Cybercriminals jailed for cryptocurrency theft, death threats

On Wednesday, two Massachusetts men were sentenced to more than two years in prison each for stealing cryptocurrency in SIM swapping attacks and hijacking their victims’ social media accounts.

In their attacks, Eric Meiggs and Declan Harrington targeted individuals who likely owned significant amounts of crypto assets in Coinbase or Block.io wallets (like cryptocurrency executives) or potential victims who controlled high-value “Original Gangster” (OG) Instagram and Tumblr accounts.

“Meiggs and Harrington conspired to hack into and take control over these victims’ online accounts so they could obtain things of value, such as cryptocurrency,” a DOJ press release reads.

“They used an illegal practice known as “SIM-swapping” and other techniques to access, take control of, and in some cases steal cryptocurrency from the accounts.”

Harrington and Meiggs were charged in November 2019 for targeting at least ten victims in SIM swapping attacks and, in some cases, with death threats.

The defendants both pleaded guilty to charges of crypto theft and hijacking victims’ social media accounts.

While each defendant faced a statutory maximum penalty of 20 years in prison for charges of wire fraud, Meiggs was sentenced to two years and one day in prison and Harrington to two years and seven days.

Death threats, hacking, and cryptocurrency theft

According to the court documents, they allegedly stole $200,000 worth of cryptocurrency in one go from an Arizona resident who “publicly communicated with cryptocurrency experts online,” while $100,000 were swiped from a victim in California with close ties to someone who “operated a blockchain-based business.” 

Another $165,000 in cryptocurrency was stolen from an Illinois cryptocurrency project leader. At the same time, roughly $35,000 worth of crypto assets got looted from the Block.io cryptocurrency wallet of a Nevada victim who “owned a Bitcoin Automated Teller Machine network.”

Meiggs also called a victim and threatened to kill their wife while trying to take control of the target’s Instagram handle, according to the indictment.

The victim complied and changed the account’s profile name, allowing the scammer to take over the handle.

Per the indictment, tactics and methods allegedly used by the two defendants during their attacks include:

• Identifying potential victims who likely had significant amounts of cryptocurrency and researching the potential victims using online tools.
• Engaging in “SIM swapping” in order to take control of victims’ cell phone numbers.
• Leveraging the victims’ hijacked phone numbers to gain unauthorized access to their online accounts, including email accounts, social media accounts, and cryptocurrency accounts.
• Using their access to victims’ accounts to take over and steal their account handles and their cryptocurrency.
• Selling or otherwise transferring victims’ log-in credentials, account handles, and cryptocurrency.
• Using victims’ hacked online accounts to ask for money and cryptocurrency from victims’ friends and families.
• Using multiple online accounts to hide their identities and evade detection by law enforcement.

With thanks to the Cyber Defence Alliance and Bleeping computer. The full story is here: https://www.bleepingcomputer.com/news/security/cybercriminals-jailed-for-cryptocurrency-theft-death-threats/

---

Don’t get hacked by social media phishing attacks!

Many of your users are active on Facebook, LinkedIn, and Twitter. Cybercriminals use these platforms to scrape profile information of your users and organization to create targeted spear phishing campaigns in an attempt to hijack accounts, damage your organization’s reputation, or gain access to your network.

KnowBe4’s Social Media Phishing Test is a complimentary IT security tool that helps you identify which users in your organization are vulnerable to these types of phishing attacks that could put your users and organization at risk.

Here’s how the Social Media Phishing Test works:

• Immediately start your test with your choice of three social media phishing templates
• Choose the corresponding landing page your users see after they click
• Show users which red flags they missed or send them to a fake login page
• Get a PDF emailed to you in 24 hours with your percentage of clicks and data entered

PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/social-media-phishing-test-partner?partnerid=001a000001lWEoJAAW