News

Authorities nab alleged cyberthief behind massive ATM jackpotting enterprise

March 27, 2018

The leader of the crime gang behind Carbanak and Cobalt malware attacks targeting more than 100 financial institutions worldwide has been arrested in Spain. The operation was conducted by the Spanish National Police with support from Europol, the FBI, authorities from Romania, Belarus and Taiwan, and private cybersecurity companies.

Since 2013, the criminal operation has struck banks in more than 40 countries resulting in losses to the global financial industry of more than 1 billion euros ($1.25 billion), a Europol press release said.

The cybergang began its spree with Anunak malware that targeted financial transfers and ATM networks of financial institutions. The following year, the same coders improved Anunak to create Carbanak, which was used in until 2016. The syndicate then began to use tailor-made malware based on Cobalt Strike penetration testing software.

In all attacks, the criminals sent spear phishing emails to bank employees. These emails contained malicious software that allowed the criminals to remotely control a victim's infected machine and gain access to the internal banking network and servers controlling the ATMs.

Money was then stolen out by one of the following means:

• ATMs were instructed remotely to dispense cash at a predetermined time, with money collected by mules.
• The e-payment network was used to transfer money from the organization to criminal accounts.
• Databases with account information were modified, inflating account balances, and then using mules to collect the money.

The criminal profits were laundered via cryptocurrencies; criminals used prepaid cards linked to cryptocurrency wallets to buy luxury goods and houses, the release said.

"The arrest of the key figure in this crime group illustrates that cybercriminals can no longer hide behind perceived international anonymity," Steven Wilson, Head of the Europol European Cybercrime Centre, said in the release. " This is another example where the close cooperation between law enforcement agencies on a worldwide scale and trusted private sector partners is having a major impact on top level cybercriminality."