SEC SIM-swapper who Googled 'signs that the FBI is after you' put behind bars
- Reference: 1747681326
- News link: https://www.theregister.co.uk/2025/05/19/sim_swapper_sec_x_account/
- Source link:
Prior to his conviction and sentencing on Friday, Eric Council Jr., 26, of Huntsville, Alabama, proved once again that cybercriminals are very bad at internet search hygiene.
Council used his personal computer to search "SECGOV hack," "telegram sim swap," "how can I know for sure if I am being investigated by the FBI," "Federal identity theft statute," and other incriminating phrases, according to court documents
[1]PDF
.[2]
The 26-year-old [3]pleaded guilty in February to conspiracy to commit aggravated identity theft and access device fraud after he and others [4]took over the SEC's X account in January 2024. The crew used the compromised account to post a message that purported to come from then-SEC chair [5]Gary Gensler and falsely announced that the government had approved Bitcoin exchange-traded funds (ETFs).
[6]
[7]
According to the DOJ, the hoax message triggered a jump of more than $1,000 in Bitcoin's price. After the federal regulator regained control of the compromised account and posted a retraction, the value dropped by over $2,000.
Council and his co-conspirator compromised the social media account via SIM-swapping someone who had access to the SEC's X account. SIM swapping is a scam where crooks trick a mobile carrier into transferring a victim's number to a SIM they control, letting them hijack calls, texts, and login codes. The court documents identify the victim as "C.L.," and detail how Council tricked an employee at an AT&T store in Huntsville.
[8]
In early January 2024, Council obtained the victim C.L.'s personal information from co-conspirators and used it to create a fake ID with the help of an ID card printer.
He showed an in-store AT&T employee the phony ID, told the worker that he was an FBI employee who had broken his phone and needed a new SIM card, and then obtained a new SIM card linked to C.L.'s account.
Council then visited a nearby Apple store, bought an iPhone, and put the C.L. SIM card into this new mobile phone to receive two-factor security reset codes associated with the @SECGov X account.
[9]
He shared the reset code with his co-conspirator, who used it to access the SEC's X account and post a false announcement about the approval of Bitcoin ETFs. Following this, Council returned the iPhone for a cash refund.
[10]Alleged Bitcoin crook faces 5 years after SEC's X account pwned
[11]Man who SIM-swapped the SEC's X account pleads guilty
[12]Alleged Scattered Spider SIM-swapper must pay back $13.2M to 59 victims
[13]Coinbase extorted for $20M. Support staff bribed. Customers scammed. One hell of a SNAFU
"The deliberate takeover of a federal agency's official communications platform was a calculated criminal act meant to deceive the public and manipulate financial markets," said FBI Criminal Investigative Division Acting Assistant Director Darren Cox in a [14]statement after the sentencing.
"By spreading false information to influence the markets, Council attempted to erode public trust and exploit the financial system," he continued. "Today's sentencing makes clear that anyone who abuses public platforms for criminal gain will be held accountable." ®
Get our [15]Tech Resources
[1] https://regmedia.co.uk/2025/05/19/eric_council_jr_sim_swapping_indictment.pdf
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aCup-p7sa6JUvdGChK10gwAAAEg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.theregister.com/2025/02/11/sim_swapped_guilty_plea/
[4] https://www.theregister.com/2024/10/18/sec_bitcoin_arrest/
[5] https://www.theregister.com/2025/01/20/trump_meme_coin/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aCup-p7sa6JUvdGChK10gwAAAEg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aCup-p7sa6JUvdGChK10gwAAAEg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aCup-p7sa6JUvdGChK10gwAAAEg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aCup-p7sa6JUvdGChK10gwAAAEg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[10] https://www.theregister.com/2024/10/18/sec_bitcoin_arrest/
[11] https://www.theregister.com/2025/02/11/sim_swapped_guilty_plea/
[12] https://www.theregister.com/2025/04/07/scattered_spider_sim_swap/
[13] https://www.theregister.com/2025/05/15/coinbase_extorted_for_20m_support/
[14] https://www.justice.gov/opa/pr/alabama-man-sentenced-14-months-connection-securities-and-exchange-commission-x-hack-spiked
[15] https://whitepapers.theregister.com/
I wonder if anything happened
To whoever bought that returned iPhone after it was resold? Did the FBI track down the BSSID of that iPhone and haul in its unaware "second" owner for questioning?
Re: I wonder if anything happened
Are you assuming they are actually competent?
I'm an Author
I've Googled everything from nerve gas types, how to construct a tactical nuclear weapon, napalm and types of plastic explosive. And that was just last Thursday. :P
If that's all it takes to get on the US three letter agencies naughty step, then I'm on that list several times over by this point. My juicier AI queries were performed on my own private LLM.
Knowledge, in and of itself, is not criminal. Many governments want you to isolated from that info "for your own protection." Sod that. Many advances have come from bright people with that knowledge making amazing technology for everyone's benefit. When your politicians filter 'dangerous' info, it's only a matter of time until they filter info dangerous to them.
Re: I'm an Author
Another bad reader...
bad "internet search hygiene" - this is where you leave your DNA all over the tools you used to break into the safe, then leave the tools laying around. You may be clever, but you are not smart.
Chicken or the egg?
The article wasn't very clear in my opinion, but it seems like the FBI found the suspicious searches after confiscating the scammer's computer. That is, it seems like the searches were evidence of his guilt, not the reason he got nabbed.
Re: I'm an Author
Quote
"I've Googled everything from nerve gas types, how to construct a tactical nuclear weapon, napalm and types of plastic explosive. And that was just last Thursday."
The hardest part of building your own nuclear weapon has always been getting the plutonium off Aldermarston, even offering them 20 million just for 10Kg just gets you on the naughty list.
Oh well... back to building my own nuclear reactor
Re: I'm an Author
Oh well... back to building my own nuclear reactor
[1] DIY-Nuclear-Generator
[1] https://www.instructables.com/DIY-Nuclear-Generator/
Re: I'm an Author
I've Googled everything from nerve gas types, how to construct a tactical nuclear weapon, napalm and types of plastic explosive. And that was just last Thursday. :P
I remember once I made a Usenet post that mentioned the "World Trade Center" and "US Department of Defense".
The date? September 10, 2001.
I was discussing British Vs American spelling and said how those are proper nouns they don't get translated to British. It was pure fluke those were the examples that came immediately to mind.
Never had any official comeback from it but it beggars belief it didn't pass at least one spook's desk after the following day.
Of course, the day after that the British papers were full of accounts of something that happened at the "World Trade Centre", wherever that is.
proved once again that cybercriminals are very bad at internet search hygiene.
Is it really fair to generalize about cybercrims, based on one from Alabama ?
Properly roasted
Anybody that got duped should be put under conservatorship. This is another example of why government using social media to announce things is improper. If the SEC had a running news page on the SEC.gov website, it would be an easy way for people to get correct information straight from the Donkey's/Rhino's orifice. Lesson #34: don't believe anything you read on social media.
We have to applaud the thriftiness of this SIM swapper
"He shared the reset code with his co-conspirator, who used it to access the SEC's X account and post a false announcement about the approval of Bitcoin ETFs. Following this, Council returned the iPhone for a cash refund."
After helping to profit from some dodgy (now read DOGEy) messages, he was polite enough to recycle the iPhone. See - humanity is not lost on these types.