LONDON — At first glance, the brother and sister accused of a mass hacking operation targeting top Italian politicians and business leaders don’t seem like your typical cybercriminals.

Giulio Occhionero, 45, is a nuclear engineer and a Freemason who had enjoyed a successful a career developing trading algorithms for financial firms who once frequented the city's posher establishments. His sister, Francesca Maria Occhionero, 49, is a flamboyant chemist with long blond hair and a passion for running and the outdoors.

Both were arrested in Rome on January 9, charged with having hacked some 18,000 email accounts, including ones belonging to former Italian prime ministers Matteo Renzi and Mario Monti, the Vatican’s culture minister Cardinal Gianfranco Ravasi, and European Central Bank chief Mario Draghi. On Monday, a judge denied their request to be transferred to house arrest because they could "repeat the crime and conceal evidence."

According to a police report, the siblings had received warning that they were to be arrested, and as police broke into their office, Francesca destroyed a handful of USB keys and data cards.

The entire setup, however, looks "really strange [and] nothing makes sense," said Vicente Diaz, principal security researcher at the Russian cybersecurity firm Kaspersky. It is unusual, he said, for two people in their forties, leading good lives with steady jobs, apparently to venture into the murky world of cybercriminality.

Eye Pyramid

The virus used to infect the accounts — called “Eye Pyramid” — is not highly sophisticated nor expensive. "These are publicly available resources.,” said Diaz. “It's quite possible to create them yourself.”

It is unlikely, he added, that the Occhioneros had a state sponsor behind them, but since they hacked multiple law firms it is plausible their ultimate goal was to sell the data they collected.

Both Giulio and his sister have denied the accusations against them, and their mother, Marisa Ferrari, a former sociology professor at Rome’s La Sapienza university, depicts her children as living a respectable, low-key lifestyle. “Giulio drives my old car and lives on the outskirts of Rome in a small rented apartment, and I paid for Francesca’s mortgage,” she told Italian daily Corriere della Sera. “The media have also speculated on their luxurious life style but actually I’m the one who occasionally invited them out for a pizza,” she added.

Ferrari said her son is an I.T. geek with a gift for mathematics “just like his father,” and acknowledged he is a Freemason. "But that's not a crime," she said. Francesca, she added, knows little about computers and technology.

Until a few years ago, both siblings — and Giulio in particular — had very different lifestyles. The engineer lived in one of Rome’s richest neighborhoods, hung out in exclusive members clubs, dined at expensive restaurants and drove fancy cars.

At the end of the nineties, after founding a company called Westlands Securities, he developed an algorithm to trade financial derivatives and sold it to American investment banks. Between 2001 and 2003 he was the only external member of the Italian bank Monte dei Paschi di Siena’s investment committee. The Tuscan lender later adopted a daily trading methodology created by Occhionero for its high-net-worth clients.

In the years since, the siblings set up at least half a dozen companies in the U.S., the U.K., Malta and the Turks and Caicos islands. The firms offered services in data management and quantitative finance. Their mother was one of the shareholders of Owl Investments, one of their Maltese companies. Their Caribbean holding, the Homeric (TCI) Limited, appears in the Panama Papers database.

US connections

Italian media have made much of the siblings’ connections to the U.S., with one website posting a picture of Giulio with Mel Sembler, who was ambassador to Rome from 2001 and 2005.

Francesca was born in Melford, Maryland, during a time their father worked as a physicist for NASA. Giulio’s resume says that in 1998 he received an offer from Illinois-based Argonne National Laboratories, a U.S. governmental science and engineering research center. The data allegedly collected through their hacking activities was stored by the Marashen Corporation LLC, a company the pair set up in Delaware.

The British intelligence agency which specializes on cybersecurity declined to comment as to whether the siblings were on their radar or not.

The prosecutor who arrested the Occhioneros said Westlands Securities advised the U.S. government on a large-scale infrastructure project in the port of Taranto in Southern Italy. According to the investigation documents, the siblings hacked the computers of the company that ran the tenders.

In London, where the siblings are legally registered as residents, few have heard of them. They are not well know in the City’s close knit circles or in London’s Italian community. At 207 Regent Street, where Westlands Securities was headquartered until the end of 2015 when it was transferred back to Malta, nobody has ever heard of them either.

A spokesperson for the Italian embassy said: “We are not acquainted and never had any contact with Mr. and Mrs. Occhionero.”

The Government Communications Headquarters (GCHQ), the British intelligence agency which specializes on cybersecurity declined to comment as to whether the siblings were on their radar or not.