LulzSec's Sabu hacked foreign gov sites while under FBI control – NYT

Ex-LulzSec chief Sabu orchestrated attacks on government computers in Iran, Syria, Pakistan and Brazil while under the control of the FBI, according to a New York Times investigation.
After he was apprehended and turned to became an FBI informant, Hector Xavier "Sabu" Monsegur encouraged fellow Anonymous hackers to hit foreign websites using a zero-day vulnerability in server-side software.
Data stolen during the hacking spree was then uploaded to a server that was secretly monitored by the Feds, it's claimed.
The allegations are based on copies of court documents as well as interviews with individuals linked to the network assaults by the New York Times.
Monsegur was arrested in September 2011, and since then he has been working with the Feds as an informant against his online brothers-in-arms. This only became public knowledge in March 2012. During the eight months in between, Sabu was coordinating a hacking spree by the LulzSec cyber-gang and elements of the wider Anonymous movement, all while pushing a list of targets on behalf of his US government handlers, it is claimed.
The NYT said it has evidence that Uncle Sam, through Sabu, used Anonymous activists to probe foreign government websites for vulnerabilities.
Chat logs between hacktivist Jeremy Hammond and Sabu show that the FBI mole supplied Hammond with addresses of foreign websites to target, it's alleged. A flaw in web-hosting software Plesk was one of the main routes used to obtain unauthorized access to vulnerable systems, the newspaper claimed.
Hammond, together with a Brazilian hacker using the nickname Havittaja, broke into the insecure sites, although Sabu merely encouraged them rather than participating in the hacks, it's reported. Once the sites were hacked, sensitive information was extracted and uploaded to servers designated by Monsegur that had been tapped by the Feds, we're told.
"Exploiting a vulnerability in a popular web hosting software, the informant directed at least one hacker to extract vast amounts of data - from bank records to login information - from the government servers of a number of countries and upload it to a server monitored by the FBI," the NYT reports.
Hammond is serving a 10-year sentence after pleading guilty last month to a high-profile hack against private intelligence outfit Stratfor and for attacks inside the United States. The hacktivist admits to taking part in attacks outside the US, but the terms of his plea-bargaining deal prevent him from going into details.
Monsegur's repeatedly delayed sentencing [PDF] is due to take place on 8 May. He has admitted 12 criminal charges that include multiple counts of conspiracy to engage in computer hacking.