Attacks/Breaches

2/7/2018
04:45 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

US, International Law Enforcement Shut Down Massive Cybercrime Marketplace

The Infraud Organization was responsible for over $500 million in losses to institutions and individuals worldwide, the US Department of Justice says.

US law enforcement authorities in collaboration with their counterparts in over a dozen nations have taken down a major cybercrime organization that was responsible for some $530 million in losses over the past seven years.

Thirty-six individuals from 17 countries have been charged in connection with their alleged roles in the so-called Infraud Organization, including five from the US. Thirteen of the 36 individuals have been arrested so far. Eight of them are awaiting extradition to the United States. More arrests are expected to follow.

In a media call announcing the arrests Wednesday morning, Deputy Assistant Attorney General David Rybicki described the Infraud Organization as a global forum for buying and selling stolen payment card data, financial information, Social Security numbers, personal identity data, malware, and other products.

"Infraud was truly the premier one-stop shop for cybercriminals worldwide," Rybicki said. "Over the course of the Infraud Organization's seven-year history, its members targeted more than 4.3 million credit cards, debit cards, and bank accounts held by individuals around the world and in all 50 states."

The 50-page indictment unsealed today does not allege that Infraud members committed any actual data breaches. But those operating on the forum offered tools and services that certainly would have facilitated those activities, Rybicki said.

According to the indictment, Svyatoslav Bondarenko, 34, of Ukraine, founded Infraud in 2010. Over the years, it became the premier destination on the Internet for crooks looking to transact business with stolen credit card, financial, banking, and identity information. In addition to providing a platform that cybercriminals could safely use to sell stolen data, Infraud also provided an escrow service that members could use to transact business using digital currencies.

As of last March, Infraud had over 10,900 members, making it one of the largest such operations on the Internet prior to its takedown this week. The group's members included individuals from the US, Ukraine, Russia, Australia, United Kingdom, Pakistan, Kosovo, and Bangladesh. The five individuals who have been arrested in the US are from New York, San Diego, Los Angeles, and Alabama.

As has become common with other cybercrime operations these days, Infraud had a formal hierarchy in place with defined roles for members, according to the indictment papers. "Administrators" were responsible for strategic planning operations as well as for managing day-to-day operations. They were also responsible for approving and monitoring membership, and for meting out rewards and punishments to members. Individuals with subject-matter expertise in different areas were assigned "Super Moderator" roles, while "Moderators" were responsible for one or two subforums within their specific areas of expertise, the DOJ indictment noted. The forum also had "vendors" who sold stolen goods, and malware and "members" and "VIP members" worked to facilitate various criminal activities.

"Today's indictment and arrests mark one of the largest cyber fraud enterprise prosecutions ever undertaken by the Department of Justice,” said John Cronin, acting assistant attorney general of the DOJ's criminal division.

"Infraud operated like a business to facilitate cyber fraud on a global scale," Cronin said, noting that the losses the group attempted to cause totaled more than $2.2 billion.

The charges in the case are the result of a joint investigation spearheaded by the US Immigration and Customs Enforcement's Homeland Security Investigations unit and the Henderson Police Department in Nevada.

The case itself is being prosecuted by the prosecutor's office in Nevada because of its familiarity with the details and the fact than 9,000 of Infraud's victims are from the state, said US Attorney Dayle Elieson of the District of Nevada during the media call.

The indictment charges the 36 individuals with racketeering, fraud, and seven other charges. They face a maximum of 20 years in federal prison on the racketeering charges and 10 years for each of the additional counts, Elieson said.

The Infraud takedown continues a string of major law-enforcement successes against cybercrime in recent years. Last year, the FBI and other US law enforcement agencies led an international operation that resulted in the takedown of the AlphaBay and Hansa criminal marketplaces. In December, the FBI, Europol, and others took down Avalanche, a massive malware operation involving 460 attack botnets.

Related content:

  

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Election Websites, Back-End Systems Most at Risk of Cyberattack in Midterms
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/14/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-13106
PUBLISHED: 2018-08-15
Cheetahmobile CM Launcher 3D - Theme, wallpaper, Secure, Efficient, 5.0.3, 2017-09-19, Android application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key.
CVE-2017-13107
PUBLISHED: 2018-08-15
Live.me - live stream video chat, 3.7.20, 2017-11-06, Android application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key.
CVE-2017-13108
PUBLISHED: 2018-08-15
DFNDR Security Antivirus, Anti-hacking & Cleaner, 5.0.9, 2017-11-01, Android application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key.
CVE-2017-13100
PUBLISHED: 2018-08-15
DistinctDev, Inc., The Moron Test, 6.3.1, 2017-05-04, iOS application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key.
CVE-2017-13101
PUBLISHED: 2018-08-15
Musical.ly Inc., musical.ly - your video social network, 6.1.6, 2017-10-03, iOS application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key.