In Moscow detained "the most dangerous hacker group with 90

[Витаутас. Частный детектив г. Вильнюс. Литва]

In Moscow, detained "the most dangerous hacker group since the 90s"
03/21/2012 | https://www.bezpeka.com/en/news/2012/03/ ... ested.html

The police and the FSB, with the participation of Group-IB experts, detained a group of IT scammers who stole money from the accounts of more than 100 banks. The head of Group-IB claims that it is "one of the most dangerous hacker groups since the 90s."

The Investigative Department of the Ministry of Internal Affairs and Group-IB announced the liquidation of a group of IT intruders involved in the theft of funds from bank accounts.

According to reports, as a result of a joint operation by the K Department of the Ministry of Internal Affairs, the Fourth Directorate of the Ministry of Internal Affairs and the FSB Information Security Center, eight people were detained who were suspected of stealing money from more than 100 banks worldwide for two years.

At the same time, Sberbank announced the involvement of the detained group in 27 thefts from Sberbank customers with a total amount of more than 10 million rubles.

According to Group-IB, whose experts were involved in the investigation, this is the first case in the world when it was possible to establish the entire criminal chain from the group organizer to the performers involved in cashing stolen money. The head of Group-IB, Ilya Sachkov, in a conversation with CNews, said that this is "one of the most dangerous hacker groups since the 90s."

According to law enforcement officials, for six months, attackers stole about 60 million rubles. According to experts from Group-IB, the amount of theft of the group for the last quarter alone amounted to 130 million rubles.

The representative of Group-IB, Irina Zubareva, explained the difference in the amount of damage by the fact that law enforcement agencies based their conclusions on documented evidence, while the amount called Group-IB was based on an expert assessment of its forensic experts.

Group-IB says that the attackers were detected as a result of the analysis of Trojans, botnet management servers and stolen data, which made it possible to establish botnet operators.

According to a report from the Investigation Department, to steal money from bank accounts, the attackers used the Carberp and RDP-door Trojans, which infected PCs of organizations that used various Bank-Client systems for settlements.

To infect accounting PCs, according to Group-IB, hacking and infection of media sites, shops and professional accounting resources were used.

Money was withdrawn from bank accounts by means of unauthorized payments to specially prepared team accounts of Trojan programs from remote servers in Canada and the Netherlands, after which it was withdrawn to bank cards and cashed at Moscow ATMs.

To cover their work, the attackers used a legal company engaged in data recovery.

Police and Group-IB did not disclose the number of victims, however, they report that by October 2011, the group’s botnet was increasing daily by about 30 thousand computers.

Interestingly, without disclosing the names of banks whose customers suffered from the actions of attackers, Group-IB expressed gratitude to Sberbank "for financing the work, collecting and providing the necessary information, active response and assistance in working with law enforcement agencies."

It may be recalled that, presenting the report “Cybercrime in Russia: Trends and Problems 2010” (Cybercrime in Russia: Trends and issues), Group-IB experts touched upon the work of banking Trojans Carberp and RDP-door. Then, among the banks affected by Carberp, they called Sberbank, Ukrsibbank and the CyberPlat payment system.

The head of the group, by decision of the Zamoskvoretsky court of Moscow, is now arrested. His elder brother, who participated in the work of the group, was released on bail in the amount of 3 million rubles, other intruders were released on bail.

The investigation department of the Fourth Directorate of the Ministry of Internal Affairs opened a criminal case under Art. 272 ("Unlawful access to computer information"), Art. 273 ("Creation, use and distribution of malware for computers") and Art. 158 (“Theft”) of the Criminal Code of the Russian Federation, according to which attackers can be sentenced to 10 years in prison.

At Kaspersky Lab, where CNews asked to comment on the detention of a group of attackers, they doubted the uniqueness of the event.

As examples of completely neutralized chains of IT scammers, Laboratory experts cite the creators of the Bredolab botnet, which was liquidated in the Netherlands in 2010 and the Brazilian network Bonnie and Clyde, destroyed in 2011.

In addition, according to Kaspersky, in the case of the current success of domestic law enforcement, one can hardly speak of a completely eliminated chain of IT intruders.

"Despite allegations that all participants in the criminal scheme were arrested, questions remain about the fate of the real authors of Carberp, those who programmed and sold it on the black market, as well as about the owners of" partner "networks that were involved in the spread of the Trojan. If they remain free, then soon we can see new criminal groups using new modifications of Carberp, "says Alexander Gostev, the main antivirus expert at Kaspersky Lab. According to Group-IB, the affiliate network traffbiz.ru "has nothing to do with this matter."

 

[Орлан]

Thanks, interesting article!

 

[Матушкин Андрей Николаевич]

Well done Ilya!

 

[Игорь Коракс]

Well, finally))) less than 20 years later)))

 

[Краев Евгений Леонидович]

In our city last year, information leaked about two such thefts from the settlement accounts of organizations. But in response to customer complaints, banks began to deny the very possibility of external impact on the Internet client-bank system. :!::!::!: And all responsibility for the payments was assigned to customers, they say you yourself somewhere gave access to your digital signatures.

 

[Частный детектив. Владивосток.]

Thanks, interesting!

 

[Детективное агентство Тула]

Interesting.

 

[Частный детектив. Панда. Краснодар.]

Thanks, interesting.

 

[Плотников Юрий Михайлович]

Interesting stuff, thanks!

 

[Детективное агентство. Москва. Арбат.]

Interesting use case