Year: 2022
Court filings and enforcement actions initiated or unsealed during calendar year 2022.
Key Facts
- 6 major cases opened or unsealed in 2022.
- Cumulative losses identified for 2022 matters exceed $8.0 billion.
- Documented from federal indictments and official government disclosures.
Documented Matters for 2022
U.S. v. James Zhong (Silk Road 50,000 Bitcoin Theft)
Historic seizure of over 50,676 Bitcoins ($3.36 billion at seizure) hidden in an underground floor safe and popcorn tin, stolen by James Zhong from the Silk Road darknet market in 2012 by triggering race conditions in the withdrawal logic.
U.S. v. Ilya Lichtenstein & Heather Morgan (Bitfinex Hack & Laundering)
Conviction of Ilya Lichtenstein and Heather Morgan for executing the 2016 hack of the Bitfinex virtual currency exchange, stealing 119,754 Bitcoins (valued at $4.5 billion at arrest), and laundering the funds through complex cryptocurrency mixers and darknet markets.
Viasat KA-SAT Satellite Modem Wiper Sabotage (AcidRain)
Russian state-sponsored operators exploited an unpatched Fortinet VPN gateway to access Viasat satellite network management segments, broadcasting malicious AcidRain wiper firmware that permanently bricked tens of thousands of satellite terminals across Ukraine and Europe.
Okta Customer Support Console Intrusion (LAPSUS$)
Teenage cyber extortion collective LAPSUS$ compromised a third-party customer support contractor (Sitel) workstation via an active RDP session, gaining access to Okta SuperUser administrative diagnostic tools affecting 366 enterprise tenants.
LastPass DevOps Engineer Home Breach & Vault Exfiltration
Adversaries compromised a senior DevOps engineer home computer by exploiting a remote code execution vulnerability in Plex Media Server, implanted keyloggers to capture master vault credentials, and exfiltrated encrypted customer password vaults from AWS S3 storage.
FTC v. Drizly, LLC & CEO James Cory Rellas (Personal Liability Consent Order)
Landmark Federal Trade Commission administrative enforcement action where the FTC held alcohol delivery marketplace Drizly and its CEO individually accountable for lax cybersecurity practices that exposed 2.5 million consumer records, requiring the CEO personally to implement comprehensive security programs at any company he leads for ten years.