Sixth member of notorious SIM-swapping cybercrime gang sentenced

US crime syndicate ‘The Community’ stole millions of dollars’ worth of cryptocurrency

The final member of an international hacking group known as ‘The Community’ has been sentenced for his role in a multimillion-dollar SIM-swapping campaign.

Garrett Endicott, 22, of Warrensburg, Missouri, has become the sixth member of the crime syndicate to have been jailed for the campaign, which saw millions of dollars’ worth of cryptocurrency stolen from victims.

Endicott, who pleaded guilty, will spend less than a year in custody for his part in the crime.

SIM hijacking

According to a statement from the US Department of Justice (DoJ), the SIM hijacking campaign “was often facilitated by bribing an employee of a mobile phone provider”.

“Other times, SIM hijacking was accomplished by a member of The Community contacting a mobile phone provider’s customer service – posing as the victim – and requesting that the victim’s phone number be swapped to a SIM card (and thus a mobile device) controlled by The Community.”

RELATED SIM swap fraud – an explainer

Once the perpetrators had control of a victim’s phone number, that number was leveraged as a gateway to gain control of online accounts such as a victim’s email, cloud storage, and high-value cryptocurrency accounts.

They could then reset passwords on online accounts and/or request two-factor authentication (2FA) codes that allowed them to bypass security measures.

Members of The Community used this method to steal cryptocurrency from victims across the US including those in California, Missouri, Michigan, Utah, Texas, New York, and Illinois.

The DoJ said: “In total, The Community’s scheme resulted the theft of tens of millions of dollars’ worth of cryptocurrency.

“Individual victims lost cryptocurrency valued, at the time of theft, ranging from under $2,000 to over $5 million.”

Meet the SIMs

Endicott was sentenced to 10 months in prison and ordered to pay more than $121,000 in restitution.

He is the sixth member of the cybercrime gang to be sentenced. According to the DoJ, other known perpetrators include:

Ricky Handschumacher, 28, of Pasco Country, Florida, who was sentenced to 48 months in prison and ordered to pay restitution in the amount of $7,681,570.03

Colton Jurisic, 22, of Dubuque, Iowa who was sentenced to 42 months in prison and ordered to pay restitution in the amount of $9,517,129.29

Reyad Gafar Abbas, 22, of Charleston, South Carolina, who was sentenced to 24 months in prison and ordered to pay restitution in the amount of $310,791.90

Ryan Stevenson, 29, of West Haven, Connecticut, who pleaded guilty and was sentenced to probation in the District of Connecticut

Conor Freeman, 22, of Dublin, Ireland, who pleaded guilty to parallel charges in Ireland and was sentenced to three years in prison by an Irish court

“The actions of these defendants resulted in the loss of millions of dollars to the victims, some of whom lost their entire retirement savings,” said acting US attorney Saima Mohsin.

“This case should serve as a reminder to all of us to protect our personal and financial information from those who seek to steal it.”