5 charged in “Scattered Spider,” one of the most profitable phishing scams ever

November 21, 2024:

Prosecutors allege that the phishing attacks ran from at least September 2021 to April 2023. During that time, the defendants sent text messages to mobile phones of employees of the targeted companies that purported to come from the IT departments of their employers.

The text messages often falsely warned that the employees’ accounts would be deactivated imminently unless they clicked on links to malicious sites that were designed to look like legitimate websites used by victim companies. The phishing sites attempted to lure the employees into providing confidential information, including account login credentials. Some employees took the bait by visiting the sites, entering their credentials, and authenticating their identities with two-factor authentication. Scattered Spider then entered the intercepted passwords and 2FA credentials into the legitimate sites and gained access to the employee accounts.

Once inside targeted companies’ networks, the defendants allegedly stole confidential information, including personal information, such as account credentials, names, email addresses, and telephone numbers. Prosecutors said the defendants also used information stolen from hacked companies and elsewhere to access cryptocurrency accounts or wallets of “numerous individuals” and take millions of dollars’ worth of digital coins.

If convicted, each defendant faces a maximum sentence of 20 years in prison for conspiracy to commit wire fraud, up to five years in federal prison for one count of conspiracy, and a mandatory two-year consecutive prison sentence for aggravated identity theft. Buchanan also faces up to 20 years in prison if he is convicted of wire fraud.

Source link

tags

Abkhazia Afghanistan Africa Albania Algeria Andorra Angola Antigua and Barbuda Argentina Armenia Australia Austria Azerbaijan Bahamas Bahrain Bangladesh Barbados Belarus Belgium Belize Benin Bolivia Bosnia and Herzegovina Botswana Brazil Bulgaria Burkina Faso Burundi Cambodia Cameroon Canada Cape Verde Central African Republic Chad Chile China Colombia Comoros Costa Rica Croatia Cuba Curacao Cyprus Czech Republic Denmark Djibouti Dominica Dominican Republic East Timor Ecuador Egypt El Salvador Equatorial Guinea Eritrea Estonia Ethiopia Fiji Finland France French Polynesia Gabon Gambia Georgia Germany Ghana Greece Grenada Guam Guatemala Guinea Guyana Haiti Honduras Hong Kong Hungary Iceland India Indonesia Iran Iraq Ireland Israel Italy Jamaica Japan Jordan Kazakhstan Kenya Kiribati Kosovo Kuwait Kyrgyzstan Laos Latvia Lebanon Lesotho Liberia Libya Liechtenstein Lithuania Luxembourg Macau Madagascar Malawi Malaysia Maldives Mali Malta Mauritania Mauritius Mexico Moldova Monaco Mongolia Montenegro Morocco Mozambique Myanmar Namibia Nepal Netherlands New Zealand Nicaragua Niger Nigeria North Korea North Macedonia Northern Cyprus Norway Oman Pakistan Palestine Panama Papua New Guinea Paraguay Peru Philippines Poland Portugal Puerto Rico Qatar Republic of the Congo Romania Russia Rwanda Saint Lucia Samoa San Marino Saudi Arabia Senegal Serbia Sierra Leone Singapore Slovakia Slovenia Solomon Islands Somalia South Korea South Sudan Spain Sri Lanka Sudan Sweden Switzerland Syria Taiwan Tajikistan Tanzania Thailand Togo Tonga Trinidad and Tobago Tunisia Turkey Turkmenistan Uganda UK Ukraine United Arab Emirates Uruguay USA Uzbekistan Vatican City Venezuela Vietnam Western Sahara Yemen Zambia Zimbabwe