Cyber Threat Actor: David Pokora

David Pokora, also known by his alias, is a Canadian national who was identified as a member of the hacking collective referred to as Xbox Underground. The group operated primarily out of North America, with Pokora residing in Mississauga, Ontario. Publicly available sources describe Xbox Underground as a loose association of individuals who collaborated to breach corporate and government networks. Their activities focused on technology companies such as Microsoft, Epic Games, Valve and Zombie Studios, as well as the United States Army. The attackers gained initial entry through SQL injection exploits and by leveraging stolen employee usernames and passwords, sometimes obtained from software development partners. Once inside the target environments, they accessed and exfiltrated unreleased software, source code, pre‑release video game titles and military training applications, including Apache helicopter simulation tools. No specific malware families or custom toolsets are mentioned in the reporting; the emphasis is on credential abuse and injection techniques. The collective’s actions resulted in the theft of intellectual property that prosecutors valued between one hundred and two hundred million dollars.

The intrusion campaign attributed to Xbox Underground spanned from January 2011 to March 2014, during which the defendants allegedly compromised the networks of Microsoft, Epic Games, Valve, Zombie Studios and the US Army. In April 2014 a federal grand jury in the District of Delaware returned an indictment charging David Pokora, Nathan Leroux, Sanadodeh Nesheiwat and Austin Alcala on eighteen counts, including conspiracies to commit computer fraud, copyright infringement, wire fraud, mail fraud, identity theft and theft of trade secrets. Pokora and Nesheiwat subsequently pleaded guilty to conspiracy to commit computer fraud and copyright infringement, each facing a maximum sentence of five years imprisonment. An additional Australian suspect with links to the conspiracy was also charged in connection with the same case. The Department of Justice highlighted that the stolen data included proprietary gaming assets such as pre‑release copies of Call of Duty: Modern Warfare 3 and Gears of War 3, as well as sensitive military software used for pilot training. The case underscored the ability of a small hacking ring to penetrate both high‑profile commercial platforms and defense‑related systems, leading to significant legal consequences for its members.