A $3 million dollar reward has been offered in exchange for information that leads to the arrest or conviction of Evgeniy Bogachev, a Russian national, believed to be the leader of the criminal organization responsible for the use of the malware “Gameover Zeus” (“GOZ”) and “Cryptolocker”, reported Reuters. Bogachev was named a defendant in the complaint, along with four other individuals whose real identities were not included, but who are known by “Temp Special”, “Ded”, “Chingiz 911” aka “Chingiz”, and “Mr. Kykypyky”. The remaining four defendants are also believed to be Russian nationals who assisted Bogachev in the administration of GOZ.
The civil action was filed in the United States District Court for the Western District of Pennsylvania, and brought under 18 U.S.C. §§ 1345 and 2521. The government is seeking to enjoin all defendants from continuing to engage in wire fraud, bank fraud, and unauthorized interception of electronic communications, which are all in violation of 18 U.S.C. §§ 1343, 1344, and 2511. According to the complaint, all defendants are believed to be residing within Russia at this time. The FBI has also issued a “Wanted” poster for Bogachev.
Gameover Zeus (“GOZ”)
GOZ is a malware that infiltrates and turns computers into “bots”, which are then controlled by an unauthorized third-party unbeknownst to the owners. The third-party can then intercept, usually through “man-in-the-middle” attacks, sensitive information, such as banking credentials and social security numbers, being transmitted from those compromised computers. This is how GOZ is used to commit fraudulent financial activity. GOZ first emerged in September 2011, and has since been the cause of over $100 million in losses worldwide. In the US, victims include a bank in Florida, a composite materials company in the Western District of Pennsylvania, and an Indian tribe in Washington. Further, GOZ provides a vehicle for Cryptolocker to be installed in computers that have already been infected by GOZ.
Cryptolocker the “ransomware”
Cryptolocker is a malicious program that infects computers, and allows a third-party to encrypt files contained in the hard drives of infected computers. From there, the user of the computer that has been infected is prompted to pay a ransom in exchange for the key that will decrypt the encrypted files. The encryption algorithm is believed to be “effectively unbreakable”, accordingly refusing to pay the ransom could result in the loss of data. Since it emerged in 2013, Cryptolocker has infected over 230,000 computers, with over 120,000 victims residing in the US. Victims in the US include an insurance company in Pittsburg, Pennsylvania, a police department in Massachusetts, and a company in North Carolina.
What happens now that charges have been filed?
Last year the US Department of Justice also filed charges against five Chinese nationals accused of, among others, computer hacking and economic espionage. There are stark differences between these two cases though. First, unlike the Russian government, the Chinese government has not given any indication that it is even considering working with the US to combat cybercrimes, according to Reuters. The head of the FBI’s cyber crime division, Joseph Demarest, said that the FSB, Russia’s internal security agency, recently expressed “tentative interest” in working with the US on investigating cybercrimes, adds the report. And secondly, the five charged individuals are known to be members of the Chinese military, whereas Bogachev and his associates are not known to be affiliated with the Russian government.
Despite the FSB’s recent statements regarding collaboration on cybercrime investigations, it remains unclear whether it will assist in Bogachev’s case, reports Reuters. Without Russia’s involvement, it will be difficult for the FBI to detain Bogachev as it cannot simply send agents into the country to extract him. Still, filing the charges can serve as more than a merely symbolic gesture. It will likely restrict Bogachev’s movement, considering entry into nations which have extradition treaties with the US could result in his detention and transfer to US custody.
The full complaint can be found here.
Leave a Reply