Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

10/10/2018
10:50 AM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Romanian National Accused of Leading Intl. Fraud Operation Behind $4M Theft

The cyber fraud ring allegedly used malware to steal $4M after taking users' passwords and personal data, the DoJ reports.

A Romanian national was returned to the United States Friday to face federal charges that accuse him of being the leader of an international cyber fraud ring that used malware to steal in excess of $4 million after taking people’s passwords, personal identifying information, and bank account information.

Assistant Attorney General Brian A. Benczkowski of the Justice Department’s Criminal Division, U.S. Attorney Justin E. Herdman of the Northern District of Ohio, Peter Elliot of the U.S. Marshals Service, Stephen D. Anthony of the FBI and Chief Kevin Bielozer of the Westlake Police Department made the announcement.

Romeo Vasile Chita, 38, was charged in a four-count indictment unsealed in U.S. District Court in Cleveland, Ohio. The charges include racketeering, wire fraud conspiracy, conspiracy to launder money and conspiracy to traffic in counterfeit services.

Eight other defendants were named in the indictment unsealed today.  Two defendants—Daniel Mihai Radu, 39; and Manuel Tudor, 37, —have already been extradited from Romania and are awaiting trial in Cleveland. The other five defendants remain at large.

“Romeo Vasile Chita allegedly led a multinational criminal enterprise that stole sensitive personal data through deceptive phishing emails and organized fraudulent online auctions, causing millions of dollars in losses to innocent victims,” said Assistant Attorney General Benczkowski.  “The Criminal Division will continue to work with our law enforcement partners, both domestic and international, to aggressively disrupt and dismantle international cyber criminal organizations that victimize our citizens and businesses.”

“This defendant led an international operation that used fraudulent emails and the internet to scam hard-working people out of their savings,” said U.S. Attorney Herdman.  “It is gratifying that this defendant will be forced to answer the charges filed against him.”

According to the indictment, Chita was based in Romania and led a racketeering enterprise that operated in the United States, Romania, Canada, Croatia, Latvia, Hungary, Bosnia, China, Jordan, Malaysia and elsewhere. The goal of the enterprise was to generate money through various criminal acts, including wire fraud, trafficking in counterfeit services, and money laundering.  It began operating as early as 2007.

Among other things, Chita’s group sent “phishing” emails purporting to be from the Better Business Bureau, the IRS, U.S. Tax Court, the National Payroll Records Center, and others. When a victim clicked on a link in a fraudulent email, specialized malware incorporating a “keylogger” was installed onto the victims’ computers, allowing members of the criminal enterprise to capture sensitive and confidential information, including the victims’ bank account information.

The conspirators, including Chita, then transmitted the sensitive information to each other and others for the purpose of fraudulently withdrawing funds from the victims’ bank accounts. The stolen funds were then transferred to specific accounts in the United States, where the money was withdrawn and transferred to other members of the conspiracy. The conspirators used their own network of accounts and “money mules” to transfer hundreds of thousands of dollars at a time to conceal the origin of the money.

The defendants also are alleged to have engaged in an extensive campaign of online auction fraud, placing ads for non-existent cars and other expensive items on eBay, Craigslist, Autotrader.com, and other websites.  According to the indictment, victims were tricked into wiring thousands of dollars to money mules to purchase these vehicles.  The money mules then transferred and laundered the proceeds for the benefit of the enterprise.    

Chita managed and facilitated the various schemes, as well as directing other conspirators to launder fraudulently obtained money.

This case was investigated by the U.S. Marshals Service, the FBI, the Westlake Police Department and the U.S. Secret Service. The case is being prosecuted by Senior Counsel Brian L. Levine of the Criminal Division’s Computer Crime and Intellectual Property Section and Assistant U.S. Attorney Duncan Brown of the Northern District of Ohio.  Valuable assistance is being provided by the Justice Department’s Office of International Affairs.  The Justice Department thanks the government of Romania for its assistance in this matter.

The prosecution of Chita prosecution is timely, as it occurs during National Cyber Security Awareness Month (NCSAM).  NCSAM – observed every October – was created as a collaborative effort between government and industry to ensure every American has the resources they need to stay safer and more secure online.  The Department of Justice encourages citizens to take advantage of cybersecurity tips and information provided by law enforcement to ensure their personal information is secured.

An indictment is merely an allegation, and the defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
7 Truths About BEC Scams
Ericka Chickowski, Contributing Writer,  6/13/2019
DNS Firewalls Could Prevent Billions in Losses to Cybercrime
Curtis Franklin Jr., Senior Editor at Dark Reading,  6/13/2019
10 Notable Security Acquisitions of 2019 (So Far)
Kelly Sheridan, Staff Editor, Dark Reading,  6/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-9391
PUBLISHED: 2019-06-17
An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that are available on port 3480 and can also be accessed via port 80 using the url "/port_3480". It seems that the UPnP services provide "request_image" as one of the s...
CVE-2017-9392
PUBLISHED: 2019-06-17
An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that are available on port 3480 and can also be accessed via port 80 using the url "/port_3480". It seems that the UPnP services provide "request_image" as one of the s...
CVE-2018-18958
PUBLISHED: 2019-06-17
OPNsense 18.7.x before 18.7.7 has Incorrect Access Control.
CVE-2019-5016
PUBLISHED: 2019-06-17
An exploitable arbitrary memory read vulnerability exists in the KCodes NetUSB.ko kernel module which enables the ReadySHARE Printer functionality of at least two NETGEAR Nighthawk Routers and potentially several other vendors/products. A specially crafted index value can cause an invalid memory rea...
CVE-2019-5017
PUBLISHED: 2019-06-17
An exploitable information disclosure vulnerability exists in the KCodes NetUSB.ko kernel module that enables the ReadySHARE Printer functionality of at least two NETGEAR Nighthawk Routers and potentially several other vendors/products. An unauthenticated, remote attacker can craft and send a packet...