10 ms·

‘Evil Corp,’ a $100M Cybercrime Menace

345 points by panarky 7y ago

deleted 7y ago
[deleted]
throwaway5752 7y ago
The US Treasury dropped sanctions on three companies related to Evil Corp after Lavrov's recent visit: https://twitter.com/dcpoll/status/1205544785446129664 https://twitter.com/dcpoll/status/1205544785446129664 (which references https://twitter.com/jeffstone500/status/1205539378019360768 https://twitter.com/jeffstone500/status/1205539378019360768)
- 52-6F-62 7y ago
  I linked this article a while back. Didn't gain any traction here, but it's worth a read to understand some of the scale: https://arstechnica.com/information-technology/2019/12/members-of-evil-corp-the-cybercrime-group-that-lived-in-luxury-are-indicted/ https://arstechnica.com/information-technology/2019/12/membe...
  - cosmodisk 7y ago
    Well,I'm sure I'd be living large as well,if I was running criminal enterprise of this scale for the government...
- mc32 7y ago
  Looks like they revised the list after erroneously adding them. But they left others on. So right now any conclusion is speculative, unless you have better information. The mastermind, Yakubets, is still on the fbi’s most wanted list, FWIW.
  - throwaway5752 7y ago
    You are totally right. I don't have better information, although I have looked. If anyone else knows what those companies do and why they were removed, I'd be happy for any good news.
    - lipnitsk 7y ago
      I read in the Russian news[1] that the removed companies were run by Gusev's namesakes. The name is common and the removed companies were registered in cities far away from Moscow. 1. https://meduza.io/news/2019/12/13/minfin-ssha-isklyuchil-iz-sanktsionnogo-spiska-tri-rossiyskie-kompanii-ih-vnesli-v-chernyy-list-iz-za-svyazi-s-chlenom-evil-corp https://meduza.io/news/2019/12/13/minfin-ssha-isklyuchil-iz-...
asdfman123 7y ago
It's true, distributing Evil Corp information is prohibited and will be punished to the fullest extent of the law -- it didn't specify who would be in legal trouble, though. I actually enjoy the hackers' questionable taste and extravagant lifestyle -- it's like Russian hackers are becoming self aware and having fun with it. They seem like they'd be cool to hang out with if you were interested in also defrauding millions from innocent people (which, alas, I am not).
munk-a 7y ago
Just to clarify - why the hell didn't the FBI task someone to do what Brian was doing? > So, each day for several years my morning routine went as follows: Make a pot of coffee; shuffle over to the computer and view the messages Aqua and his co-conspirators had sent to their money mules over the previous 12-24 hours; look up the victim company names in Google; pick up the phone to warn each that they were in the process of being robbed by the Russian Cyber Mob. Just assigning an agent to that seems like a dead simple way to really quickly curtail that operation.
- dopamean 7y ago
  Law enforcement does not seem interested in looking for victims, even if it's easy. It seems that they are optimized for responding to complaints. Anything more proactive gets reserved for perpetrators.
  - loa_in_ 7y ago
    That's because every time the police force would call a potential victim to warn them, and it would turn out to be a false positive eventually some business owner would think: "we lost some money today, must have been because of that false warning, police is do incompetent". And then proceed to take the force to the court for "damages".
    - nradov 7y ago
      It would be impossible to establish damages for that in civil court.
    - dopamean 7y ago
      I don't believe for a second that the primary reason police departments don't look for potential victims is because they're worried about getting sued. The way they handle police brutality cases is enough proof that that's not true.
  - gav 7y ago
    They don't really seem to care much for complaints a lot of the time either. Somebody attempted to cash some fraudulent checks for a company I worked for, luckily this was caught by our bank before we lost any money. The NYPD had no interest in doing any more than taking a report and were extremely happy when the perpetrator attempted to cash a third check, taking the total above $100k and into FBI justification. The FBI took the report and nothing happened even though our bank was able to provide details which should have led to an arrest.
golergka 7y ago
This writeup misses a lot of information about this group's ties to FSB, here's a better source: https://meduza.io/en/feature/2019/12/12/the-fsb-s-personal-hackers https://meduza.io/en/feature/2019/12/12/the-fsb-s-personal-h... Basically, it's founder married a daughter of a high-placed FSB official and enjoys full immunity for his actions.
- cosmodisk 7y ago
  Schemes like this, especially of this scale, rarely,if ever,run without any suport from these type agencies. So while the guy's face is all over the internet for being 'the leader' of the org, I'm pretty sure there are quite few people above him that will never ever end up on any DoJ lists.
  - SAI_Peregrinus 7y ago
    The people above him are over the authority of the DoJ, they're in the domain of the CIA & Department of State to deal with. At a certain level prosecuting people starts international diplomatic incidents, and the DoJ tends to avoid those without DoS authorization.
- chatmasta 7y ago
  I wonder if American agencies provide similar semi-official cover to US criminals who hack into foreign systems...
  - jsjohnst 7y ago
    I have no proof I can offer up, but the answer is yes.
- bashinator 7y ago
  I really hope Brian Krebs has a very good bodyguard and other personal protection in place.
  - jokoon 7y ago
dmamills 7y ago
Name Flyman. Arrest Flyman.
cortesoft 7y ago
> Needless to say, the victims that spun their wheels chasing after me usually suffered far more substantial financial losses (mainly because they delayed calling their financial institution until it was too late). That really rubs me the wrong way... someone doubts the random phone call telling them they are being robbed and he acts like it was their fault for doubting?
- BoorishBears 7y ago
  That comment ended very differently than I expected it to. What rubs me the wrong way is that they'd doubt the call. It'd take seconds to process "how can the attacker benefit from this" and come up empty. After all it's not like he was calling them and offering to fix the issue, he was literally giving them a heads up, the worst that could happen is a wasted call to the bank.
  - jonas21 7y ago
    > the worst that could happen is a wasted call to the bank. Well, no. The worst (and probably very likely) thing that would happen is they would call the bank, the bank would block withdrawals from their payroll processor, and they would miss payroll for that period. This could also have severe financial consequences for the company's employees, given how many people live paycheck to paycheck. Small businesses are constantly inundated with all varieties of scam calls, so it's not at all unreasonable to be suspicious of someone who calls you out of the blue and says, "Your payroll accounts have been hacked, and you’re about to lose a great deal of money. You should contact your bank immediately." The odds of ever getting a call from a good samaritan like Brian Krebs are vanishingly small, while you're probably getting called by scammers every day.
    - BoorishBears 7y ago
      That's not true though... He says right there, the fraudulent payroll payments were many times the normal amount and not part of the normal cycle. In fact, from what he described, even the bank would have picked up on the fraudulent transactions upon human review. Small businesses are not going to confuse out-of-cycle payroll payments with normal ones, cash flow is way too tight for mistakes like that. - I'm also not saying it's unreasonable to be suspicious of the call, but after that initial suspicion, it's unreasonable not to hang up immediately on the scammer... then make a "sanity call" to bank/payroll processor/both
ufmace 7y ago
What I wonder about these schemes - why don't any of these "Money mules" just keep all of the money? If these guys had any enforcement capabilities in the US, they presumably wouldn't need money mules.
- chockZ 7y ago
  The "money mules" may not realize that what they are doing is illegal. If they are people looking for part-time work and have already done weeks of menial tasks before being asked to transfer funds, they probably just think that it's part of their gig.
- PeterisP 7y ago
  The mules are never in posession of "all of the money" - they handle a couple payments, after that they get the next ones. Sure, some of them might "keep" the money (they can't keep it, the victims have claim on that money and the mules aren't anonymous or protected) and not forward it, so the scammers need to recruit new mules.
- Gunax 7y ago
  They probably do some of the time. To the hackers, it's likely a cost of business.
erik_landerholm 7y ago
omg..this part: "Here’s where it got interesting. Each of these mule recruitment sites had the same security weakness: Anyone could register, and after logging in any user could view messages sent to and from all other users simply by changing a number in the browser’s address bar. As a result, it was trivial to automate the retrieval of messages sent to every money mule registered across dozens of these fake company sites." Amazing.... And the picture of the Russian tool in question, with his cat and his clothes. Could he be anymore more stereotypical Russian Goon looking?! He looks like the evil character in an Austin Power's movie...
- LilBytes 7y ago
  Can write and run malware at an international scale. Cannot run a simple PHP forum securely.
jonesnc 7y ago
The name Evil Corp is a reference to the show Mr. Robot right?
- dmix 7y ago
  Yes, obviously it was added later on. They've been doing this for at least a decade well before the show existed.
- nwallin 7y ago
  I would assume it's a parody of James Bond or a reference to any of the numerous parodies of it over the years, notably Austin Powers' Dr. Evil.
stevespang 7y ago
Let's see, the crook made a $100 million - - - but the FBI is only offering $5 million. This story is straight out of an Austin Powers Movie - - "Evil Corporation" . . . .
rrryyyyrrr 7y ago
Yeah, the government is just as bad as ms13. Shut the fuck up you imbecile piece of ignorant shit.
dmje 7y ago
It's f######g 2019! Why isn't Kreb's website mobile friendly, ffs?
- kovach 7y ago
  It's 2019, why are using a mobile browser without a Reader View button? (Hint: Firefox)
deleted 7y ago
[deleted]
reti 7y ago
is Brian Krebs the beneficiary of this $5 million bounty through this investigation?

345 points by panarky 7y ago

deleted 7y ago

[deleted]

The US Treasury dropped sanctions on three companies related to Evil Corp after Lavrov's recent visit: https://twitter.com/dcpoll/status/1205544785446129664 https://twitter.com/dcpoll/status/1205544785446129664 (which references https://twitter.com/jeffstone500/status/1205539378019360768 https://twitter.com/jeffstone500/status/1205539378019360768)

52-6F-62 7y ago
I linked this article a while back. Didn't gain any traction here, but it's worth a read to understand some of the scale: https://arstechnica.com/information-technology/2019/12/members-of-evil-corp-the-cybercrime-group-that-lived-in-luxury-are-indicted/ https://arstechnica.com/information-technology/2019/12/membe...
- cosmodisk 7y ago
  Well,I'm sure I'd be living large as well,if I was running criminal enterprise of this scale for the government...
mc32 7y ago
Looks like they revised the list after erroneously adding them. But they left others on. So right now any conclusion is speculative, unless you have better information. The mastermind, Yakubets, is still on the fbi’s most wanted list, FWIW.
- throwaway5752 7y ago
  You are totally right. I don't have better information, although I have looked. If anyone else knows what those companies do and why they were removed, I'd be happy for any good news.
  - lipnitsk 7y ago
    I read in the Russian news[1] that the removed companies were run by Gusev's namesakes. The name is common and the removed companies were registered in cities far away from Moscow. 1. https://meduza.io/news/2019/12/13/minfin-ssha-isklyuchil-iz-sanktsionnogo-spiska-tri-rossiyskie-kompanii-ih-vnesli-v-chernyy-list-iz-za-svyazi-s-chlenom-evil-corp https://meduza.io/news/2019/12/13/minfin-ssha-isklyuchil-iz-...

asdfman123 7y ago

It's true, distributing Evil Corp information is prohibited and will be punished to the fullest extent of the law -- it didn't specify who would be in legal trouble, though. I actually enjoy the hackers' questionable taste and extravagant lifestyle -- it's like Russian hackers are becoming self aware and having fun with it. They seem like they'd be cool to hang out with if you were interested in also defrauding millions from innocent people (which, alas, I am not).

munk-a 7y ago

Just to clarify - why the hell didn't the FBI task someone to do what Brian was doing? > So, each day for several years my morning routine went as follows: Make a pot of coffee; shuffle over to the computer and view the messages Aqua and his co-conspirators had sent to their money mules over the previous 12-24 hours; look up the victim company names in Google; pick up the phone to warn each that they were in the process of being robbed by the Russian Cyber Mob. Just assigning an agent to that seems like a dead simple way to really quickly curtail that operation.

dopamean 7y ago
Law enforcement does not seem interested in looking for victims, even if it's easy. It seems that they are optimized for responding to complaints. Anything more proactive gets reserved for perpetrators.
- loa_in_ 7y ago
  That's because every time the police force would call a potential victim to warn them, and it would turn out to be a false positive eventually some business owner would think: "we lost some money today, must have been because of that false warning, police is do incompetent". And then proceed to take the force to the court for "damages".
  - nradov 7y ago
    It would be impossible to establish damages for that in civil court.
  - dopamean 7y ago
    I don't believe for a second that the primary reason police departments don't look for potential victims is because they're worried about getting sued. The way they handle police brutality cases is enough proof that that's not true.
- gav 7y ago
  They don't really seem to care much for complaints a lot of the time either. Somebody attempted to cash some fraudulent checks for a company I worked for, luckily this was caught by our bank before we lost any money. The NYPD had no interest in doing any more than taking a report and were extremely happy when the perpetrator attempted to cash a third check, taking the total above $100k and into FBI justification. The FBI took the report and nothing happened even though our bank was able to provide details which should have led to an arrest.

golergka 7y ago

This writeup misses a lot of information about this group's ties to FSB, here's a better source: https://meduza.io/en/feature/2019/12/12/the-fsb-s-personal-hackers https://meduza.io/en/feature/2019/12/12/the-fsb-s-personal-h... Basically, it's founder married a daughter of a high-placed FSB official and enjoys full immunity for his actions.

cosmodisk 7y ago
Schemes like this, especially of this scale, rarely,if ever,run without any suport from these type agencies. So while the guy's face is all over the internet for being 'the leader' of the org, I'm pretty sure there are quite few people above him that will never ever end up on any DoJ lists.
- SAI_Peregrinus 7y ago
  The people above him are over the authority of the DoJ, they're in the domain of the CIA & Department of State to deal with. At a certain level prosecuting people starts international diplomatic incidents, and the DoJ tends to avoid those without DoS authorization.
chatmasta 7y ago
I wonder if American agencies provide similar semi-official cover to US criminals who hack into foreign systems...
- jsjohnst 7y ago
  I have no proof I can offer up, but the answer is yes.
bashinator 7y ago
I really hope Brian Krebs has a very good bodyguard and other personal protection in place.
- jokoon 7y ago

dmamills 7y ago

Name Flyman. Arrest Flyman.

cortesoft 7y ago

> Needless to say, the victims that spun their wheels chasing after me usually suffered far more substantial financial losses (mainly because they delayed calling their financial institution until it was too late). That really rubs me the wrong way... someone doubts the random phone call telling them they are being robbed and he acts like it was their fault for doubting?

BoorishBears 7y ago
That comment ended very differently than I expected it to. What rubs me the wrong way is that they'd doubt the call. It'd take seconds to process "how can the attacker benefit from this" and come up empty. After all it's not like he was calling them and offering to fix the issue, he was literally giving them a heads up, the worst that could happen is a wasted call to the bank.
- jonas21 7y ago
  > the worst that could happen is a wasted call to the bank. Well, no. The worst (and probably very likely) thing that would happen is they would call the bank, the bank would block withdrawals from their payroll processor, and they would miss payroll for that period. This could also have severe financial consequences for the company's employees, given how many people live paycheck to paycheck. Small businesses are constantly inundated with all varieties of scam calls, so it's not at all unreasonable to be suspicious of someone who calls you out of the blue and says, "Your payroll accounts have been hacked, and you’re about to lose a great deal of money. You should contact your bank immediately." The odds of ever getting a call from a good samaritan like Brian Krebs are vanishingly small, while you're probably getting called by scammers every day.
  - BoorishBears 7y ago
    That's not true though... He says right there, the fraudulent payroll payments were many times the normal amount and not part of the normal cycle. In fact, from what he described, even the bank would have picked up on the fraudulent transactions upon human review. Small businesses are not going to confuse out-of-cycle payroll payments with normal ones, cash flow is way too tight for mistakes like that. - I'm also not saying it's unreasonable to be suspicious of the call, but after that initial suspicion, it's unreasonable not to hang up immediately on the scammer... then make a "sanity call" to bank/payroll processor/both

ufmace 7y ago

What I wonder about these schemes - why don't any of these "Money mules" just keep all of the money? If these guys had any enforcement capabilities in the US, they presumably wouldn't need money mules.

chockZ 7y ago
The "money mules" may not realize that what they are doing is illegal. If they are people looking for part-time work and have already done weeks of menial tasks before being asked to transfer funds, they probably just think that it's part of their gig.
PeterisP 7y ago
The mules are never in posession of "all of the money" - they handle a couple payments, after that they get the next ones. Sure, some of them might "keep" the money (they can't keep it, the victims have claim on that money and the mules aren't anonymous or protected) and not forward it, so the scammers need to recruit new mules.
Gunax 7y ago
They probably do some of the time. To the hackers, it's likely a cost of business.

erik_landerholm 7y ago

omg..this part: "Here’s where it got interesting. Each of these mule recruitment sites had the same security weakness: Anyone could register, and after logging in any user could view messages sent to and from all other users simply by changing a number in the browser’s address bar. As a result, it was trivial to automate the retrieval of messages sent to every money mule registered across dozens of these fake company sites." Amazing.... And the picture of the Russian tool in question, with his cat and his clothes. Could he be anymore more stereotypical Russian Goon looking?! He looks like the evil character in an Austin Power's movie...

LilBytes 7y ago
Can write and run malware at an international scale. Cannot run a simple PHP forum securely.

jonesnc 7y ago

The name Evil Corp is a reference to the show Mr. Robot right?

dmix 7y ago
Yes, obviously it was added later on. They've been doing this for at least a decade well before the show existed.
nwallin 7y ago
I would assume it's a parody of James Bond or a reference to any of the numerous parodies of it over the years, notably Austin Powers' Dr. Evil.

stevespang 7y ago

Let's see, the crook made a $100 million - - - but the FBI is only offering $5 million. This story is straight out of an Austin Powers Movie - - "Evil Corporation" . . . .

rrryyyyrrr 7y ago

Yeah, the government is just as bad as ms13. Shut the fuck up you imbecile piece of ignorant shit.

dmje 7y ago

It's f######g 2019! Why isn't Kreb's website mobile friendly, ffs?

kovach 7y ago
It's 2019, why are using a mobile browser without a Reader View button? (Hint: Firefox)

deleted 7y ago

[deleted]

reti 7y ago

is Brian Krebs the beneficiary of this $5 million bounty through this investigation?