Ubiquiti Insider Nickolas Sharp Pleads Guilty to Breach and Is Sentenced to Six Years
· 36:12 · Watch on YouTube ↗
Summary
Ubiquiti cloud engineer Nickolas Sharp used company access to download private repositories, hide evidence and extort the company. He pleaded guilty to three counts and was sentenced to six years in prison.
Key points
- Sharp used his Ubiquiti credentials to access the AWS environment and locate a key to other company credentials.
- Using a shared, high-privilege GitHub account over a VPN, he cloned more than 100 private repositories and their histories to his personal computer.
- He changed AWS log-retention settings and renamed sessions to conceal activity.
- GitHub logs recorded his home IP, and router data showed a separate MacBook transferring a similar volume of data during the incident.
- Sharp demanded 25 bitcoin and threatened to publish stolen data; he later uploaded it to a public Keybase folder, which Keybase removed after Ubiquiti contacted the service.
- Sharp contacted Brian Krebs while posing as a whistleblower and alleged Ubiquiti had downplayed the breach. The episode reports Ubiquiti's stock fell 20% in two days after the story appeared.
- Sharp pleaded guilty to three counts and admitted planning the scheme for financial gain. At sentencing, he described it as an unsanctioned security drill; he received six years in prison.
Article Details
- Topics
- [03:28] Nickolas Sharp's role at Ubiquiti and his stated motivations
- [10:26] Planning the intrusion and using a VPN
- [13:01] Accessing Ubiquiti's AWS environment and credential vault
- [15:11] Cloning private GitHub repositories and downloading company data
- [27:28] Ubiquiti's response, forensic findings and the FBI investigation
- [32:10] Sharp's contact with Brian Krebs, guilty plea and sentencing
- Concealing activity, extortion demands and the Keybase data upload
MITRE ATT&CK
T1078.004 · Cloud AccountsSharp accessed Ubiquiti's AWS environment using company credentials.T1213.003 · Code RepositoriesHe accessed and cloned private GitHub repositories and their change histories.T1562.008 · Disable or Modify Cloud LogsHe changed AWS log-retention settings to one day in an attempt to have logs deleted.
People
Threat Actors
Vendors
Amazon Web Services[04:06] streaming of video that’s handled by AWS. About a mile away from AWS is Ubiquiti. They make routers,GitHub[10:44] AWS cloud environment. He had access to all the source code on GitHub. He had access to all theKeybase[24:34] to do, another senior employee gets a message on Keybase. Keybase is a chat app, and it justLastPass[32:58] stores log-ins in a LastPass account. How irresponsible. He’s not wrong. UbiquitiSurfshark[11:24] get a VPN. Nick went with Surfshark VPN. He got a twenty-seven-month subscription and paid with hisUbiquiti[04:06] streaming of video that’s handled by AWS. About a mile away from AWS is Ubiquiti. They make routers,
Products
AWS[04:06] streaming of video that’s handled by AWS. About a mile away from AWS is Ubiquiti. They make routers,GitHub[10:44] AWS cloud environment. He had access to all the source code on GitHub. He had access to all theKeybase[24:34] to do, another senior employee gets a message on Keybase. Keybase is a chat app, and it justLastPass[32:58] stores log-ins in a LastPass account. How irresponsible. He’s not wrong. UbiquitiSurfshark VPN[11:24] get a VPN. Nick went with Surfshark VPN. He got a twenty-seven-month subscription and paid with his