The U.S. Department of Justice (DOJ) announced the arrest of Nickolas Sharp, an individual accused by the Federal Bureau of Investigation (FBI) of having exposed the confidential information of his former employer. Authorities argue that the defendant stole thousands of confidential records from a New York-based wireless communications firm he used to work for.
Once he had the confidential information under his control, the defendant tried to extort money from the company, demanding payment of $2 million USD in exchange for returning these records and identifying a backdoor that the defendant would have exploited to access this data.
The attacker didn’t stop there, as after threatening the company he began leaking false reports about the way the firm was addressing the leak, leading to a 20% drop in the company’s stock price.
After days of uncertainty, authorities identified Sharp and arrested him Wednesday.
The DOJ mentions that Sharp abused his role as Amazon Web Services (AWS) cloud administrator at the affected company to download sensitive data sometime in 2020. Sharp subsequently sent a company representative an anonymous ransom note demanding payment of 50 Bitcoin, about $2 million USD depending on the exchange rate at the time of the attack.
After the company refused to pay, the defendant would post a sample of the stolen information on a publicly accessible online platform.
The defendant also caused severe damage to the company’s IT infrastructure during his intrusion, as he modified access and security policies in order to go unnoticed while stealing sensitive information. The FBI adds that the defendant used the Surfshark VPN service to hide the IP address from which the malicious activity was initiated.
Despite his attempts to cover his tracks, Sharp made a critical mistake, briefly exposing his home’s IP address during one of his intrusions; using this data, the agents obtained a search warrant, during which they seized multiple electronic equipment.
Michael Driscoll, deputy director of the FBI’s New York office, said, “Mr. Sharp created a plot to extort money from the company he worked for using his technology and data against him, in clear violation of multiple federal laws.”
If found guilty, the defendant faces up to 20 years in prison.
To learn more about information security risks, malware variants, vulnerabilities and information technologies, feel free to access the International Institute of Cyber Security (IICS) websites.
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He also worked for security companies like Kaspersky Lab. His everyday job includes researching about new malware and cyber security incidents. Also he has deep level of knowledge in mobile security and mobile vulnerabilities.
