A Vancouver man was sentenced Thursday in federal court to 13 months prison time for his part in a large-scale online attack that affected hundreds of thousands of DVRs, internet routers, fiber-optic networking devices and surveillance camera systems.
Kenneth Currin Schuchman, 22, pleaded guilty in September in U.S. District Court in Anchorage, Alaska, to aiding and abetting computer intrusions.
As part of his sentence, Schuchman was also ordered to serve 18 months of community confinement following his release from prison and a three-year term of supervised release, according to a news release from the U.S. Attorney’s Office District of Alaska.
From at least July 2017 through October 2018, Schuchman and two known co-conspirators hijacked connected, internet-enabled devices, including 650,000 DVRs. These networks of compromised devices, known as “botnets,” were used to overwhelm larger computer networks, rendering them inaccessible during the attack and ultimately hijacking them, according to the plea agreement.
“Criminals often target so-called ‘Internet of Things’ devices such as home DVRs, internet routers and smart camera systems. These devices can be subject to wide-scale credential vulnerabilities that can permit criminal actors to exploit substantial numbers of these devices simultaneously and develop botnets at scale,” according to Schuchman’s plea agreement.
Schuchman specialized in researching and identifying vulnerable devices for attack, according to the plea agreement.
He and his co-conspirators called their botnets “Satori,” “Masuta” and “Okiru,” and sold them to other hackers, who paid in cryptocurrency and other online payment methods.
The plea agreement says Schuchman continued creating botnets after he was charged in August 2018, and orchestrated a “swatting” attack in October against one of his co-conspirators that resulted in a “substantial law enforcement response.”
In a recently unsealed indictment, Schuchman’s criminal associates Aaron Sterritt, aka “Vamp,” of the United Kingdom, and Logan Shwydiuk, aka “Drake,” a Canadian national, were charged for their roles in the scheme. They were previously identified by their online aliases in court records.
“Cybercriminals depend on anonymity, but remain visible in the eyes of justice,” said U.S. Attorney Bryan Schroder. “(Schuchman’s) sentencing should serve as a reminder that together with our law enforcement and private sector partners, we have the ability and resolve to find and bring to justice those that prey on Alaskans and victims across the United States.”
