Three high-ranking members of a sophisticated international cybercrime group operating out of Eastern Europe have been arrested and are currently in custody facing charges filed in U.S. District Court in Seattle.<\/p>\n
According to three federal indictments, Ukrainian nationals Dmytro Fedorov, 44, Fedir Hladyr, 33, and Andrii Kolpakov, 30, are members of a prolific hacking group widely known as FIN7 (also referred to as the Carbanak Group and the Navigator Group, among other names).\u00a0 Since at least 2015, FIN7 members engaged in a highly sophisticated malware campaign targeting more than 100 U.S. companies, predominantly in the restaurant, gaming, and hospitality industries.\u00a0 As set forth in indictments, FIN7 hacked into thousands of computer systems and stole millions of customer credit and debit card numbers, which the group used or sold for profit.<\/p>\n
In the United States alone, FIN7 successfully breached the computer networks of companies in 47 states and the District of Columbia, stealing more than 15 million customer card records from over 6,500 individual point-of-sale terminals at more than 3,600 separate business locations.\u00a0 Additional intrusions occurred abroad, including in the United Kingdom, Australia, and France.\u00a0 Companies that have publicly disclosed hacks attributable to FIN7 include such familiar chains as Chipotle Mexican Grill, Chili\u2019s, Arby\u2019s, Red Robin and Jason\u2019s Deli.\u00a0 Additionally in Western Washington, FIN7 targeted other local businesses.<\/p>\n
\u201cThe three Ukrainian nationals indicted allegedly were part of a prolific hacking group that targeted American companies and citizens by stealing valuable consumer data, including personal credit card information, that they then sold on the Darknet,\u201d said Assistant Attorney General Benczkowski.\u00a0 \u201cBecause hackers are committed to finding new ways to harm the American public and our economy, the Department of Justice remains steadfast in its commitment to working with our law enforcement partners to identify, interdict, and prosecute those responsible for these threats.\u201d<\/p>\n
\u201cProtecting consumers and companies who use the internet to conduct business \u2013 both large chains and small \u2018mom and pop\u2019 stores — is a top priority for all of us in the Department of Justice,\u201d said U.S. Attorney Hayes.\u00a0 \u201cCyber criminals who believe that they can hide in faraway countries and operate from behind keyboards without getting caught are just plain wrong.\u00a0 We will continue our longstanding work with partners around the world to ensure cyber criminals are identified and held to account for the harm that they do \u2013 both to our pocketbooks and our ability to rely on the cyber networks we use.\u201d<\/p>\n
\u201cThe naming of these FIN7 leaders marks a major step towards dismantling this sophisticated criminal enterprise,\u201d said Special Agent in Charge Tabb.\u00a0 \u201cAs the lead federal agency for cyber-attack investigations, the FBI will continue to work with its law enforcement partners worldwide to pursue the members of this devious group, and hold them accountable for stealing from American businesses and individuals.\u201d<\/p>\n
Each of the three FIN7 conspirators is charged with 26 felony counts alleging conspiracy, wire fraud, computer hacking, access\u00a0<\/span>device fraud, and aggravated identity theft.<\/p>\n In January 2018, at the request of U.S. officials, foreign authorities separately arrested Ukrainian Fedir Hladyr and a second FIN7 member, Dmytro Fedorov.\u00a0 Hladyr was arrested in Dresden, Germany, and is currently detained in Seattle pending trial.\u00a0 Hladyr allegedly served as FIN7\u2019s systems administrator who, among other things, maintained servers and communication channels used by the organization and held a managerial role by delegating tasks and by providing instruction to other members of the scheme.\u00a0 Hladyr\u2019s trial is currently scheduled for Oct. 22.<\/p>\n Fedorov, a high-level hacker and manager who allegedly supervised other hackers tasked with breaching the security of victims\u2019 computer systems, was arrested in Bielsko-Biala, Poland.\u00a0 Fedorov remains detained in Poland pending his extradition to the United States.<\/p>\n In late June 2018, foreign authorities arrested a third FIN7 member, Ukrainian Andrii Kolpakov in Lepe, Spain.\u00a0 Kolpakov, also alleged to be a supervisor of a group of hackers, remains detained in Spain pending the United States\u2019 request for extradition.<\/p>\n Numerous waves of malicious cyberattacks<\/b><\/p>\n According to the indictments, FIN7, through its dozens of members, launched numerous waves of malicious cyberattacks on numerous businesses operating in the United States and abroad.\u00a0 FIN7 carefully crafted email messages that would appear legitimate to a business\u2019 employee, and accompanied emails with telephone calls intended to further legitimize the email. Once an attached file was opened and activated, FIN7 would use an adapted version of the notorious Carbanak malware in addition to an arsenal of other tools to ultimately access and steal payment card data for the business\u2019 customers. Since 2015, FIN7 sold the data in online underground marketplaces.<\/p>\n FIN7 used a front company, Combi Security, purportedly headquartered in Russia and Israel, to provide a guise of legitimacy and to recruit hackers to join the criminal enterprise.\u00a0 Combi Security\u2019s website indicated that it provided a number of security services such as penetration testing.\u00a0 Ironically, the sham company\u2019s website listed multiple U.S. victims among its purported clients.<\/p>\n The charges in the indictments are merely allegations, and the defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.<\/p>\n \u201cKaspersky Lab is delighted that law enforcement agencies have announced the arrest of suspected members of the Carbanak gang \u2013 a group behind financial theft on an immense scale,\u201d said Siang Tiong Yeo, general manager at Kaspersky Lab Southeast Asia in a statement released to the press.<\/p>\n Yeo remarked that Kaspersky Lab has been tracking the Carbanak threat since 2014, observing how it was the first to apply to common financial crime the kind of highly sophisticated tools, techniques and processes normally associated with nation-state backed threat actors. It learned from these advanced groups how to stay under the radar while amassing a fortune.\u00a0\u00a0<\/span><\/p>\n \u201cFollowing the publication of our\u00a0findings<\/a>, the gang did not disband and disappear as many others do; it stayed and in fact extended its\u00a0activities<\/a>.\u00a0Our research shows that, over time, Carbanak turned into an umbrella for a range\u00a0of cybercriminal activities\u00a0all sharing the same purpose of illicit financial gain. We believe that the kind of active international cooperation that led to these arrests is the key to catching and stopping the most sophisticated cyberthreats,\u201d said Yeo.<\/p>\n","protected":false},"excerpt":{"rendered":" Three high-ranking members of a sophisticated international cybercrime group operating out of Eastern Europe have been arrested and are currently in custody facing charges filed in U.S. District Court in Seattle. According to three federal indictments, Ukrainian nationals Dmytro Fedorov, 44, Fedir Hladyr, 33, and Andrii Kolpakov, 30, are members of a prolific hacking group […]<\/p>\n","protected":false},"author":6,"featured_media":32721,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19],"tags":[5585,495,117],"class_list":["post-32720","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-headlines","tag-carbanak","tag-cybersecurity-and-cybercrime","tag-kaspersky-lab"],"_links":{"self":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts\/32720","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/comments?post=32720"}],"version-history":[{"count":0,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts\/32720\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/media\/32721"}],"wp:attachment":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/media?parent=32720"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/categories?post=32720"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/tags?post=32720"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}