The US Department of Justice has charged three young individuals (including one juvenile) with hacking Twitter last month that compromised the accounts of 130 high-profile celebrities, politicians and businesses like Barack Obama, Joe Biden, Bill Gates, Jeff Bezos, Elon Musk, Apple and Uber.
The 19-year-old Mason Sheppard (aka “Chaewon”) of the UK was charged in a criminal complaint in the Northern District of California with conspiracy to commit wire fraud, conspiracy to commit money laundering, and the intentional access of a protected computer.
“Nima Fazeli, aka “Rolex,” 22, of Orlando, Florida, was charged in a criminal complaint in the Northern District of California with aiding and abetting the intentional access of a protected computer,” the Department of Justice said in a statement on Friday.
The third defendant is a juvenile.
“With exceptions that do not apply to this case, juvenile proceedings in federal court are sealed to protect the identity of the juvenile,” said the statement.
Twitter has revealed that the massive hack that spread a cryptocurrency scam by hijacking accounts of high-profile celebrities, politicians and businesses was a result of a phone spear phishing attack.
The attackers targeted 130 Twitter accounts, ultimately tweeting from 45, accessing the DM (Direct Messages) inbox of 36, and downloading the Twitter data of seven accounts.
The incident raised concerns around Twitter tools and levels of employee access.
“The hackers allegedly compromised over 100 social media accounts and scammed both the account users and others who sent money based on their fraudulent solicitations,” said Acting Assistant Attorney General Brian C. Rabbitt of the Justice Department’s Criminal Division.
As alleged in the complaints, the Twitter attack consisted of a combination of technical breaches and social engineering.
“There is a false belief within the criminal hacker community that attacks like the Twitter hack can be perpetrated anonymously and without consequence,” said US Attorney David L. Anderson for the Northern District of California.
The hackers are alleged to have created a scam Bitcoin account, to have hacked into Twitter VIP accounts, to have sent solicitations from the Twitter VIP accounts with a false promise to double any Bitcoin deposits made to the scam account, and then to have stolen the Bitcoin that victims deposited into the scam account.
As alleged in the complaints, the scam Bitcoin account received more than 400 transfers worth more than $100,000.
“Today’s announcement proves that cybercriminals can no longer hide behind perceived global anonymity,” said Thomas Edwards, Special Agent in Charge, US Secret Service, San Francisco Field Office.
Twitter said that since the attack, it has significantly limited access to its internal tools and systems to ensure ongoing account security.
As a result, some features — namely, accessing the Your Twitter Data download feature — and processes have been impacted.
Twitter said it will be slower to respond to account support needs, reported tweets, and applications to its developer platform.
