8/1/18, “US names arrested Fin7 cyber-gang suspects,” BBC
“Three Ukrainian citizens suspected of being part of a “prolific hacking group” have been arrested, the US Department of Justice has announced.
The three men are accused of using malware to attack more than 120 US companies, including the restaurant chains Chipotle and Arby’s.
Firms in the UK, France and Australia were also said to have been targeted.
The gang involved has been called several names including Fin7, Carbanak and JokerStash.
Its activities had been widely tracked in the cyber-security press. In some cases it was suspected of being a Russia-based operation.
The Department of Justice (DoJ) said that the group had hijacked more than 15 million payment card details from more than 6,500 payment check-out points in the US alone.
It said the information was then sold via the “dark net” – a part of the internet that is not indexed by regular search engines such as Google.
The resulting losses are believed to have run into the tens of millions of dollars.
The group is understood to still be active.
Each of the three accused faces allegations of conspiracy, wire fraud, computer hacking, access device fraud, and aggravated identity theft.
However, only one of the men is currently in US custody.
Fedir Hladyr is being held in Seattle pending trial after being handed over by the German authorities, who arrested the 33-year-old in January.
Dmytro Fedorov was arrested the same month in Poland. The Spanish authorities are holding the third suspect, Andrii Kopakov. The US is seeking to have both extradited.
It is not known whether the men deny the crimes they are accused of.
“The naming of these Fin7 leaders marks a major step towards dismantling this sophisticated criminal enterprise,” said the FBI agent in charge, Jay Tabb.
“The FBI will continue to work with its law enforcement partners worldwide to pursue the members of this devious group, and hold them accountable for stealing from American businesses and individuals.”...
“The criminal organisation, to which the individuals arrested are alleged to belong, is one of the larger groups, which likely is the reason for it attracting sufficient attention from law-enforcement,” commented Dr Steven Murdoch from University College London.
“The clever techniques it used to infiltrate companies demonstrates that it is impossible to guarantee that systems processing card numbers will be protected from all attacks.
“For this reason, payment systems are gradually being changed to reduce the value of card numbers to criminals, such as by creating card numbers which can only be used once, or confirming transactions by sending a text message to the customer.””
Added: linked above: “FOR IMMEDIATE RELEASE
8/1/18, “Three Members of Notorious International Cybercrime Group “Fin7” In Custody for Role in Attacking Over 100 U.S. companies,“ justice.gov
“Victim Companies in 47 U.S. States; Used Front Company ‘Combi Security’ to Recruit Hackers to Criminal Enterprise”
“Three high-ranking members of a sophisticated international cybercrime group operating out of Eastern Europe have been arrested and are currently in custody facing charges filed in U.S. District Court in Seattle, announced Assistant Attorney General Brian A. Benczkowski of the Justice Department’s Criminal Division, U.S. Attorney Annette L. Hayes for the Western District of Washington and Special Agent in Charge Jay S. Tabb Jr. of the FBI Seattle Field Office.
According to three federal indictments unsealed today, Ukrainian nationals Dmytro Fedorov, 44, Fedir Hladyr, 33, and Andrii Kolpakov, 30, are members of a prolific hacking group widely known as FIN7 (also referred to as the Carbanak Group and the Navigator Group, among other names). Since at least 2015, FIN7 members engaged in a highly sophisticated malware campaign targeting more than 100 U.S. companies, predominantly in the restaurant, gaming, and hospitality industries. As set forth in indictments, FIN7 hacked into thousands of computer systems and stole millions of customer credit and debit card numbers, which the group used or sold for profit.
Since at least 2015, FIN7 members engaged in a highly sophisticated malware campaign targeting more than 100 U.S. companies, predominantly in the restaurant, gaming, and hospitality industries. As set forth in indictments, FIN7 hacked into thousands of computer systems and stole millions of customer credit and debit card numbers, which the group used or sold for profit.
In the United States alone, FIN7 successfully breached the computer networks of companies in 47 states and the District of Columbia, stealing more than 15 million customer card records from over 6,500 individual point-of-sale terminals at more than 3,600 separate business locations. Additional intrusions occurred abroad, including in the United Kingdom, Australia, and France. Companies that have publicly disclosed hacks attributable to FIN7 include such familiar chains as Chipotle Mexican Grill, Chili’s, Arby’s, Red Robin and Jason’s Deli. Additionally in Western Washington, FIN7 targeted other local businesses.
“The three Ukrainian nationals indicted today allegedly were part of a prolific hacking group that targeted American companies and citizens by stealing valuable consumer data, including personal credit card information, that they then sold on the Darknet,” said Assistant Attorney General Benczkowski.
“Because hackers are committed to finding new ways to harm the American public and our economy, the Department of Justice remains steadfast in its commitment to working with our law enforcement partners to identify, interdict, and prosecute those responsible for these threats.”…
Each of the three FIN7 conspirators is charged with 26 felony counts alleging conspiracy, wire fraud, computer hacking, access device fraud, and aggravated identity theft.
In January 2018, at the request of U.S. officials, foreign authorities separately arrested Ukrainian Fedir Hladyr and a second FIN7 member, Dmytro Fedorov. Hladyr was arrested in Dresden, Germany, and is currently detained in Seattle pending trial. Hladyr allegedly served as FIN7’s systems administrator who, among other things, maintained servers and communication channels used by the organization and held a managerial role by delegating tasks and by providing instruction to other members of the scheme. Hladyr’s trial is currently scheduled for Oct. 22.
Fedorov, a high-level hacker and manager who allegedly supervised other hackers tasked with breaching the security of victims’ computer systems, was arrested in Bielsko-Biala, Poland. Fedorov remains detained in Poland pending his extradition to the United States.
In late June 2018, foreign authorities arrested a third FIN7 member, Ukrainian Andrii Kolpakov in Lepe, Spain. Kolpakov, also alleged to be a supervisor of a group of hackers, remains detained in Spain pending the United States’ request for extradition.
According to the indictments, FIN7, through its dozens of members, launched numerous waves of malicious cyberattacks on numerous businesses operating in the United States and abroad. FIN7 carefully crafted email messages that would appear legitimate to a business’ employee, and accompanied emails with telephone calls intended to further legitimize the email. Once an attached file was opened and activated, FIN7 would use an adapted version of the notorious Carbanak malware in addition to an arsenal of other tools to ultimately access and steal payment card data for the business’ customers. Since 2015, FIN7 sold the data in online underground marketplaces
(Supplemental document “How FIN7 Attacked and Stole Data” explains the scheme in greater detail.)
FIN7 used a front company, Combi Security, purportedly headquartered in Russia and Israel, to provide a guise of legitimacy and to recruit hackers to join the criminal enterprise. Combi Security’s website indicated that it provided a number of security services such as penetration testing. Ironically, the sham company’s website listed multiple U.S. victims among its purported clients.
The charges in the indictments are merely allegations, and the defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.
The indictments are the result of an investigation conducted by the Seattle Cyber Task Force of the FBI and the U.S. Attorney’s Office for the Western District of Washington, with the assistance of the Justice Department’s Computer Crime and Intellectual Property Section and Office of International Affairs, the National Cyber-Forensics and Training Alliance, numerous computer security firms and financial institutions, FBI offices across the nation and globe, as well as numerous international agencies. Arrests overseas were executed in Poland by the “Shadow Hunters” from CBŚP (Polish Central Bureau of Investigation); in Germany by the LKA Sachsen – Dezernat 33, (German State Criminal Police Office) and the Polizeidirektion Dresden (Dresden Police); and in Spain the Grupo de Seguridad Logica within the Unidad de Investigación Technologica of the Cuerpo Nacional de Policía (Spanish National Police)..
This case is being prosecuted by Assistant U.S. Attorneys Francis Franze-Nakamura and Steven Masada of the Western District of Washington with assistance from Trial Attorney Anthony Teelucksingh of the Justice Department’s Computer Crime and Intellectual Property Section.”
..............
No comments:
Post a Comment