It seems that the criminals are actually from the USA: http://www1.folha.uol.com.br/mercado/2014/07/1479569-gangue-do-boleto-infectou-192-mil-computadores-detec

It seems that the criminals are actually from the USA: http://www1.folha.uol.com.br/mercado/2014/07/1479569-gangue-do-boleto-infectou-192-mil-computadores-detectam-fbi-e-pf.shtml http://www1.folha.uol.com.br/mercado/2014/07/1479569-gangue-... (Portuguese only, I'm afraid).