow at least a half-dozen times starting in 2014, drawing puzzled notes from Facebook friends. Court documents show he was working closely with Russian payment processors. Social media posts show him in selfies drinking vodka and soda and posing in front of the Kremlin and the Ministry of Foreign Affairs. He partied at the City Space Bar on the 34th floor of the lavish Swissotel Krasnye Holmy in downtown Moscow, and he posted a photo of himself smoking a hookah. “Doesn’t get better,” he wrote in a caption. “If it wasn’t 25 degrees, I wouldn’t leave.”
Mr. Aaron and his wife also traveled frequently to Russia starting in 2015. In a photo posted on social media accounts this year, he’s wearing a Russian fur cap and posing in front of the Kremlin. He and his wife also drank at the City Space Bar. Mr. Aaron and Mr. Murgio met there in July. A photo shows them smiling as they dine along the Moscow River. Two weeks later, they were charged.
Mr. Murgio was arrested in Tampa and is free on bond. Mr. Aaron’s whereabouts are unknown. Friends of both men say it’s unfathomable they would be involved in the crimes they’re accused of. “I’m still trying to wrap my head around it,” says frat brother Mr. White. “There must be something else going on here, or some kind of misunderstanding. They both just shared a passion for business.”