The FBI arrested the person who, according to them, was behind the hacking of the SEC's Twitter account in January 2024

Man

Professional
Messages
3,085
Reaction score
623
Points
113
25-year-old Eric Councill Jr. of Athens, Alabama, was arrested this morning in Athens in connection with the unauthorized takeover of the US Securities and Exchange Commission (SEC) X account in January 2024, formerly known as Twitter, in which hackers posted a fake message from the SEC chairman that caused the value of bitcoin (BTC) to increase by $1000. that the Board will be appearing for the first time today in the Northern District of Alabama.

The indictment unsealed today accuses the Board of conspiracy to commit aggravated identity theft and access device fraud. The arrest and indictment were announced by United States Attorney Matthew M. Graves, Principal Deputy Assistant Attorney General Nicole M. Argentieri of the Department of Justice's Criminal Division, Acting FBI Special Agent David Geist of the Washington Washington Field Office, and SEC Inspector General Deborah Jeffrey.

According to the indictment, on January 9, 2024, the Board conspired with others to gain unauthorized control of the @SECGov X account (sometimes referred to as the SEC's Twitter account) and handed over a fake post on behalf of the SEC Chairman, which, among other things, falsely announced: "Today, the SEC approves ETFs #Bitcoin for listing on all registered national securities exchanges". Immediately after the tweet, the price of BTC rose by more than $1000 per bitcoin.

Shortly after the unauthorized publication, the SEC regained control of its account X and confirmed that the announcement was unauthorized and was the result of a security breach. Following this disclosure of corrective data, the value of BTC declined by more than $2,000 per bitcoin. (At the time, the SEC was debating whether to approve exchange-traded funds (ETFs) that held bitcoin.) An unauthorized entity gained control of SEC X's account through a "SIM swap".

"These SIM swapping schemes, in which scammers trick service providers into handing over control of unsuspecting victims' phones to them, can result in devastating financial losses for victims and the leakage of sensitive personal information", said U.S. Attorney Graves. "Here, the coup plotters allegedly used their illegal access to the phone to manipulate the financial markets. Through indictments like this one, we will bring to justice those who commit these serious crimes".

"The indictment alleges that Eric Council Jr. illegally accessed the SEC's account on X using the stolen identity of a person who had access to the account to take possession of their cell phone number", said First Deputy Assistant Attorney General Argentieri. "Council Jr.'s co-conspirators then allegedly used this unauthorized access to account X to falsely announce that the SEC had approved the listing of a bitcoin ETF, causing the price of bitcoin to rise by $1,000 and then drop by $2,000. The Board's indictment underscores the Criminal Division's commitment to countering cybercrime, particularly when it threatens the integrity of financial markets".

"The FBI is working to identify, suppressinvestigation of fraud using cyber technologies, including SIM swapping," said Acting FBI Special Agent Geist. "SIM swapping is a method that attackers use to illegally access confidential information of an individual or company with the intent to commit a crime. In this case, an unauthorized entity allegedly used SIM swapping to manipulate the global financial market. The FBI will continue to work tirelessly with our law enforcement partners across the country and around the world to hold accountable those who violate U.S. law".

"Today's arrest demonstrates our commitment to holding bad actors accountable for undermining the integrity of financial markets", said SEC Inspector General Jeffrey.

A subscriber identification module (SIM) card is a chip that stores information that identifies and authenticates a mobile phone subscriber. When a cell phone carrier reassigns a phone number from one physical phone to another — for example, when a customer buys a new phone but wants to keep the same number — the carrier switches the cell phone number assignment from the SIM card in the old phone to the SIM card in the new phone, a process sometimes called number porting.

A SIM swap attack refers to the process of tricking a carrier into reassigning a mobile phone number from a legitimate subscriber or a user's SIM card to a SIM card and phone controlled by a criminal entity. A SIM swap attack allows a criminal actor to bypass multi-factor authentication (MFA) and/or a two-step verification process to access the victim's account so that the criminal actor can steal the victim's money and/or data or gain access to the victim's online accounts.

As described in the indictment, Council, who used online aliases including "Ronin", "Easymunny", and "Agianschnauzer", obtained personally identifiable information (PII) and an identity card template containing the victim's name and photo from accomplices. The Council then used his ID card printer to create a fake ID card with this information. The council proceeded to obtain a SIM card tied to the victim's phone line by presenting a fake ID at a cell phone operator's store in Huntsville, Alabama. He then bought a new iPhone with cash and used the two items to obtain access codes to account @SECGov X. The board shared these codes with the conspirators, who then gained access to the account – and posted a fraudulent tweet on account @SECGov X on behalf of the SEC chairman, falsely announcing the SEC's approval of the BTC ETF. The council received a payment in BTC for a successful SIM swap. Soon after, the Board traveled to Birmingham, Alabama to return the iPhone used in the SIM swap for cash.

He later conducted an internet search for "SECGOV hacking", "telegram sim card swap", "how can I know for sure if my case is being investigated by the FBI", and "What are the signs that you are under investigation by law enforcement or the FBI, even if they haven't contacted you".

The case is being investigated by the Criminal and Cyber Support Division of the FBI's Washington Field OfficeThe Office of the SEC Inspector General, the U.S. Attorney's Office for the District of Columbia, as well as the Department of Justice's Market Integrity and Major Fraud Division (MIMF) and the Division of Computer Crime and Intellectual Property (CCIPS). Significant assistance was provided by the FBI field office in Birmingham.

The prosecution is being handled by Assistant United States Attorney Kevin Rosenberg, as well as U.S. Department of Justice trial attorneys Ashley Pungello and Paul Zebb of the Computer Crime and Intellectual Property Division and Lauren Archer of the Fraud Division. Assistant United States Attorney John Hundscheid of the Northern District of Alabama provided valuable assistance.

• Source: https://www.justice.gov/usao-dc/pr/...-january-2024-sec-x-hack-spiked-value-bitcoin
• Source: https://www.justice.gov/usao-dc/media/1373721/dl?inline
 
Eric Council Jr., accused of involvement in the alleged hacking of the U.S. Securities and Exchange Commission (SEC) X account and posting a message suggesting that Bitcoin exchange-traded funds had been approved, has pleaded not guilty in a D.C. courtroom.

At his arraignment on Oct. 25 before Judge Amy Berman Jackson in the U.S. District Court for the District of Columbia, Council pleaded not guilty to one count of conspiracy to commit aggravated identity theft and access device fraud. He was allegedly part of a group that hacked the SEC X account in January, posting a tweet claiming that the commission had officially approved Bitcoin (BTC) spot ETFs for the first time.

Federal Bureau of Investigation officials arrested Council in Alabama on Oct. 17. According to Bloomberg, prosecutors intended to “make a plea” to Council. It is unclear whether U.S. authorities also intend to execute additional arrest warrants for individuals involved in the SEC violation.

According to U.S. authorities, a group believed to include the Council took control of X's SEC account through a SIM swap attack. X's security team reported, and the SEC later confirmed, that the commission's account did not have two-factor authentication enabled, which led to the breach.
 
Top