Person
person:nickolas_sharp
Also: Nick, Nick Sharp
Ubiquiti cloud-team leader who accessed company systems, copied data, attempted extortion, and was later prosecuted.
Ubiquiti cloud-team leader who accessed company systems, copied data, attempted extortion, and was later prosecuted.
“this story is about a guy name Nickolas Sharp. We’ll call him Nick.”
“Nickolas Sharp was arrested on a four-count indictment”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | MEMBER_OF | Ubiquiti | Explicit | 178 |
| outgoing | USES | Amazon Web Services | Explicit | 178 |
| outgoing | USES | GitHub | Explicit | 178 |
| outgoing | USES | Surfshark VPN | Explicit | 178 |
| outgoing | USES | VPN | Explicit | 178 |
| outgoing | USES | VPN kill switch | Explicit | 178 |
| outgoing | USES | SSH | Explicit | 178 |
| outgoing | USES | get-caller-identity | Explicit | 178 |
| outgoing | USES | Keybase | Explicit | 178 |
| outgoing | USES | Data exfiltration | Explicit | 178 |
| outgoing | USES | log deletion | Explicit | 178 |
| outgoing | USES | principle of least privilege | Explicit | 178 |
| incoming | INVOLVES | Ubiquiti breach | Explicit | 178 |
Nickolas Sharp MEMBER_OF Ubiquiti
Nickolas Sharp worked for Ubiquiti and eventually led its cloud team.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“he quit his job at AWS and took the job at Ubiquiti”
“ended up leading the whole cloud team”
Ubiquiti breach INVOLVES Nickolas Sharp
The episode presents Nickolas Sharp as the insider responsible for carrying out the Ubiquiti breach; he later admitted the plan.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“In February 2023 he pleads guilty to three counts”
“Nick admits that it was all planned for financial gain.”
Nickolas Sharp USES Amazon Web Services
Nick used his normal Ubiquiti credentials to log into the company’s AWS cloud environment.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“Nick fires up his work laptop. He logs into Ubiquiti’s cloud environment on AWS.”
Nickolas Sharp USES GitHub
Nick used Ubiquiti’s GitHub account and repositories to access and clone private source-code data.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“Nick logs into Ubiquiti’s GitHub account.”
“he starts running commands to clone these top-secret files”
Nickolas Sharp USES Surfshark VPN
Nick purchased and used Surfshark VPN to conceal his IP address during the attack.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“Nick went with Surfshark VPN.”
“Nick was connected behind that Surfshark VPN”
Nickolas Sharp USES VPN
Nick used a VPN to hide his IP address while accessing Ubiquiti systems.
Explicit Confidence 98% · Jack Rhysider EP 178 Details
“He got a twenty-seven-month subscription”
“His IP is hidden”
Nickolas Sharp USES VPN kill switch
Nick enabled a VPN kill switch to prevent connections from going out if the VPN disconnected.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“He thought about that and enabled a VPN kill switch”
Nickolas Sharp USES SSH
Nick connected to GitHub via SSH while using the shared high-level account.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“He connects via SSH.”
Nickolas Sharp USES get-caller-identity
Nick ran get-caller-identity to verify the identity of the account he was using.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“Nick then runs a command called get-caller-identity.”
Nickolas Sharp USES Keybase
Nick used Keybase to communicate with a senior Ubiquiti employee and publish stolen data.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“Nick himself was active on Keybase”
“Nick uploads the stolen data to a public Keybase folder.”
Nickolas Sharp USES Data exfiltration
Nick downloaded more than 100 repositories containing gigabytes of confidential company data.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“he’s cloned and downloaded over 100 repositories”
“That’s gigabytes of confidential company data.”
Nickolas Sharp USES log deletion
Nick changed AWS log-retention policies to one day in an attempt to delete evidence of his activity.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“He changes the life cycle retention policies to just one day.”
“This will delete the logs”
Nickolas Sharp USES principle of least privilege
Nick had advocated the principle of least privilege, although he also exploited Ubiquiti’s overly broad access controls.
Explicit Confidence 97% · Jack Rhysider EP 178 Details
“The principle of least privilege is something he tried to tell them about”