OnionHector Monsegur aka "Sabu": the LulzSec Leader Who Sold Out All His Friends to the FBI
On March 6, 2012, just hours after the FBI and New Scotland Yard announced the simultaneous arrest of five major LulzSec members across four countries, a rumor spread through hacker chatrooms: their leader had not been swept up with them. He was not taken at dawn. He was not raided. Because he was the source. For 10 months, Hector Monsegur, alias Sabu — a New Yorker from the Lower East Side and a figure of authority within Anonymous — had secretly cooperated with the FBI while continuing to operate publicly as the collective's leader. His betrayal brought down LulzSec, AntiSec, and sent Jeremy Hammond — his closest ideological ally — to prison for ten years. This article tells his story without hagiography or condemnation, drawing on court records, public interviews, and documents revealed by Hammond's defenders.
⚫ This page is the showcase. The rest is elsewhere. Tor access →From the Lower East Side to Anonymous
Hector Xavier Monsegur was born in 1983 in New York, into a modest Puerto Rican family settled in the Lower East Side of Manhattan. His father was incarcerated for drug trafficking when Hector was 14; it was his grandmother, Irma, who took on his upbringing. Self-taught, Hector discovered computing on salvaged computers he assembled in his room. By 15, he was already practicing web hacking and participating in IRC communities.
In the 2000s, Monsegur became a recognized figure in Latin American hacktivist circles. He took part in several campaigns against government websites (notably Puerto Rican ones), developed an interest in digital activism, and adopted the pseudonym "Sabu" — a tribute to the wrestler Sabu, a rebellious figure of ECW. At the time, Monsegur occasionally worked as an IT technician for small businesses, but his income remained modest.
His personal life was complex. As an adult, he had custody of two young cousins he raised like adopted daughters after a difficult family situation. He received social assistance. This parental responsibility would play a central role in his decision to cooperate with the FBI later on.
In 2010–2011, Monsegur joined the Anonymous movement, then in full post-WikiLeaks expansion. He quickly became one of the most active operators in the #anonops chat, participated in Operation Payback (attacks against PayPal, Visa, and MasterCard, which had cut off WikiLeaks), then in Operation Tunisia. His tactical acumen and ability to coordinate multinational operations earned him strong authority in the community.
LulzSec: fifty days that shook the Internet
On May 7, 2011, a core group of Anonymous members decided to split off into a more targeted and media-friendly group: LulzSec (The Lulz Boat). The founding members: Sabu (tactical leadership), Topiary (Jake Davis, communications/PR), Kayla (Ryan Ackroyd, technical intrusions), Tflow (Mustafa Al-Bassam, vulnerability exploitation), Pwnsauce (Darren Martyn), Palladium (Donncha O'Cearrbhail).
The group claimed 50 days of intense operations. The list of targets is staggering:
- Fox.com (May 17) — release of 73,000 data records of X-Factor USA contestants
- PBS (May 30) — intrusion and publication of a fake article announcing that Tupac Shakur was alive in New Zealand
- Sony Pictures (June 2) — leak of 1 million plaintext user accounts
- FBI affiliates (Infragard) (June 3) — doxing of members of the FBI intelligence program
- CIA.gov (June 15) — DDoS attack taking the site offline for 2 hours
- US Senate (June 13) — intrusion into senate.gov
- NHS (June 14) — access to UK National Health Service systems
- Arizona Department of Public Safety (June 23) — "Chinga La Migra," leak of 440 MB of internal documents
- Soca.gov.uk (June 20) — DDoS attack on the UK's Serious Organised Crime Agency
Each operation was claimed on Twitter (@LulzSec) and Pastebin in a provocative, humorous style that attracted global media coverage. The Twitter account reached 350,000 followers within weeks — more than most traditional media outlets.
On June 26, 2011, LulzSec officially announced its dissolution via a manifesto titled "50 Days of Lulz." Members migrated to AntiSec, a new collective still coordinated by Sabu. AntiSec continued operations until the March 2012 dismantlement.
The arrest of June 7, 2011
A few days before LulzSec's dissolution, Sabu made his fatal mistake. According to court minutes filed in the Southern District of New York, on June 7, 2011 (a date that predates the public dissolution), Monsegur connected to an IRC chat without activating the Xerobank VPN he normally used. His residential IP address in New York was then logged by a service monitored by the FBI. Agents traced it back to his apartment at 90 Avenue D in the Lower East Side within hours.
The FBI knocked on his door in the early evening. Two special agents, one supervisor. No dynamic entry, no SWAT — a different strategy from the one that would be used with Ulbricht. The agents presented their warrant, gave Monsegur a few minutes to process, and then made the offer: full cooperation in exchange for a reduced sentence. In particular, a guarantee that his two cousins in his care would not be placed in foster care — the argument that weighed most heavily for him.
Monsegur agreed the same evening. He signed a formal cooperation agreement the following week with the deputy US attorney for the Southern District of New York. From that moment, every one of his online activities was monitored in real time by FBI Cyber Division agents. Every chat with other hackers was recorded. Every operation he "coordinated" was validated (or quietly prevented) by his federal handlers.
10 months of double-dealing
His cooperation lasted 10 months. During this period, Sabu continued to be publicly present under the same pseudonym, on the same IRC chats, with the same tone. None of his collaborators suspected he had flipped. Several factors explain this absence of detection:
- Monsegur was a brilliant interlocutor, capable of simulating enthusiasm for new operations while neutralizing them through suggestions that delayed or redirected them toward less sensitive targets
- FBI agents gave him tactical leeway: he could participate in real operations as long as they did not cause irreversible damage
- Several operations attributed to AntiSec during this period were in reality conceived by the FBI as traps — luring other hackers into publicly participating
The FBI used Sabu's conversations to methodically identify members of LulzSec, AntiSec, and other sub-groups. Civil identities were cross-referenced with IP databases, phone records, and carelessly posted images. The main targets emerged: Jake Davis (Topiary) in the Shetland Islands, Ryan Ackroyd (Kayla) in South Yorkshire, Mustafa Al-Bassam (Tflow) in London, Jeremy Hammond in Chicago, and the Irish members.
Jeremy Hammond and the Stratfor affair
The Jeremy Hammond case is the most painful. Hammond was a Chicago activist known for operations against private companies he deemed harmful. In December 2011, he penetrated the servers of Stratfor (Strategic Forecasting, Inc.), a private geopolitical intelligence firm based in Austin. The hack exposed millions of analyst emails discussing sensitive matters — some with embarrassing implications for governments and corporations.
In reality, Sabu played an active role in preparing the hack. He provided Hammond with a list of "interesting targets" that included Stratfor, and suggested intrusion techniques. Hammond, who considered Sabu his friend and ideological mentor, acted in complete trust. What he did not know: Sabu was operating under FBI control. The Stratfor hack was indirectly orchestrated by the FBI itself, which used it to (1) identify the sensitive targets Hammond was interested in attacking, (2) precisely document his opsec, and (3) accumulate federal charges against him.
The data stolen from Stratfor was even uploaded to a server controlled by the FBI. Agents allowed WikiLeaks to access it (via Hammond and Sabu) to create the "Global Intelligence Files" archive, which WikiLeaks subsequently published. The operation was therefore simultaneously an FBI-documented act of hacking and the biggest leak of 2012.
Jeremy Hammond was arrested on March 5, 2012. He pleaded guilty in 2013 to avoid a more costly and lengthy trial, and was sentenced on November 15, 2013, to 10 years in federal prison — the maximum under his agreement. He served his sentence until late 2020. During his incarceration, he was placed in solitary confinement several times and discovered in the court documents the full extent of Sabu's involvement in preparing the hack. His public testimony on this affair remains one of the most damning against FBI investigative methods in activism cases.
March 6, 2012: the reveal
On March 6, 2012, the FBI and New Scotland Yard simultaneously announced the arrest of Jake Davis (Topiary), Ryan Ackroyd (Kayla), Donncha O'Cearrbhail (palladium), and Darren Martyn (pwnsauce). The statement noted that the arrests had been made possible "thanks to a cooperating informant." Within hours, Hector Monsegur's name and his alias "Sabu" were confirmed by several media outlets (FoxNews first, quickly followed by Reuters and the New York Times).
The reaction in the hacker community was one of shock. Sabu — the charismatic leader, the anti-establishment New Yorker, the friend of Latin American causes — had in reality been under federal control for nearly a year. On Twitter, one of the most-used hashtags in the days that followed: #EtTuSabu.
Still-free members of Anonymous and AntiSec launched a major opsec purge: changing all VPNs, abandoning several chatrooms, completely overhauling internal communications strategy. Multiple investigations opened by the FBI in the following months led to further arrests, all based on evidence gathered during the Sabu period.
A symbolic sentence
Monsegur appeared before Judge Loretta Preska of the Southern District of New York on May 27, 2014. The initial indictment provided for up to 26 years in prison for his hacking activities. After plea agreement negotiations and recognition of his exceptional cooperation:
- Effective sentence: 7 months in prison (most of which had already been served in pre-trial detention — he was effectively released after only a few additional days)
- 1 year of supervised release
- No Internet use ban (exceptional for this type of case)
The sentence was perceived as extraordinarily lenient compared to Jeremy Hammond's 10 years. This disproportion fueled criticism of the US justice system and the power dynamics between activism and cooperation, notably in pieces by Glenn Greenwald, Micah Lee, and Rebecca MacKinnon.
Sabu as a cybersecurity consultant
After his release, Hector Monsegur reinvented himself. He created his own cybersecurity consulting firm, worked as an analyst at several startups, and makes public appearances on information security topics. He is not under an official witness protection program: he lives openly under his real name in New York.
His media appearances have been regular since 2015. He has participated in Black Hat and DEF CON conferences, and has given interviews to Vice, Motherboard, and Wired. In his public statements, he maintains that his cooperation was motivated by the protection of his cousins and that he regrets certain aspects (notably the Hammond affair), while claiming to have "prevented worse damage" than he would have caused without FBI control.
This stance remains contested. For part of the hacker community, Monsegur remains the symbol of the traitor who brought down Anonymous. For another part, he is a tragic case of a man caught between his family responsibility and his political loyalty. For the FBI, he is simply the model informant — brilliant, effective, and well rewarded.