Europol | US, European officials bring charges in global malware case

Ten people, including five Russian fugitives, have been charged in connection with malicious software attacks that infected tens of thousands of computers worldwide and caused more than USD100 million in financial losses, U.S. and European authorities announced yesterday.

The malware enabled criminals from Eastern Europe to take remote control of infected computers and siphon funds from victims’ bank accounts, and targeted companies and institutions across all sectors of American life. Victims included a Washington law firm, a church in Texas, a furniture business in California, a casino in Mississippi and a Pennsylvania asphalt and paving business.

Several defendants are awaiting prosecution in Europe, and five are Russians who remain fugitives in that country. An 11th participant in the conspiracy was extradited to the United States from Bulgaria in 2016 and pleaded guilty last month in a related case in federal court in Pittsburgh, where Thursday’s indictment was brought.

Though the Justice Department has pursued multiple malware prosecutions in recent years against foreign hackers, this case stands out as a novel model of international collaboration, said Scott Brady, the U.S. attorney in Pittsburgh.

American authorities did not seek the immediate extradition of all 10 defendants, an often cumbersome process that can take years of negotiations, even in countries that have treaties with the U.S. Instead, they shared evidence with their European counterparts to allow officials in Ukraine, Moldova and Georgia to initiate prosecutions.

“It represents a paradigm change in how we prosecute cybercrime,” Brady said in an interview with The Associated Press before a news conference in The Hague with representatives of six countries.

Cybercrime networks “are increasingly targetable” when investigators work together, said Robert Jones, the FBI special agent in charge of the Pittsburgh office. “International cooperation is no longer a nicety, it’s a requirement,” he said.

Other law enforcement officials also said the strategy represents the new face of combating high-tech crime.

Cybercrime has no borders, and criminals have taken advantage of the legal complexities of trying to fight it, said Steven Wilson, head of the European CyberCrime Centre at Europol. “Only through international cooperation can we hope to tackle it,” he said, adding the charges “provide for a safer internet for all of us.”

The charges in the indictment include conspiracy to commit computer fraud, conspiracy to commit wire and bank fraud and conspiracy to commit money laundering.

The investigation was an outgrowth of the Justice Department’s dismantling in 2016 of a network of computer servers, known as Avalanche, which hosted more than 20 different types of malware.

The malware, GozNym, cited in yesterday’s case was among the ones hosted on the network. Law enforcement officials say it was formed by the defendants as they advertised their technical skills in underground, Russian-language online criminal forums.

“For the past three years, we have been unpeeling an onion as it were that is very challenging to investigate and identify,” Brady said.

GozNym infected more than 41,000 computers. It relied on spam emails, disguised as legitimate messages, that once opened enabled the malware to be downloaded onto the machines. From there, the hackers could record keystrokes from the victims’ computers, steal banking log-in credentials and then launder the stolen money into foreign bank accounts they controlled.

Brady said prosecutors always look to recover stolen funds, but that is especially challenging in international cybercrime cases.

“Proceeds were converted to bitcoin and without the private key, it is really hard to identify and access, let alone seize, those accounts,” Brady told the AP.

WHAT IS GOZNYM?

It is a hybrid of two other pieces of malware, Nymaim and Gozi, BBC reported.

The first of these is what is known as a “dropper”, software that is designed to sneak other malware on to a device and install it. Up until 2015, Nymaim was used primarily to get ransomware on to devices.

Gozi has been around since 2007. Over the years it has resurfaced with new techniques, all aimed at stealing financial information. It was used in concerted attacks on US banks.

Combining the two created what one expert called a “double-headed monster”. MDT/Agencies