British cybercriminal sentenced to five years in prison in the US

On June 23, 2023, Joseph O’Connor, aka “PlugwalkJoe”, a 24-year old UK cybercriminal, was sentenced to five years in prison, three years probation and a 794,012.64 USD (around 724,000 EUR) seizure. He appeared jointly before California and New York State courts in two separate cases. The accused pled guilty to all ten counts. Arrested in Spain, where he spent some time, he was extradited to the US in April 2023.

The most high profile of the two cases, tried in California, was the spectacular hack of Twitter on July 15, 2020. Hackers took control of many popular accounts on the social network and used them to tweet out a Bitcoin scam.

PlugwalkJoe was a member of the cybercriminal group that managed to access Twitter’s internal tools after a telephone conversation with an employee of the social network. They then gained control of a significant number of accounts. The brains behind the operation, a US national who was only 17 at the time, Graham Ivan Clarke, was sentenced to three years in 2021.

The second case, tried in the State of New York, deals with fraud and harassment campaigns, which all start with an exchange of SIM cards. Joseph O’Connor specialized in this type of attack; he would take control of the victim’s phone by impersonating them and requesting a new SIM card from their provider.

The cybercriminal admitted to hacking the accounts of several crypto investors, stealing around 1.6 million USD (1.46 million EUR). He also gained access to the Snapchat accounts of several female celebrities, stealing nude photos to blackmail them.

If his extortion attempts failed, he used a harassment technique known as “swatting”, which involves reporting a shooting or hostage situation at the victim’s home to trigger a heavily-armed and ready-to-kill SWAT team response.

Joseph O’Connor also admitted to cyber harassing and swatting a 16-year old girl, sending her nude photos and threatening to rape and murder her.