Angela Lang/CNET
A Florida teenager is accused of being the “mastermind” behind a massive Twitter hack earlier this month that hijacked the accounts of dozens of high-profile politicians, celebrities and businesses to peddle a bitcoin scam. Hillsborough State Attorney Andrew Warren filed 30 felony charges against 17-year-old Graham Ivan Clark, who was arrested Friday.
The US Department of Justice also filed charges against two other people, UK resident Mason Sheppard and Florida resident Nima Fazeli, for their alleged role in the hack.
“These crimes were perpetrated using the names of famous people and celebrities, but they’re not the primary victims here,” said Warren in a release. “This ‘Bit-Con’ was designed to steal money from regular Americans from all over the country, including here in Florida.”
The scam bitcoin account received more than 400 transfers worth more than $100,000, according to the DOJ.
Clark faces charges including organized fraud, communications fraud and fraudulent use of personal information. Sheppard faces charges including conspiracy to commit wire fraud and conspiracy to commit money laundering, while Fazeli is charged with aiding and abetting the intentional access of a protected computer.
“There is a false belief within the criminal hacker community that attacks like the Twitter hack can be perpetrated anonymously and without consequence,” said US Attorney David Anderson in a release. “Criminal conduct over the Internet may feel stealthy to the people who perpetrate it, but there is nothing stealthy about it.”
Twitter on Thursday said the hack — which targeted the accounts of Elon Musk, Bill Gates, Kanye West, Barack Obama and other celebrities — was the result of a spearphishing attack. Twitter said the attackers needed both access to Twitter’s internal network and employee credentials that granted access to specific support tools.
The hackers allegedly relied on an approach that typically involves bogus emails disguised as legitimate ones to fool recipients into revealing passwords or other sensitive information. Twitter said 130 accounts were targeted in the attack, with hackers managing to tweet from 45 accounts, accessing the direct message inboxes of 36 accounts and downloading the Twitter data from seven.
In a statement posted to Twitter on Friday, the company said it appreciates the “swift actions of law enforcement in this investigation and will continue to cooperate as the case progresses.” Twitter added that it’ll continue to provide updates.
We appreciate the swift actions of law enforcement in this investigation and will continue to cooperate as the case progresses. For our part, we are focused on being transparent and providing updates regularly.
For the latest, see here 👇 https://t.co/kHty8TXaly
— Twitter Comms (@TwitterComms) July 31, 2020