For five years, several AT&T employees were conspiring with a Pakistani man to install malware on company computers so that man could unlock millions of smartphones subsidized by the carrier, according to federal investigators.
On Tuesday, the Justice Department unsealed an indictment against Muhammad Fahd for bribing AT&T employees at a call center in Washington state to pull off the scheme. According to the feds, Fahd allegedly paid more than $1 million in bribes to the AT&T employees during the conspiracy, which allowed him to fraudulently unlock more than 2 million AT&T phones from 2012 to 2017.
Fahd allegedly partnered with businesses that offered cell phone unlocking services in exchange for a fee. These unnamed business would then supply him with the IMEI numbers of the phones bound to AT&T's network.
Initially, Fahd kicked off his scheme in 2012 by simply wiring the IMEI numbers to the rogue AT&T employees, who had access to internal computers capable of unlocking a smartphone from the carrier's network. However in April 2013, Fahd took things further by bribing the employees to install malware on AT&T's internal computers, so he could control the systems from afar.
The malware used valid AT&T login credentials to control the carrier's computers and process automated unlock requests sent by Fahd's external servers. AT&T uncovered the malware and the rogue employees who installed it in October 2013. Although those employees left the company, Fahd continued recruiting and bribing other AT&T insiders to help him re-plant the malware. One AT&T employee allegedly received $428,500 over the five-year period.
Fahd was arrested in February 2018 in Hong Kong and extradited to the US last Friday, federal authorities said in today's announcement. He is being charged with conspiracy to commit wire fraud and hacking computers; each charge is punishable by up to 20 years in prison.
"We have been working closely with law enforcement since this scheme was uncovered to bring these criminals to justice and are pleased with these developments," AT&T said in a statement. No customer information was breached.
Still, the scheme is pretty unsettling; one man was able to break into a major wireless carrier in the US by simply bribing employees. According to the indictment, Fahd allegedly recruited the AT&T employees by using telephone calls, Facebook, and other channels. He then instructed them to buy pre-paid "burner" phones, use anonymous email accounts, and create shell companies so he could communicate and pay them without alerting the authorities.
According to federal investigators, three of Fahd's other co-conspirators have so far pleaded guilty to accepting the bribes.