Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

Police Bust $200 Million Data Theft Ring

U.S., British and Vietnamese authorities accuse men of selling 1.1 million stolen credit cards via Gmail and Facebook accounts.

The Syrian Electronic Army: 9 Things We Know
(click image for larger view)
The Syrian Electronic Army: 9 Things We Know
One of the world's largest underground "carder" forums for reselling stolen credit card data has been shut down.

That announcement was made Wednesday by the FBI, together with police in Britain and Vietnam, who have been conducting a joint investigation into the "Mattfeuter" website. Authorities have accused the site of selling harvested personal information, including 1.1 million stolen credit cards, which were used to make at least $200 million in fraudulent credit card charges.

In the past week, Vietnamese police have arrested eight men as part of the investigation, which is ongoing. Five were charged with being part of the gang that ran Mattfeuter, while three were charged with using information they'd obtained on the forum for ongoing gambling. A local news report named one of the arrested men, Van Tien Tu, as being the boss of the operation.

[ It's getting harder for cybercriminals to launder money without leaving a trail. Read Liberty Reserve Fallout: How Will Cybercrime Move Money? ]

"Although we haven't yet heard of many cases with Vietnamese cyber crime yet, the improvements in Vietnamese law passed in 2009 made it a criminal offense to fraudulently obtain card data from overseas targets, as well as from victims in Vietnam," said Gary Warner, director of research in computer forensics at the University of Alabama at Birmingham, in a blog post.

In the United States, a related investigation has focused on Vietnam resident Duy Hai Truong, 23, who was arrested last week by Vietnamese police on related charges filed by British authorities. The Department of Justice, in a criminal complaint filed Wednesday in federal court, charged Truong with being one of the leaders of the massive conspiracy to commit bank fraud, which began in 2007 and specialized in stealing the data from online retailers. If convicted, Truong faces up to 30 years in jail and a fine of $1 million, or two times the gain derived from the crimes or loss suffered by victims, whichever is greater.

Britain's Serious Organized Crime Agency (SOCA) announced Wednesday that they'd arrested three men in London who they accused of being "significant forum users." Related arrests reportedly also took place in Germany and Italy.

"One of the world's major facilitation networks for online card fraud has been dismantled by this operation," said SOCA's Andy Archibald, who's the interim deputy director of Britain's national cyber crime unit, in a statement. "Those engaged in this type of crime should know that that they are neither anonymous nor beyond the reach of law enforcement agencies."

SOCA is continuing to target more "Mattfeuter.ru" forum members and share related intelligence with international law enforcement agencies and said further arrests of forum members are likely to occur.

How did the forum operate? According to the U.S. criminal complaint, which was sworn by FBI Special Agent Russell Ficara, the forum sold data relating to an individual's personal identifying information (PII), which was known as a "dump." Each dump would fetch between $1 and $300, depending on the victim's country and the completeness of the data, which might include name, address, credit card details and social security number. Payments for dumps were made via wire-transfer services such as Western Union, as well as via Liberty Reserve. Buyers either used dumps to make fraudulent credit card charges, or else resold the dumps to other carders.

Forum users could email their requests to the hackers who ran "Mattfeuter" and would need to use a wire-transfer service to send payment, then provide the related money transfer control number (MTCN) as proof of purchase before receiving the requested data.

But approximately 16,000 users instead registered with the "www.mattfeuter.biz" or "www.mattfeuter.com" websites -- which required creating a username and password -- and could then browse available credit card numbers and search based on regions and different credit card issuers. The site offered discounts for bulk purchases. After selecting their desired dumps, users headed to a checkout screen, where they entered their Liberty Reserve number to finalize the transaction, according to the criminal complaint.

Ficara said that he reviewed more than 1,100 bank accounts during the course of the investigation, and that Truong controlled email accounts that received many of the MTCNs used to pay for dumps. He said that the vast majority of these MTCNs were cashed in at a single Western Union location in Ho Chi Minh City, Vietnam, and that they exceeded $1.9 million.

According to the complaint, in a related case, an unnamed individual plead guilty to credit card fraud and began working with an unnamed law enforcement agency. As part of that cooperation, the person met with others who claimed to have access to stolen credit card numbers offered for sale via Mattfeuter, and communicated with the site using a Gmail account that was controlled by Truong. According to Ficara, Truong also used a Facebook account -- in his own name, and with a photograph of himself -- to post messages to dump purchasers.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
bamenda
50%
50%
bamenda,
User Rank: Apprentice
6/9/2017 | 2:49:07 PM
re: Police Bust $200 Million Data Theft Ring
hahahah.. thanks for the post..

 

https://carder007.bid
zerses
50%
50%
zerses,
User Rank: Apprentice
6/10/2013 | 1:06:08 AM
re: Police Bust $200 Million Data Theft Ring
...And Americans can't see that this is or will be happening a LOT because of the malfeasance and lack of CARE in OUR government's employees?

Right.

Close your eyes and wish, see what it gets you.
Edge-DRsplash-10-edge-articles
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
News
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Commentary
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: "Network congestion ahead."
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-27734
PUBLISHED: 2021-05-17
Hirschmann HiOS 07.1.01, 07.1.02, and 08.1.00 through 08.5.xx and HiSecOS 03.3.00 through 03.5.01 allow remote attackers to change the credentials of existing users.
CVE-2021-27342
PUBLISHED: 2021-05-17
An authentication brute-force protection mechanism bypass in telnetd in D-Link Router model DIR-842 firmware version 3.0.2 allows a remote attacker to circumvent the anti-brute-force cool-down delay period via a timing-based side-channel attack
CVE-2021-31727
PUBLISHED: 2021-05-17
Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 where IOCTL's 0x80002014, 0x80002018 expose unrestricted disk read/write capabilities respectively. A non-privileged process can open a handle to \.\ZemanaAntiMalware, register with the driver using IOCTL 0x8000201...
CVE-2021-31728
PUBLISHED: 2021-05-17
Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 allows a non-privileged process to open a handle to \.\ZemanaAntiMalware, register itself with the driver by sending IOCTL 0x80002010, allocate executable memory using a flaw in IOCTL 0x80002040, install a hook wit...
CVE-2021-32402
PUBLISHED: 2021-05-17
Intelbras Router RF 301K Firmware 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) due to lack of validation and insecure configurations in inputs and modules.