NEW YORK (DOJ) – Joseph Garrison pled guilty today to conspiracy to commit computer intrusion in connection with a scheme to hack user accounts at a fantasy sports and betting website (the “Betting Website”) and sell access to those accounts in order to steal hundreds of thousands of dollars from them. Garrison pled guilty.
U.S. Attorney Damian Williams said: “Joseph Garrison and his co-conspirators launched an online cyberattack, stealing approximately $600,000 from innocent victims’ accounts. Garrison now stands convicted of a federal crime for targeting the accounts of victims making legitimate online wagers.”
According to the charging documents and other filings and statements made in court:
On or about November 18, 2022, Garrison launched a “credential stuffing attack” on the Betting Website. During a credential stuffing attack, a cyber threat actor collects stolen credentials or username and password pairs obtained from large-scale data breaches of companies that can be purchased on the dark web. The threat actor then systematically attempts to use those stolen credentials to obtain unauthorized access to accounts held by the same user with other companies and providers in order to compromise accounts where the user has maintained the same password. Here, in connection with the attack on the Betting Website, there was a series of attempts to log into the Betting Website accounts using a large list of stolen credentials.
Garrison and others successfully accessed approximately 60,000 accounts at the Betting Website (the “Victim Accounts”) through the credential stuffing attack. In some instances, the individuals who unlawfully accessed the Victim Accounts were able to add a new payment method on the account, deposit $5 into that account through the new payment method to verify that method, and then withdraw all the existing funds in the Victim Account through the new payment method (i.e., to a newly added financial account belonging to the hacker), thus stealing the funds in the Victim Account. Using this method, GARRISON and others stole approximately $600,000 from approximately 1,600 Victim Accounts.
Law enforcement executed a search on Garrison’s home in February 2023. In that search, they located programs typically used for credential stuffing attacks. Those programs require individualized “config” files for a target website to launch credential stuffing attacks, and law enforcement located approximately 700 such config files for dozens of different corporate websites on Garrison’s computer. Law enforcement also located files containing nearly 40 million username and password pairs on Garrison’s computer, which are also used in credential stuffing attacks.
On Garrison’s cellphone, law enforcement also located conversations between Garrison and his co-conspirators, which included discussions about how to hack the Betting Website and how to profit from the hack of the Betting Website by extracting funds from the Victim Accounts directly or by selling access to the Victim Accounts. In one particular conversation, Garrison discussed, in substance and in part, how successful he was at credential stuffing attacks, how much he enjoyed credential stuffing attacks, and how Garrison believed that law enforcement would not catch or prosecute him. Specifically, Garrison messaged the following, in substance and in part: “fraud is fun . . . im addicted to see money in my account . . . im like obsessed with bypassing shit.”
* * *
Garrison, 19, of Madison, Wisconsin, pled guilty to one count of conspiring to commit computer intrusion, which carries a maximum sentence of five years in prison.
News by Breaking911
