The US Department of Justice has convicted nine people for stealing $2.5 million. Six of the perpetrators were members of a hacking group called “Community.” The other three were former employees of mobile phone companies. According to the indictment, the three former employees helped hackers steal $2.5 million worth of cryptocurrency through “SIM swapping” attacks
Five of the six members of the group "Community" are of American origin, while the sixth member is from Ireland. They have been charged with 15 criminal acts, including participation in the theft of money and identity theft
The companies' former employees are Americans.
The details of the accused have been published:
group "Community"
Conor Freeman, 20 years old, from Ireland
Ricky Handschumacher, 25, from Florida
Colton Jurisic, 20, from Iowa
Reyad Gafar Abbas, 19 years old, from New York
Garrett Endicott, 21, from Missouri
Ryan Stevenson, 26, from Connecticut
Former employees
Jarratt White, 22, from Arizona
Robert Jack, 22 years old, from Arizona
Fendley Joseph, 28 years old, from California
In SIM swapping attacks, attackers transfer the victim's phone number to a SIM card, which they manage themselves.
Initially, the perpetrators obtain the users' details, either using the phishing technique or by purchasing them on the dark web, where stolen user data is found. With this information, they contact mobile phone companies and, pretending to be the victim users, request to replace the old SIM card with a new one, with the excuse that the old one was lost or stolen.
Companies ask some questions to make sure they're talking to the owner of the number, but hackers, with the information they have, can answer them correctly. They're then able to cancel the old SIM card and activate a new one.
Once the new SIM is activated, the perpetrators can handle the victim's account, make calls, read and send messages, access passwords, make transactions, and more.
“SIM Hijacking” or “SIM Swapping” is an identity theft technique. It does not exploit any specific vulnerability. It essentially exploits the mobile phone number.
So in this particular case, the "Community" group took control of the victims' mobile phones, using the number and some personal information.
According to the court, the companies' former employees helped hackers obtain the new SIMs.
According to the charges, the perpetrators carried out seven attacks and stole $2.5 million from the victims' cryptocurrency exchange wallets. The money was transferred to wallets controlled by the perpetrators.
The sentence imposed by the court is 20 years in prison. Those who also participated in the theft of personal information (and not just the money) will be punished with an additional two years.
