A British national, Tyler Robert Buchanan, 24, of Dundee, Scotland, has pleaded guilty in a US court to conspiracy to hack into dozens of companies and to stealing cryptocurrency, according to the Department of Justice. He admitted to conducting SMS phishing attacks that bombarded victims’ employees with hundreds of messages linking to phishing sites to harvest credentials and PII, which enabled him and co-conspirators to access accounts and steal sensitive information.
They used a phishing kit to capture credentials and send them to a Telegram channel Buchanan and a co-conspirator managed, and he admitted to identifying virtual currency accounts and wallets of numerous individuals, with at least $8 million in cryptocurrency stolen from US victims. The conspirators relied on SIM swapping to bypass MFA and intercept two-factor authentication codes, allowing access to victims’ accounts.
Buchanan is scheduled for sentencing on 21 August, and his co-conspirator Noah Michael Urban was sentenced to 10 years in prison last August; three other individuals are also charged in the case, all linked to the Scattered Spider group.