The U.S. Department of Justice has indicted six people allegedly linked with the “The Community” cybercrime group for an alleged SIM card hijacking case which made victims lose an aggregate $2.4 million. The DOJ has posted the announcement in its official Press Release, the six individuals named below are facing multiple cases of aggravated identity theft, wire fraud and conspiracy to commit wire fraud.
- Conor Freeman, 20, of Dublin, Ireland
- Ricky Handschumacher, 25 of Pasco County, Florida
- Colton Jurisic, 20 of, Dubuque, Iowa
- Reyad Gafar Abbas, 19, of Rochester, New York
- Garrett Endicott, 21, of Warrensburg, Missouri
- Ryan Stevenson, 26, of West Haven, Connecticut
As per the DOJ prosecution team, the defendants allegedly were behind the identity theft that cost people their cryptocurrencies, their mobile phone SIMs were taken over. With access to the victim’s SIM information, message redirection was made by the attackers. Since emails, crypto exchange accounts and web services user passwords are usually reset through a mobile phone verification, the attackers were able to leverage the stolen SIMs to their advantage of taking over the cryptocurrency wallets and exchange accounts of the victims.
“The Community would use their control of victims’ phone numbers to reset passwords on online accounts and/or request two-factor authentication (2FA) codes that allowed them to bypass security measures. The members of “The Community” charged in the indictment endeavored to gain control of victims’ cryptocurrency wallets or online cryptocurrency exchange accounts and steal victims’ funds. It is alleged in the indictment that the defendants executed seven attacks that resulted in the theft of cryptocurrency valued at approximately $2,416,352,” explained the U.S. Eastern District of Michigan Attorney’s Office.
U.S. authorities are still looking for 3 more members of “The Community” that are still at-large. Their age range is between 19 to 28 years old, the savvy age of being involved with cryptocurrency. The case also provides a glimpse of how lax the user-verification process of service providers. “The allegations against these defendants are the result of a complex cryptocurrency and identity theft investigation led by Homeland Security Investigations, which spanned two continents. Increasingly, criminal groups are turning exclusively to web-based schemes to further their illicit activities, which is why HSI has developed capabilities to meet these threats head on,” emphasized Acting Special Agent in Charge Angie Salazar of U.S. Immigration and Customs Enforcement’s (ICE) Homeland Security Investigations (HSI) Detroit.
Their customer support teams are easily persuaded with a social engineering attack providing the “thieves” the username and password of the cryptocurrency exchange accounts of the victims using the hijacked SIMs. Anyone with 2-Factor authentication are still vulnerable, since many service providers uses SMS as the delivery method for the 2FA, which the attackers already have access through SIM hijacking.
“Mobile phones today are not only a means of communication but also a means of identification. This case should serve as a reminder to all of us to protect our personal and financial information from those who seek to steal it,” explained U.S. Attorney Matthew Schneider.
Related Resources:
The Cybersecurity Risks Of Engaging With Cryptocurrency
Why Cryptocurrency’s Future Needs More Women Behind The Scenes
This Ransomware Went From Stealing Passwords To Hijacking PCs
Why Mixing Your Cryptocurrency Is Still The Best Shot At Privacy