They dismantled a global group of cybercriminals who stole $ 100 million from 41,000 victims: how they were fooled

European and US authorities announced Thursday the dismantling of a global network of cybercriminals who stole $ 100 million from more than 41,000 victims anywhere in the world, using a Russian malware (malware).

Europol indicated that a lawsuit had been filed against 10 suspects in Georgia, Ukraine, Moldova and the United States. The European Agency for Cooperation between the Criminal Police has also stressed that Five Russian citizens still fleeing.

The criminals used the malicious program GozNym to attack companies and banking institutions, with the aim of obtaining registration identification information. Then they managed to transfer the money and launder these funds using the bank accounts of foreign beneficiaries, often American, controlled by the detainees.

Europol explained the complex chain of network stages, which he described as "complex, operational and organized":

1. The leader of the group, based in Georgia, proposed the malware. In turn, a Russian deasrrollador worked with other colleagues to create GozNym, a sophisticated virus that stole the bank IDs of victims' computers.
2. The leader recruited accomplices with special skills promoted in the networks, most of them in the form of criminal photos in Russian.
3. Cover the tracks: they used encryptors so that the malware would not be detected by the victim's antivirus systems
4. "Spammers", mainly based in Moscow, spread the virus to hundreds of thousands of potential victims, through e-mails seeking to have a legitimate appearance, with link or attachment.

When the link was clicked, users were redirected to a malicious server that downloaded and executed the virus. Europol emphasized this division of tasks as a concept of "cybercrime as a service".

The leader of the gang, unidentified in the statement, is being prosecuted in Georgia, as well as his badistant. Meanwhile, the administrator of the server on which the virus was stored is being prosecuted in Ukraine. In turn, the encryptor faces the Moldovan authorities. The malware developer is among the five Russian fugitives.

The investigation began in November 2016 as part of an operation initially conducted by Germany in Ukraine and which ended with the dismantling of this mafia.

(With information from AFP)