Attacks/Breaches

2/7/2018
04:45 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

US, International Law Enforcement Shut Down Massive Cybercrime Marketplace

The Infraud Organization was responsible for over $500 million in losses to institutions and individuals worldwide, the US Department of Justice says.

US law enforcement authorities in collaboration with their counterparts in over a dozen nations have taken down a major cybercrime organization that was responsible for some $530 million in losses over the past seven years.

Thirty-six individuals from 17 countries have been charged in connection with their alleged roles in the so-called Infraud Organization, including five from the US. Thirteen of the 36 individuals have been arrested so far. Eight of them are awaiting extradition to the United States. More arrests are expected to follow.

In a media call announcing the arrests Wednesday morning, Deputy Assistant Attorney General David Rybicki described the Infraud Organization as a global forum for buying and selling stolen payment card data, financial information, Social Security numbers, personal identity data, malware, and other products.

"Infraud was truly the premier one-stop shop for cybercriminals worldwide," Rybicki said. "Over the course of the Infraud Organization's seven-year history, its members targeted more than 4.3 million credit cards, debit cards, and bank accounts held by individuals around the world and in all 50 states."

The 50-page indictment unsealed today does not allege that Infraud members committed any actual data breaches. But those operating on the forum offered tools and services that certainly would have facilitated those activities, Rybicki said.

According to the indictment, Svyatoslav Bondarenko, 34, of Ukraine, founded Infraud in 2010. Over the years, it became the premier destination on the Internet for crooks looking to transact business with stolen credit card, financial, banking, and identity information. In addition to providing a platform that cybercriminals could safely use to sell stolen data, Infraud also provided an escrow service that members could use to transact business using digital currencies.

As of last March, Infraud had over 10,900 members, making it one of the largest such operations on the Internet prior to its takedown this week. The group's members included individuals from the US, Ukraine, Russia, Australia, United Kingdom, Pakistan, Kosovo, and Bangladesh. The five individuals who have been arrested in the US are from New York, San Diego, Los Angeles, and Alabama.

As has become common with other cybercrime operations these days, Infraud had a formal hierarchy in place with defined roles for members, according to the indictment papers. "Administrators" were responsible for strategic planning operations as well as for managing day-to-day operations. They were also responsible for approving and monitoring membership, and for meting out rewards and punishments to members. Individuals with subject-matter expertise in different areas were assigned "Super Moderator" roles, while "Moderators" were responsible for one or two subforums within their specific areas of expertise, the DOJ indictment noted. The forum also had "vendors" who sold stolen goods, and malware and "members" and "VIP members" worked to facilitate various criminal activities.

"Today's indictment and arrests mark one of the largest cyber fraud enterprise prosecutions ever undertaken by the Department of Justice,” said John Cronin, acting assistant attorney general of the DOJ's criminal division.

"Infraud operated like a business to facilitate cyber fraud on a global scale," Cronin said, noting that the losses the group attempted to cause totaled more than $2.2 billion.

The charges in the case are the result of a joint investigation spearheaded by the US Immigration and Customs Enforcement's Homeland Security Investigations unit and the Henderson Police Department in Nevada.

The case itself is being prosecuted by the prosecutor's office in Nevada because of its familiarity with the details and the fact than 9,000 of Infraud's victims are from the state, said US Attorney Dayle Elieson of the District of Nevada during the media call.

The indictment charges the 36 individuals with racketeering, fraud, and seven other charges. They face a maximum of 20 years in federal prison on the racketeering charges and 10 years for each of the additional counts, Elieson said.

The Infraud takedown continues a string of major law-enforcement successes against cybercrime in recent years. Last year, the FBI and other US law enforcement agencies led an international operation that resulted in the takedown of the AlphaBay and Hansa criminal marketplaces. In December, the FBI, Europol, and others took down Avalanche, a massive malware operation involving 460 attack botnets.

Related content:

  

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
John Fontana, Standards & Identity Analyst, Yubico,  9/19/2018
Turn the NIST Cybersecurity Framework into Reality: 5 Steps
Mukul Kumar & Anupam Sahai, CISO & VP of Cyber Practice and VP Product Management, Cavirin Systems,  9/20/2018
NSS Labs Files Antitrust Suit Against Symantec, CrowdStrike, ESET, AMTSO
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17283
PUBLISHED: 2018-09-21
Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL Inject...
CVE-2018-17282
PUBLISHED: 2018-09-20
An issue was discovered in Exiv2 v0.26. The function Exiv2::DataValue::copy in value.cpp has a NULL pointer dereference.
CVE-2018-14592
PUBLISHED: 2018-09-20
The CWJoomla CW Article Attachments PRO extension before 2.0.7 and CW Article Attachments FREE extension before 1.0.6 for Joomla! allow SQL Injection within download.php.
CVE-2018-15832
PUBLISHED: 2018-09-20
upc.exe in Ubisoft Uplay Desktop Client versions 63.0.5699.0 allows remote attackers to execute arbitrary code. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of URI ha...
CVE-2018-16282
PUBLISHED: 2018-09-20
A command injection vulnerability in the web server functionality of Moxa EDR-810 V4.2 build 18041013 allows remote attackers to execute arbitrary OS commands with root privilege via the caname parameter to the /xml/net_WebCADELETEGetValue URI.