{"id":7271,"date":"2025-02-10T15:18:11","date_gmt":"2025-02-10T21:18:11","guid":{"rendered":"https:\/\/www.darkreading.com\/cyber-risk\/guilty-plea-in-hacking-of-the-sec-s-x-account-that-caused-bitcoin-value-spike"},"modified":"2025-02-10T15:18:11","modified_gmt":"2025-02-10T21:18:11","slug":"guilty-plea-in-hacking-of-the-secs-x-account-that-caused-bitcoin-value-spike","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2025\/02\/10\/guilty-plea-in-hacking-of-the-secs-x-account-that-caused-bitcoin-value-spike\/","title":{"rendered":"Guilty Plea in Hacking of the SEC’s X Account That Caused Bitcoin Value Spike"},"content":{"rendered":"
<\/a><\/div>\n
<\/div>\n

PRESS RELEASE<\/span><\/span><\/p>\n

WASHINGTON \u2013<\/span><\/span> Eric Council, 25, of Athens, Alabama, entered a guilty plea today to one count of conspiracy to commit aggravated identity theft in United States District Court for the District of Columbia. Council was arrested on October 17, 2024, in connection with his role in a conspiracy to hack into the X account of the U.S. Securities and Exchange Commission (SEC) and publish fraudulent posts in the name of the then-SEC Chairman. <\/span><\/p>\n

The plea was announced by U.S. Attorney Edward R. Martin, Jr., Supervisory Official Antoinette T. Bacon of the Justice Department\u2019s Criminal Division, SEC Inspector General Deborah Jeffrey and FBI Special Agent in Charge Sean Ryan of the Washington Field Office, Criminal and Cyber Division.<\/span><\/p>\n

Council\u2019s plea was entered before U.S. District Court Judge Amy Berman Jackson in the District of Columbia. He faces a maximum sentence of five years in prison, a $250,000 fine, and up to three years of supervised release. His sentencing is scheduled for May 16, 2025.<\/span><\/p>\n

According to court documents, from at least January 2024, Council conspired with others to carry out Subscriber Identity Model (SIM) attacks, commonly referred to as \u201cSIM swaps,\u201d in exchange for money. <\/span><\/p>\n

A SIM card is a chip that stores information identifying and authenticating a cell phone subscriber and connects a physical cell phone to a mobile carrier\u2019s cellular and data network. A SIM swap attack is a form of sophisticated fraud where criminal actors fraudulently induce a mobile carrier to reassign a mobile phone number from a victim\u2019s SIM card to a SIM card and telephone controlled by a criminal actor attempting to access valuable information associated with the victim\u2019s telephone. Members of SIM swapping groups conduct SIM swaps for the purpose of defeating multifactor authentication and\/or two-step verification security features for internet connected accounts, such as social media and virtual currency accounts. <\/span><\/p>\n

After convincing a mobile carrier to reassign a phone number to a new SIM card in the criminal actor\u2019s control, members of the conspiracy generate password reset security authentication codes for online accounts and those codes are in turn sent to the telephone in the control of the criminal actor. Members of SIM swap groups share the security reset codes with one another to unlawfully access a victim\u2019s internet connected accounts and complete the fraud. <\/span><\/p>\n

On or about January 9, 2024, Council, and others, executed a SIM swap of the mobile phone account associated with the @SECgov X account, the official account of the SEC. The purpose of this SIM swap was to gain unauthorized access to this government account in order to make fraudulent posts. <\/span><\/p>\n

Before January 9, a member of the conspiracy had identified the authorized user for the phone number linked to the official @SECgov X account. Council received instruction from a co-conspirator to perform the SIM swap on this phone line, along with information to make the needed fake ID, that is, an image of an ID card template with the authorized user\u2019s name on it but Council\u2019s face, and information purporting to be the user\u2019s date of birth and social security number. <\/span><\/p>\n

Council used his portable ID card printer to create a physical ID which he used to impersonate the victim at an AT&T store in Huntsville, Alabama. Council provided false information to the AT&T store employee to explain why he needed a replacement SIM card. Council obtained the SIM card linked to the victim\u2019s phone line and walked to a nearby Apple store where he purchased a new iPhone to use in the crime.  He inserted the SIM card to activate the phone, received the @SECGov X password reset codes on this new phone linked to the victim\u2019s SIM card and used his personal cell phone to take a photo of the @SECgov X account reset code to share with his co-conspirators. After passing along the password reset codes, Council drove to Birmingham, Alabama and immediately returned the iPhone for cash.   <\/span><\/p>\n

A member of the conspiracy used the reset code to gain access to the @SECGov X account and issue a fraudulent post in the name of the then-SEC Chairman, falsely announcing SEC approval of Bitcoin (BTC) Exchange Traded Funds (ETFs). The price of BTC increased by more than $1,000 following the post. Shortly after this unauthorized post, the SEC regained control over their X account and confirmed that the announcement was unauthorized and the result of a security breach, which caused the value of BTC decreased by more than $2,000.<\/span><\/p>\n

Council also admitted to attempting to perform additional SIM swaps in June 2024 in Alabama. In June 2024, the FBI executed a search warrant at an Athens, Alabama, apartment where he resided. Agents recovered a fake identification card and a portable ID card printer. They also recovered a laptop computer.  <\/span><\/p>\n

Pursuant to the search warrant, agents searched the laptop and discovered templates for additional fake identification cards stored on the laptop along with internet searches for<\/span><\/p>\n

\u201cSECGOV hack,\u201d \u201ctelegram sim swap,\u201d \u201chow can I know for sure if I am being investigated by the FBI,\u201d \u201cWhat are the signs that you are under investigation by law enforcement or the FBI even if you have not been contacted by them,\u201d \u201cwhat are some signs that the FBI is after you,\u201d \u201cVerizon store list,\u201d \u201cfederal identity theft statute,\u201d and \u201chow long does it take to delete telegram account.\u201d <\/span><\/p>\n

Council admitted to receiving approximately $50,000 from members of the conspiracy to perform SIM swap during the previous six months.   <\/span><\/p>\n

This case is being investigated by the FBI Washington Field Office Criminal and Cyber Division, the SEC-Office of Inspector General, the U.S. Attorney\u2019s Office for the District of Columbia, and the Computer Crime and Intellectual Property Section (CCIPS) and Fraud Section\u2019s Market Integrity and Major Frauds Unit of the Justice Department\u2019s Criminal Division. Significant assistance was provided by the FBI\u2019s Birmingham Field Office.<\/span><\/p>\n

The prosecution is being handled by Assistant United States Attorney Kevin Rosenberg, CCIPS Trial Attorney Ashley Pungello, and Fraud Section Trial Attorney Lauren Archer. Valuable assistance was provided by Assistant United States Attorney John Hundscheid from the Northern District of Alabama.<\/span><\/p>\n

For more information on SIM swapping, go to: <\/span>https:\/\/www.ic3.gov\/PSA\/2024\/PSA240411<\/a><\/span><\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

PRESS RELEASE WASHINGTON \u2013 Eric Council, 25, of Athens, Alabama, entered a<\/p>\n","protected":false},"author":12,"featured_media":7272,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[809],"class_list":["post-7271","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-dark-reading"],"featured_image_urls":{"full":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/guilty-plea-in-hacking-of-the-secs-x-account-that-caused-bitcoin-value-spike.png?fit=3840%2C2160&ssl=1",3840,2160,false],"thumbnail":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/guilty-plea-in-hacking-of-the-secs-x-account-that-caused-bitcoin-value-spike.png?resize=150%2C150&ssl=1",150,150,true],"medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/guilty-plea-in-hacking-of-the-secs-x-account-that-caused-bitcoin-value-spike.png?fit=300%2C169&ssl=1",300,169,true],"medium_large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/guilty-plea-in-hacking-of-the-secs-x-account-that-caused-bitcoin-value-spike.png?fit=640%2C360&ssl=1",640,360,true],"large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/guilty-plea-in-hacking-of-the-secs-x-account-that-caused-bitcoin-value-spike.png?fit=640%2C360&ssl=1",640,360,true],"1536x1536":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/guilty-plea-in-hacking-of-the-secs-x-account-that-caused-bitcoin-value-spike.png?fit=1536%2C864&ssl=1",1536,864,true],"2048x2048":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/guilty-plea-in-hacking-of-the-secs-x-account-that-caused-bitcoin-value-spike.png?fit=2048%2C1152&ssl=1",2048,1152,true],"chromenews-featured":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/guilty-plea-in-hacking-of-the-secs-x-account-that-caused-bitcoin-value-spike.png?fit=1024%2C576&ssl=1",1024,576,true],"chromenews-large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/guilty-plea-in-hacking-of-the-secs-x-account-that-caused-bitcoin-value-spike.png?resize=825%2C575&ssl=1",825,575,true],"chromenews-medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/guilty-plea-in-hacking-of-the-secs-x-account-that-caused-bitcoin-value-spike.png?resize=590%2C410&ssl=1",590,410,true]},"author_info":{"display_name":"Dark Reading","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/darkreading\/"},"category_info":"Uncategorized<\/a>","tag_info":"Uncategorized","comment_count":"0","jetpack_featured_media_url":"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/guilty-plea-in-hacking-of-the-secs-x-account-that-caused-bitcoin-value-spike.png?fit=3840%2C2160&ssl=1","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/7271","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=7271"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/7271\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media\/7272"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=7271"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=7271"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=7271"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}