Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operations //

Identity & Access Management

7/11/2014
03:30 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

International Hacker Pleads Guilty To 2011 Global Cyberattack

Conspirators Stole $14 Million Within 48 Hours

Earlier today at the federal courthouse in Brooklyn, Qendrim Dobruna, a member of an international cybercrime organization that was responsible for a cyberattack that inflicted millions of dollars in losses on the global financial system over the course of two days in 2011, pleaded guilty to bank fraud.

The defendant, who was extradited from Germany, and his co-conspirators hacked into the systems of a U.S.-based credit and debit card payment processor that processed debit card transactions for the American Red Cross in connection with disaster relief victims. The stolen card data was then disseminated worldwide and used in an “unlimited operation” that made $14 million in fraudulent withdrawals from ATMs across the globe.

The guilty plea was announced by Loretta E. Lynch, United States Attorney for the Eastern District of New York, and Robert J. Sica, Special Agent in Charge, United States Secret Service, New York Field Office.

“The defendant and his associates hacked into the global financial system and helped themselves to funds using prepaid debit cards meant for the needy and vulnerable,” stated United States Attorney Lynch. “We will continue to work with our private sector partners to solve these 21st century heists and bring the perpetrators, no matter where in the world they may hide, to justice.”

“Our success in this case and other similar investigations is a result of our close work with our law enforcement partners,” said Secret Service Special Agent in Charge Sica. “The Secret Service worked closely with the Department of Justice and INTERPOL to share information and resources that ultimately brought Qendrim Dobruna to justice. This case demonstrates there is no such thing as anonymity for those engaging in data theft and fraudulent schemes.”

As described in the indictment, court filings in related cases, and public court proceedings, the cyberattack employed by the defendant and his co-conspirators is known in the cyber underworld as an “Unlimited Operation” – through its hacking “operation,” the cybercrime organization can access virtually “unlimited” criminal proceeds.

The “Unlimited Operation” begins when the cybercrime organization hacks into the computer systems of a payment card processor, compromises prepaid debit card accounts, essentially eliminates the withdrawal limits of those accounts, and manipulates the security protocols that would alert the victim to the attack. The compromised card data is then distributed to cells worldwide that use the data to encode magnetic stripe cards to use at ATMs. These sophisticated techniques enable the participants to withdraw literally unlimited amounts of cash until the operation is finally detected and shut down. “Unlimited Operations” are marked by three key characteristics:

(1) the surgical precision of the hackers carrying out the cyberattack,

(2) the global nature of the cybercrime organization, and

(3) the speed and coordination with which the organization executes its operations on the ground.

These attacks rely upon both highly sophisticated hackers and organized criminal cells whose role is to withdraw the cash as quickly as possible.

In February 2011 the defendant and his co-conspirators targeted a publicly traded credit and debit card processing company based in the United States that processed transactions for prepaid debit cards issued by the American Red Cross for disaster relief victims. After the hackers penetrated the payment card processor’s computer network, compromised the American Red Cross prepaid card accounts, and manipulated the balances and withdrawal limits, casher cells across the globe operated a coordinated ATM withdrawal campaign. In total, more than 15,000 ATM transactions were conducted in approximately 18 countries using the compromised disaster relief prepaid cards, resulting in $14 million in financial loss worldwide.

The defendant, also known by the aliases “cl0sEd” and “cL0z,” participated in the cyber-attack from overseas by obtaining account information from co-conspirators who directly hacked into the payment card processor’s database and selling that account information to other co-conspirators over the Internet, including to an individual in Brooklyn, New York. The defendant was arrested in an apartment in Stuttgart, Germany in March 2012 by the German federal criminal police and subsequently extradited to the United States.

In announcing the guilty plea, United States Attorney Lynch praised the extraordinary efforts of the Secret Service in investigating this complex network intrusion. Ms. Lynch also thanked the Department of Justice’s Office of International Affairs, INTERPOL, and the authorities in Germany for their assistance in effecting the defendant’s extradition.

Today’s plea took place before Senior United States District Judge I. Leo Glasser. When sentenced on October 24, 2014, the defendant faces up to 30 years in prison, a fine of up to $1 million, and forfeiture of the proceeds of his crimes.

The government’s case is being prosecuted by Assistant United States Attorney Amir H. Toossi.
The Defendant:
QENDRIM DOBRUNA
Age: 27
E.D.N.Y. Docket No. 12 CR 300 (ILG)

 

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Data Leak Week: Billions of Sensitive Files Exposed Online
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/10/2019
Intel Issues Fix for 'Plundervolt' SGX Flaw
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-5252
PUBLISHED: 2019-12-14
There is an improper authentication vulnerability in Huawei smartphones (Y9, Honor 8X, Honor 9 Lite, Honor 9i, Y6 Pro). The applock does not perform a sufficient authentication in a rare condition. Successful exploit could allow the attacker to use the application locked by applock in an instant.
CVE-2019-5235
PUBLISHED: 2019-12-14
Some Huawei smart phones have a null pointer dereference vulnerability. An attacker crafts specific packets and sends to the affected product to exploit this vulnerability. Successful exploitation may cause the affected phone to be abnormal.
CVE-2019-5264
PUBLISHED: 2019-12-13
There is an information disclosure vulnerability in certain Huawei smartphones (Mate 10;Mate 10 Pro;Honor V10;Changxiang 7S;P-smart;Changxiang 8 Plus;Y9 2018;Honor 9 Lite;Honor 9i;Mate 9). The software does not properly handle certain information of applications locked by applock in a rare condition...
CVE-2019-5277
PUBLISHED: 2019-12-13
Huawei CloudUSM-EUA V600R006C10;V600R019C00 have an information leak vulnerability. Due to improper configuration, the attacker may cause information leak by successful exploitation.
CVE-2019-5254
PUBLISHED: 2019-12-13
Certain Huawei products (AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS8000;Secospace USG6300;Secospace USG6500;Secospace USG6600;USG6000V;eSpace U1981) have an out-of-bounds read vulnerability. An attacker who logs in to the board m...