 |
| Joshua with his mother Vivina before his arrest as a teenager in 2017 |
The astonishing tale of Joshua Epiphaniou: the first Cypriot citizen ever extradited to the US, and the first to face a murder charge with the victim’s body still missing. He’s also handling his own legal defence
What, you may wonder, has become of ‘the little hacker’?
Joshua Polloso Epiphaniou is one of the few local criminals who are so notorious that they’re known by a nickname (for some reason, English-language media tend to refer to him as ‘the little hacker’, whereas in Greek he’s usually ‘the hacker’).
Calling him a criminal, however – though technically true – is a misrepresentation of his story, and the general perception of him.
The hacker, still only 27, has been at the forefront of four criminal cases in the past decade, with the most recent one being by far the most serious. Along the way, he’s racked up a number of firsts.
He’s the first Cypriot citizen ever to be extradited to the United States – where, in March 2021, he was convicted of cyber-extortion and sentenced to a year in federal prison.
He’s also the first-ever defendant in a local case to be charged with murder even though the alleged victim’s body was never found.
And he’s now also in the position – not a first, but still very uncommon – of representing himself in court in that same murder case, having fallen out with two lawyers over how the defence should be conducted.
He’s also autistic, having been diagnosed with Asperger’s syndrome – and also part of what can only be called an underclass in Cyprus society. “Had he been born into a well-off, high-society Cypriot family, it would have been different,” his lawyer Eleni Erotokritou told the Cyprus Mail in 2020, as her client was being extradited after three years in custody.
His mother, Vivina Polloso, is a Filipina who became a naturalised citizen. His father is Cypriot, a police officer, and played no part in his son’s upbringing – indeed, he refused to even recognise Joshua, only doing so after a paternity test and lengthy back-and-forth in family court.
Vivina is “a very polite, kind lady who’s worried about her son,” lawyer Michael Chambers – who also represented Epiphaniou around the time of the extradition – tells the Cyprus Mail now.
“And I think Joshua, the reason that he got into this mess in the first place, was because of their need for money…
“I mean, it was funny because when they arrested him they found €70,000 in cash, in his apartment. And he had a large amount in bitcoins. But he had bought nothing for himself. Nothing! He was in a tracksuit and a pair of sneakers.
“He didn’t go out. The apartment was – you know, nothing. There was nothing… He only did it to help his mother out.”
Joshua has spent most of his adult life in prisonThe little hacker was first arrested in 2017, still a teenager, and charged with being behind a cyber-attack on Cablenet in Cyprus that had brought their systems down for several days.
That, in turn, led to charges of having hacked websites in 2014-16 – including five American websites, hence the FBI’s involvement – and extorting money out of them by threatening to reveal stolen user data.
His lawyers fought the extradition order – but finally, worn down by nearly four years in custody, the hacker agreed to be tried in the US, trusting (correctly, as it turned out) that his youth, Asperger’s, and time already served would mitigate the sentence.
A year later, he was back in Cyprus – but by now he was running in some shady circles.
In 2022, Epiphaniou filed a complaint claiming he’d been abducted, and had money extorted from him, in the buffer zone by criminals posing as Turkish Cypriot cops. He also alleged, making the story even more complicated, that the same group had tried to persuade him “to infiltrate the network of Nicosia businessman Alexis ‘Alexoui’ Mavromichalis… so that one day he could get close and text Alexoui’s location,” according to a report in KNews that October. Alexoui, who had close links with organised crime, was shot dead in 2023.
This was the third criminal case where the little hacker was involved, albeit as the victim. A few months later came the fourth case – the disappearance, in April 2023, of 31-year-old Angelos Perikleous. Epiphaniou has been charged with premeditated murder, even though Perikleous remains missing and no body has ever been found.
The evidence against the hacker appears to include witness testimony that he and Perikleous had financial differences, some half-charred clothes that the alleged victim was wearing, evidence that the two were together on the day of the disappearance, and (above all) a statement by Epiphaniou’s uncle that his nephew admitted the crime to him while forcing him at gunpoint to help burn Perikleous’ car. Both the uncle and Vivina Polloso are being charged as accessories after the fact.
The police confirmed to the Cyprus Mail that their investigation is complete, that they’re no longer searching for the body, that this is the first case of its kind, and that it will be “interesting” to see what the court decides.
What’s also interesting are the proceedings now taking place, with the little hacker – representing himself – carrying out extremely detailed cross-examinations of prosecution witnesses, often consulting the copious notes he’s apparently made for every question.
The trial was only on the eighth witness (out of 96 that the prosecution plans to bring) when last reported, with the atmosphere often fraught and the judge intervening to rebuke Epiphaniou. “Repeated warnings, in a stern tone, came from the bench regarding his line of questioning, which was causing unnecessary time-wasting,” wrote Phileleftheros in February.
There’s a comical side to all this – but of course the case itself is far from comical. Chambers offers no opinion on the merits (he’s not involved), nor will he comment on whether the non-violent, computer-mad youngster he once knew could’ve turned into a cold-blooded killer – but he does point out a major systemic issue.
“This is a problem, I believe, with our criminal system… You arrest someone for a hacking case, then you put him in prison with criminals that have committed murder, and crimes of that nature. How do you think this is going to work out for that person, that young teenager? How do you think it’s going to go?
“It’s wrong of the justice system in Cyprus to place teenagers, or people who have committed less serious crimes, in the same environment as hardcore criminals.”
Chambers recalls the year when the little hacker was serving his sentence in US federal prison – and we hear a lot about the awfulness of American prisons, but in fact “when he was detained in the US, he was with like-minded individuals. Similar age, similar offences.
“I mean, he used to call me from the US. And sometimes he had someone else call, to say that Joshua isn’t available to speak now but, you know, he wants me to do this or that – and the person who called would be another detainee.
“And the way he spoke… You know, they’d call and say, ‘Good evening, Mr. Chambers. How are you today?’.” It was like getting a call from some posh boarding school, not a prison – but in fact “that’s the proper way to do it,” he insists.
The hacker (at the time, at least) was more of a wayward boy than a hardened criminal.
At 27, he’s lived almost all his adult life in prison – an especially stressful environment for someone who’s neurodivergent. He’s still there, of course, allowed some privileges when he needs to examine documents or use the internet to prepare his defence, but otherwise just another prisoner.
There have been some “incidents,” admits the prisons department, refusing to elaborate. In fact, the hacker (through his then-lawyer) reported having been attacked three times by other inmates – including being stabbed and having his nose broken – since his arrest, the third attack, in February 2025, prompting the authorities to move him to another cell.
It’s a sad story, irrespective of his guilt or innocence.
The little hacker never had a chance. He’s “a clever person,” reckons Chambers – and he obviously has skills that could’ve earned him an excellent salary in the IT sector, under different circumstances. (They still might, someday.) Instead he slipped into dishonesty and delinquency.
Vivina Polloso has been in Cyprus since 1989, she told the Cyprus Mail six years ago, right after Joshua’s extradition. Her son was born here. He is, to all intents and purposes, a Cypriot.
“But my son was always treated as ‘the Filipino’ – as a foreigner. Not a Cypriot.”
