Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

4/18/2019
04:50 PM
Robert Lemos
Robert Lemos
News
50%
50%

Creator of Hub for Stolen Credit Cards Sentenced to 90 Months

Coming eight years after he launched the site, the steep sentence for the cybercriminal operator is based on a tab of $30 million in damages calculated by Mastercard and other credit card companies.

A federal judge sentenced a Macedonian man responsible for creating and operating a now-defunct hub for the collection and sale of stolen information on credit card accounts — called Codeshop — to 90 months in prison, federal prosecutors said on April 17. 

The sentence for Djevair Ametovski, also known as "xhevo" and "sindrom," capped an eight-year investigation and prosecution by the US Secret Service and the US Attorney's Office for the Eastern District of New York.

Codeshop launched in 2011 and operated for more than three years. In 2014, Slovenian authorities arrested Ametovski, and two years later, prosecutors successfully extradited him to the United States. While Ametovski initially maintained his innocence, he pleaded guilty to two of three charges in August 2017.

"Ametovski and his co-conspirators were merchants of crime, stealing victims' information and selling that information to other criminals," Richard P. Donoghue, US Attorney for the Eastern District of New York, said in a statement on April 17. "This Office and our law enforcement partners will tirelessly pursue cybercriminals who seek to profit at others' expense."

The US Secret Service investigated the Codeshop.su website, including seizing servers in the Netherlands and the Czech Republic. The computers hosted both the website and a database of more than 400,000 stolen credit card accounts. A forensics analysis, however, revealed that more than 1.3 million stolen credit card numbers had been part of the database at one time or another. The credit card account information included the cardholder's name and address, the credit card number, the expiration date, and the security code printed on the card.

The investigation revealed the site attracted more than 28,000 criminal users in its three years of operation. Codeshop allowed potential buyers to easily search for cards based on the account holder's location, the financial institution issuing the card, and the credit card brand.

"To supply the Codeshop website with stolen credit card and account data, the defendant enlisted the services of criminal hackers and fraudsters, [including enlisting] his co-conspirators to hack into the computer databases of financial institutions and other businesses, including businesses in the United States," prosecutors stated in an October 2018 statement in support of their sentencing request.

When he created the Codeshop, Ametovski had little experience in running such an operation. In March 2011, he sent an email to the administrator of another carding operation asking about "the webshop script to buy," according to the October 2018 sentencing statement issued by the US Attorney's Office. A month later, he advertised his new shop offering "canadian cvvs," "USA Fulls," and "usa cvvs," prosecutors stated.

The cybercriminal operation only last three years before Ametovski was arrested in Ljubljana, Slovenia, on January 23, 2014. He fought extradition for more than two years, before being extradited to the United States in May 2016

At the time, the US Attorney's Office called the extradition a warning to other cybercriminal operators.

"Cybercriminals who create and operate online criminal marketplaces in which innocent victims' financial and personal information are bought and sold erode consumer trust in modern-day payment systems and cause millions of dollars in losses to financial institutions and unsuspecting individuals," Robert L. Capers, US Attorney for the Eastern District of New York, said in a May 2016 statement. 

In addition to Ametovski, investigators identified three other people who allegedly had permission to upload stolen information to the servers.

While the 90-month sentence is significant, the penalty ended up being less than half of the 17 years requested by prosecutors, who based their request on damages calculated to be in excess of $30 million, primarily due to a loss of nearly $30 million alleged by Mastercard.

"Even assuming arguendo [for the sake of argument] that the defendant served as no more than a traditional 'fence' … his crimes are still extremely serious," Donoghue argued in a February 2019 sentencing document. "Furthermore, even assuming arguendo that the Codeshop website was neither unique nor sophisticated … the need for general deterrence of those who would seek to operate such purportedly easy-to-create websites is significant."

Ametovski's public defender could not immediately be reached for comment.

Related Content

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
Mobile App Fraud Jumped in Q1 as Attackers Pivot from Browsers
Jai Vijayan, Contributing Writer,  7/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15105
PUBLISHED: 2020-07-10
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authenticati...
CVE-2020-11061
PUBLISHED: 2020-07-10
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in...
CVE-2020-4042
PUBLISHED: 2020-07-10
Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to...
CVE-2020-11081
PUBLISHED: 2020-07-10
osquery before version 4.4.0 enables a priviledge escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables l...
CVE-2020-6114
PUBLISHED: 2020-07-10
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabi...