Eight online banking scammers arrested in Russia
Hackers mainly targeted Russian, Eastern European and Dutch banks
IDG News Service - The Russian Federal Security Service (FSB) arrested eight hackers who allegedly stole $4.5 million in the last quarter alone using an online banking Trojan, security analyst firm Group-IB said Tuesday.
Seven Russians and one person in Abkhazia, an independent republic in a territory claimed by Georgia, comprised the group. The group was first noticed in the beginning of 2010 and used a Trojan to compromise systems, said Michael Sandee, security specialist at the Dutch security firm Fox IT, which assisted in many stages of the investigation.
Apart from Fox IT, Group-IB and the FSB, the Russian Ministry of the Interior (MVD) also worked on the investigation. The hackers were arrested Monday, said Aleksey Kuzmin, head of Group-IB's U.S. office.
The criminals used the Caberb Trojan, aimed at wide range of Windows OSes -- Windows 2000 through Windows 7 -- according to Sandee. "That Trojan gathers an alarming amount of data," he explained in a phone interview. Caberb logged a wide variety of passwords and log-in data once it installed itself on a system.
Caberb would nestle itself in computers using various browser vulnerabilities, including Java and Flash browser plug-in flaws. Once inside, the Trojan would launch a so-called man-in-the-browser attack. Caberb placed itself in the browser, and was used to run a protocol sniffer, detecting passwords and log-in credentials. The Trojan was also able to manipulate traffic to serve phishing sites without users knowing they were visiting one.
Together with the Caberb Trojan, Rdpdor malware was used to manipulate systems. According to Sandee, the Rdpor program established a full Remote Desktop Protocol (RDP), which allowed the criminals to see what the users saw on the screen, or even take over the whole machine.
When the group obtained log-in credentials for online banking sites they were used for fraudulent transactions that were sent to a specially prepared account. The scammers hacked popular news media websites and online stores, among other methods, to spread the malicious software, said Group-IB in a press release.
The eight hackers mainly targeted electronic banking systems in Russia, Eastern Europe and the Netherlands, Sandee said. They were active in the Netherlands until November 2010 and then shifted their focus to Eastern Europe, mainly because there are six authentication systems used in that area while every Netherlands bank uses its own authentication system.
"The Eastern European authentication systems are not bad," said Sandee, but emphasized that the small number of systems gave the cybercriminals "more value for their money."
Both Group-IB and Fox IT noted that it is fairly uncommon to be able to arrest an entire criminal chain. In typical actions against cybercriminals, only part of a group gets arrested, Sandee noted. Some people, like the leaders, are often not arrested because they are difficult to identify, he said. Usually the criminal who operates the botnet is the easiest to find.
The effort to take down the whole group is why the investigation took about a year and a half to complete. Group-IB said that the group's leader was identified in January 2010. The investigators put a vast amount of effort in documenting his activities, which was complicated because he was constantly on the move, traveling often outside of the Russian Federation.
Loek covers all things tech for the IDG News Service. Follow him on Twitter at @loekessers or email tips and comments to firstname.lastname@example.org
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Who's Spying on You? You're aware of the threats of malware to your business but what about the ever-changing ground rules? Cybercriminals today are launching attacks against...
- Pay-as-you-Grow Data Protection: IBM Tivoli's Full-featured Data Protection Suite for Small to Medium Businesses IBM Tivoli Storage Manager Suite for Unified Recovery gives small and medium businesses the opportunity to start out with only the individual solutions...
- Streamline Data Protection with IBM Tivoli Storage Manager Operations Center IBM Tivoli Storage Manager (TSM) has been an industry-standard data protection solution for two decades. But, where most competitors focus exclusively on Backup...
- Simplify and Consolidate Data Protection for Better Business Results Learn about IBM® Tivoli® Storage Manager Operations Center, which provides advanced visualization, built-in analytics and integrated workflow automation features that leapfrog traditional backup...
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well...
- The New Way to Work Knowledge Vault This Knowledge Vault focuses on how, in today's increasingly virtual world, it's more important than ever to engage deeply with employees, suppliers, partners,... All Cybercrime and Hacking White Papers | Webcasts