Billion Dollar Cyber Crime Chief Finally Caught

A man has been arrested for allegedly stealing more than a billion dollars in cyber attacks. The tactics were so outlandish, they almost sounded like the words used by Richard Pryor's character in Superman III.

The unnamed man was arrested in Spain after an investigation that involved officials from six countries on three continents plus private cyber security firms. The man is alleged to have led a gang that attacked more than 100 banks and other financial institutions around the world.

The gang has been operating for at least three years using three forms of malware, known as Anunak, Carbanak and Cobalt Strike. The last of these was customized from legitimate software designed to test security on computer networks.

Phishing Emails Breached Networks

The attacks started with phishing scams where bank employees were targeted with bogus emails that contained attachments. Once opened, these attachments installed the malware, spread across a bank's network, and then infected the computers that controlled ATMs.

The gang then exploited the malware in three increasingly jaw dropping ways. At the simplest, they accessed electronic payment networks and simply transferred the bank's own money to their accounts.

At the next level, they accessed the databases that keep track of customer bank balances. They then increased the listed balance before immediately withdrawing cash from ATMS. (Source: bbc.co.uk)

ATMs Spat Out Bills

The most audacious method, however, was to gain control of the ATMs themselves and force them to eject cash as if somebody was making a withdrawal. Other gang members were waiting by the machines to grab the money and flee.

The money was then used to buy units of virtual "cryptocurrencies" before being turned back into traditional cash balances on cards. Once that was complete, they used the money to buy cars and houses, making it harder to trace the culprits.

Some of the gang's operations collected more than €10 million (US $12.3 million). Altogether the gang is believed to have raked in more than a billion euros (US $1.23 billion) across 40 countries. (Source: europa.eu)

What's Your Opinion?

Are you surprised the gang was able to pull off such outlandish thefts for so long? Do the banks bear any responsibility for the security holes? Should financial institutions ban the receipt of external emails on internal network computers?