Florida man jailed after draining $1M from victims in crypto SIM swap attacks

A 20-year-old Florida man has been sentenced to 30 months down bars for his domiciled successful a SIM-swapping ringing that stole astir $1 cardinal successful cryptocurrency from dozens of victims.

Jordan Persad, of Orlando, was besides ordered to salary $945,833 successful restitution. He pleaded blameworthy to conspiracy to perpetrate machine fraud connected May 1. 

According to a plea statement reached pinch US prosecutors [PDF], betwixt astatine slightest March 2021 and September 2022, Persad and his co-conspirators, immoderate he only knew by their online handles, utilized SIM swapping to siphon costs from their marks.

What's absorbing is that this benignant of point is usually done by convincing a victim's mobile bearer to reassign nan mark's cellphone number to nan SIM successful nan scammer's phone. With that done, nan criminal tin petition password resets for nan victim's various online accounts; nan one-time verification codes successful matter messages to authenticate and alteration nan login specifications are sent to nan thief alternatively than nan victim's handheld, allowing nan accounts to beryllium hijacked.

The crook typically gets power of a victim's email first via this method, and erstwhile successful their inbox, resets much relationship passwords via email (or SMS) until nan thief tin get into things for illustration their victim's cryptocurrency wallets hosted by exchanges.

In Persad's case, his process was described successful a somewhat different albeit not needfully sequential order. In a statement, prosecutors said he "hacked into victims’ email accounts, hijacked their compartment telephone numbers, and gained unauthorized entree to their online cryptocurrency accounts."

And successful nan plea agreement, Persad said he obtained log files of people's email reside and password combinations; logged into people's webmail; took power of nan numbers associated pinch those marks' SIM cards; and past raided their crypto-wallets. So not rather nan aforesaid order, though nan consequence is nan same: money being drained from accounts.

"For example, connected aliases astir April 4, 2022, my co-conspirators and I accessed, without authorization, an internet-based cryptocurrency relationship belonging to Arizona resident JD," Persad, who was sentenced past week, confessed successful 1 tribunal document. "At my direction, 1 of my co-conspirators transferred astir $28,000 worthy of cryptocurrency from JD's cryptocurrency relationship to a cryptocurrency wallet utilized aliases controlled by my co-conspirator."

The unit past divided nan illicit proceeds from nan scam among themselves. 

In total, nan crooks stole astatine slightest $950,000 from their victims, and Persad says he personally kept astir $475,000 from nan fraud. According to nan US Justice Department, FBI investigators recovered immoderate of these costs erstwhile they executed hunt warrants astatine Persad's Orlando home.

• 23-year-old Brit linked to 2020 Twitter onslaught and SIM-swap strategy pleads guilty
• 'Baby Al Capone' to salary $22m to SIM-swap crypto-heist victim
• Microsoft unveils shady shenanigans of Octo Tempest and their cyber-trickery toolkit
• More Okta customers trapped successful Scattered Spider's web

This type of scam, arsenic good arsenic its timing, seems to travel nan Scattered Spider playbook. The Register asked the US Attorney's Office successful Phoenix, Arizona, which prosecuted nan case, if Persad is connected to this loose-knit group of cybercriminals and did not person a response.  

Scattered Spider is nan Lapsus$-like, English-speaking pack of teens and early 20-somethings that sewage their cybercrime commencement pinch SIM swapping and email and SMS phishing attacks successful 2022 earlier branching into ransomware and extortion.

The group is now thought to beryllium an AlphV connection — AlphV aka BlackCat is simply a ransomware-as-a-service (RaaS) unit — and successful September claimed work for nan extortion attacks against Caesars Entertainment (that paid nan ransom) and MGM Resorts (that did not discuss pinch nan crooks). ®