The Security Service of Ukraine this week moved to show it is serious about cracking down on global cybercrime, arresting five suspects who allegedly took a leading role in a cyber theft ring that netted $70 million.
The Security Service of Ukraine this week moved to show it is serious about cracking down on global cybercrime, arresting five Donetsk Oblast residents on suspicion of taking a leading role in a cyber theft ring that stole more than $70 million in the United States and Europe.
The arrests of the alleged kingpins came after a long investigation by the U.S. Federal Bureau of Investigation that highlighted Ukraine’s position as a global cybercrime hub.
The suspects were later released pending formal charges, which should be filed in the next few days.
Click here to view CYBER THEFT RING scheme
According to the national intelligence agency, known as the SBU, at least $40 million of the estimated $70 million made its way into Ukraine via “money mules” and wire transfers.
On Sept. 30, the SBU detained and released five suspects and carried out eight search warrants connected to a global crackdown that led to the arrests of 39 suspects in the United States and 20 in the United Kingdom. The investigation started in Omaha, Nebraska, in May 2009.
The SBU said 15 others in Ukraine are suspected of being part of the ring that had attempted to steal some $220 million in more than a year.
The majority of those arrested are from the former Soviet Union, according to the FBI. The theft ring’s brains and software coders and exploiters are believed to be the five suspects that were detained in Ukraine.
The cyber ring allegedly used malicious software to steal the money through use of the so-called “Zeus” family of software that has been used by thousands of criminals worldwide. A Russian is believed to be the author of the sophisticated password stealer.
The attacks worked by embedding hidden software in an apparently benign email that, once opened, installed the software and recorded the keystrokes on a victim’s computer as they logged into their bank accounts.
The hackers took over the accounts and transferred thousands of dollars to hundreds of false-name accounts. The money was allegedly sent or carried in cash overseas in a “money mule” operation, typically using foreign students recruited via online job sites.
The suspects in Ukraine are 20-30 years old and have knowledge in advanced computer technologies, according to Oleksandr Zahrebelny of the SBU’s information security department.
The SBU confirmed that the alleged kingpins could expect to be charged this week with money laundering, interfering with computer transmissions and distributing malicious programs.
The FBI called the global cooperation an “unprecedented partnership.”
The SBU’s Zahrebelny said that in the last two years, “we have substantially improved the effectiveness of our international cooperation because cyber crimes have no borders and they must be stopped.”
Ukraine has long been criticized as a weak link the fight against cybercrime.
In June, criminal charges were filed in a U.S. court against a Kyiv-based company that was allegedly a world leader in producing scareware – fake anti-virus software that is sold by frightening users that they’re computer is infected with viruses.
In 2005, an investigation by U.S. law enforcement agents led to the arrest of Dmitry Golubov, who allegedly founded carderplanet.com, a website that trafficked stolen credit card details. He was later bailed out by Party of Regions deputies, and now heads the Internet Party of Ukraine. Golubov has always denied the charges.
Paul Ferguson, a threat researcher at the U.S. office of Internet security firm Trend Micro, said Ukraine is the number one problem spot in the world for serious Internet crime.
“Although I am hopeful [as a result of these arrests], I can only be encouraged if we see the Ukrainian authorities do more to corral the Internet crime occurring in their country,” Ferguson said.
Kyiv Post staff writers Olesia Oleshko and Mark Rachkevych can be reached at [email protected] and and [email protected].
