iStockphoto
The Department of Justice announced this week the arrest of two more individuals on charges relating to the 2022 DraftKings customer hacking case.
Nathan Austad (AKA Snoopy), a 19-year-old from Minnesota, and Kamerin Stokes (AKA TheMFNPlug), a 21-year-old from Memphis, were charged in connection with a scheme to hack DraftKings customer accounts and sell access to those accounts in order to steal hundreds of thousands of dollars from them.
“As alleged, Nathan Austad and Kamerin Stokes were involved a scheme to hack into the accounts of tens of thousands of victims and then to sell access to those stolen accounts online,” said U.S. Attorney Damian Williams in a statement.
“Our office is relentless in tracking down the perpetrators of cybercrime. Earlier this month, we announced an SDNY Whistleblower Pilot Program to encourage early and voluntary self-disclosure of criminal activity. To all cybercriminals: call us before we call you.”
In the complaint, Austad and Stokes are charged with performing a credential stuffing attack where “a cyber threat actor collects stolen credentials, or username and password pairs, obtained from other large-scale data breaches of other companies, which can be purchased on the darkweb.”
U.S. Attorney's Office, Southern District of New York
They were also charged with attempting to log into DraftKing customer accounts.
“In some instances, the individuals who unlawfully accessed the Victim Accounts were able to add a new payment method on the account, deposit $5 into that account through the new payment method to verify that method, and then withdraw all the existing funds in the Victim Account through the new payment method (i.e., to a newly added financial account belonging to the hacker), thus stealing the funds in the Victim Account,” read the complaint.
On or about December 2, 2022, Austad wrote in a message to other alleged co-conspirators, “everyone 3hould’ve been prepared for this before cashing out lol.” A co-conspirator replied, “lol fbi can’t do s—.”
Austad and Stokes were charged with several crimes including conspiracy to commit computer intrusions, unauthorized access to a protected computer, unauthorized access to a protected computer to further intended fraud, wire fraud conspiracy, wire fraud, and aggravated identity theft.
Last year, the Department of Justice revealed $600,000 from 1,600 DraftKings accounts had been stolen by hackers breaking into customer accounts in November of 2022.
Charges were filed against an 18-year-old Wisconsin man named Joseph Garrison by the U.S. Attorney’s Office, Southern District of New York.
CNBC reported at that time that law enforcement authorities found credential stuffing programs, instruction photos on how to use stolen user credentials to steal money from victim accounts, and messages between Garrison and co-conspirators in a search of Garrison’s home.
Garrison was charged with conspiracy to commit computer intrusions, unauthorized access to a protected computer to further intended fraud, unauthorized access to a protected computer, wire fraud conspiracy, wire fraud and aggravated identity theft.
He plead guilty to one count of conspiracy to commit computer intrusion in November.