Europe's law enforcement agency says Spanish police have arrested the alleged mastermind of a cybercrime syndicate that stole more than 1 billion euros ($1.24 billion) from banks over more than four years.

Europol said on March 26 that the alleged gang leader was arrested in the coastal city of Alicante, without giving the person's name or nationality.

The gang used pieces of malware known as Carbanak and Cobalt to target more than 100 banks in more than 40 countries since late 2013, a statement said.

It said the gang sent e-mails with a malicious attachment to bank workers. The software gave the cybercriminals remote control of infected machines, providing them with access to the internal banking network and infecting servers controlling ATMs.

Europol said the investigation was conducted by the Spanish National Police with the support of Europol, the FBI, Romanian, Belarusian, and Taiwanese authorities, as well as private cybersecurity companies.

With reporting by AP

</s>AMSTERDAM (Reuters) - Spanish police have arrested the suspected leader of a gang of cyber criminals who stole up 1 billion euros ($1.2 billion) from banks by altering account balances and instructing automatic teller machines to issue cash, Europol said on Monday.

The person suspected of being behind malware attacks known as “Carbanak” and “Cobalt” was arrested in Alicante, a port city on the south east coast of Spain, after cooperation between police forces in the United States, Asia and Europe, Europol said.

The Interior Ministry said ‘Denis K.’, who had directed the criminal organization from Spain since 2013, was arrested with three members of his organization, who originally came from Russia and Ukraine, it said.

The Ukrainian police did not provide further details.

Europol said the group had operated since 2013, with members in 40 countries, carrying out attacks on 100 financial institutions. They targeted bank employees with emails infecting their computers and then using them as a base to gain control of bank network and servers.

“With that level of access, the nefarious individuals authorize fraudulent bank transfers, raise the balances of mule accounts or command affected ATMs to spit out the money for them,” Europol said.

Europol, said the U.S. Federal Bureau of Investigation, Romanian, Belarussian and Taiwanese authorities, and private cyber security companies were assisting in the case.

The Interior Ministry said that during the raid in Alicante police seized jewels worth 500,000 euros and two luxury cars. It also blocked bank accounts and two homes valued at about 1 million euros.

The organization needed the support of other criminal groups to coordinate the work of the ‘mules’ they used to extract money from cash points that they attacked, it said. Until 2015 they used the Russian mafia for this, and after 2016 the Moldovan mafia.

Their earnings were converted into bitcoins at exchange houses in Russia and Ukraine. These were later transferred to their accounts and they accumulated about 15,000 bitcoin, Interior Ministry said.

Denis K used financial platforms in Gibraltar and the United Kingdom to load prepaid cards with bitcoin and spend them in Spain on cars, homes, and other goods.

He also set up an “enormous network” to mine bitcoins which he used as a means of laundering money.</s>Spanish police have arrested the suspected leader of a gang of cyber criminals that stole as much as one billion Euros ($1.2 billion) from banks by altering account balances and instructing automatic teller machines to issue cash, Europol said on Monday.

The person suspected of being behind malware attacks known as “Carbanak” and “Cobalt” was arrested in Alicante after cooperation between police forces in the U.S., Asia and Europe, Europol said.

It did not give any information on the suspect’s identity.

Europol said the group had operated since 2013, with members in 40 countries, carrying out attacks on 100 financial institutions.

They targeted bank employees with emails infecting their computers and then using them as a base to gain control of bank network and servers.

“With that level of access, the nefarious individuals authorise fraudulent bank transfers, raise the balances of mule accounts or command affected ATMs to spit out the money for them.

“They then take the money and convert it into crypto currencies,” Europol said.

Europol said the U.S. Federal Bureau of Investigation, Romanian, Belarussian and Taiwanese authorities and private cyber security companies assisted in the case.</s>AMSTERDAM (Reuters) - Spanish National police have arrested a person suspected of leading a gang of cyber criminals that targeted banks, altering account balances and instructing automatic tellers to eject cash, causing as much as a billion euros ($1.2 billion) in damages, Europol said on Monday.

In a statement, Europol said the suspect in the malware attacks known as “Carbanak” and “Cobalt” had been arrested in Alicante, Spain, after cooperation from police forces around the globe.</s>POLICE HAVE NICKED the suspected leader of a group of cyber crooks that managed to pilfer up to €1bn, some £873m, from banks over the past few years.

The suspect was cornered and arrested by Spanish police in Spain's port city of Alicante, and is beehived to be the head of the cyber criminal gang behind the Carbanak and Cobalt malware attacks which targeted more than 100 financial institutions worldwide since 2013. 

 

"The criminal operation has struck banks in more than 40 countries and has resulted in cumulative losses of over €1bn for the financial industry. The magnitude of the losses is significant: the Cobalt malware alone allowed criminals to steal up to €10m per heist," said Europol, which worked with the Spanish National Police, the FBI, Romanian, Belarussian and Taiwanese authorities, as well as private cyber security firms, all to nab the cyber crook.

The cyber criminal gang started out its heavy hitting heists with the Anunak malware campaign that saw it steal $81m from the Bangladesh Bank. That cyber heist then led to the Carbanak attacks which saw more than $300m swiped from banks, and then the Cobalt attacks which targeted banks in at least 14 countries and saw ATMs spit out cash.

Through the use of phishing emails, the hackers would encourage unsuspecting bank workers to download malicious attachments and end up infecting their machines. And from there the hackers could spread their malware and go hunting for money.

But now that the so-called "mastermind" behind the hacking group has been captured and arrested, it looks like the future of the cyber heist outfit could be at risk; we've all seen Ocean's Eleven and know that a good leader is the crux of a successful heist, apparently.

In this case, the as-yet-unnamed leader was responsible for developing the malware, so without him, the cyber criminal group may have lost the brains of its operation.

"This global operation is a significant success for international police cooperation against a top level cybercriminal organisation. The arrest of the key figure in this crime group illustrates that cybercriminals can no longer hide behind perceived international anonymity," said Steven Wilson, head of Europol's European Cybercrime Centre.

"This is another example where the close cooperation between law enforcement agencies on a worldwide scale and trusted private sector partners is having a major impact on top level cyber criminality."

We'll have to wait and see if the cyber criminal group is on its last legs, but it would appear that if you're going to try and pilfer cash from a bank by using malware, a whole roster of law enforcement will be coming after you. µ</s>European Union Agency for Law Enforcement Cooperation, known as Europol, announced Monday that it arrested the leader of a hacker gang that stole more than $1.2 billion from banks around the world.

The gang leader wasn’t identified by name, but was taken into custody by Spanish National Police in Alicante, following a five-year crime spree in which hackers used malware to steal from ATMs.

According to Europol, the scheme started in 2013, when the hacking group started producing the Carabank and Cobalt malware — two attacks that became notorious for targeting financial institutions.

The attackers would send spear phishing emails — targeted emails sent to employees of a bank and laced with malicious code — that would infect the victim’s machine and provide the hackers access to the bank’s computer network.

Once the hackers gained access, they would begin to spread malware throughout the bank’s internal network. The malware would infect the bank’s servers and provide the attackers with the ability to control ATMs operated by the bank.

With unfettered access to the bank’s servers, the hackers could run rampant. They could transfer funds to other bank accounts that they operate, adjust the balance of bank accounts and force ATMs to spit out cash that could be collected by members of their gang. The stolen money was often converted into cryptocurrencies in order to launder the money and hide it from the authorities.

Taking down the leader of the gang behind the attacks, which hit more than 100 financial institutions worldwide, took a concerted effort from law enforcement agencies. Europol, the FBI and authorities in Spain, Romania, Belarus and Taiwan all contributed to the takedown of the gang’s leader.

"This global operation is a significant success for international police cooperation against a top level cybercriminal organization,” Steven Wilson, Head of Europol’s European Cybercrime Centre (EC3), said in a statement.

“The arrest of the key figure in this crime group illustrates that cybercriminals can no longer hide behind perceived international anonymity. This is another example where the close cooperation between law enforcement agencies on a worldwide scale and trusted private sector partners is having a major impact on top level cybercriminality," Wilson said.

While details about the hacking group are still sparse, previous reports may give insight into where the attackers are operating from. A 2015 report from cybersecurity firms Group-IB and Fox-IT suggested the Cobalt malware had ties to a group operating in Ukraine and Russia.</s>Thanks to an investigation that spanned several countries, authorities have finally caught up with an alleged cybercrime mastermind who led a yearslong high-tech spree to steal 1 billion euros ($1.2 billion) from global financial institutions.

The leader of the gang that has allegedly been behind malware attacks known as Carbanak and Cobalt was arrested in Alicante, Spain, according to a statement from Europol released on Monday. The bust was a massive operation involving not only the European Union’s law enforcement agency and the Spanish National Police, but also the Federal Bureau of Investigation, Romanian, Belarusian and Taiwanese authorities, along with private cybersecurity groups.

Officials said the gang began attacking financial systems in 2013, with the so-called Anunak malware campaign that targeted financial transfers and ATM networks, before working their way up to a more sophisticated set of malware in 2016, and then moving onto tailor-made malware.

Under the phishing attacks, emails with malicious software attachments would be sent to bank employees, allowing the gang to infiltrate internal banking networks, and infect ATM servers. Europol provided this graphic showing how the money was paid out, such as cash that was remotely spit out of ATMs at predetermined times and transfers via e-payment networks.

The cybercrime profits were also allegedly laundered via cryptocurrencies, using prepaid digital coin wallets, and then used to buy luxury cars and houses. On the day of the arrest, the European Cybercrime Centre helped deploy experts and information in Spain, and the European Banking Federation was also involved in the operation.

“The arrest of the key figure in this crime group illustrates that cybercriminals can no longer hide behind perceived international anonymity,” said Steven Wilson, Head of Europol’s European Cybercrime Centre, in a statement.</s>The individual, a Ukrainian national identified only as Denis K., was detained in the coastal city of Alicante with three accomplices, Spain's Interior Ministry said Monday.

According to Europol, the syndicate stole more than €1 billion ($1.24 billion) in a five-year spree by attacking over 100 financial institutions with malicious software. Authorities said almost all of Russia's banks were targeted.

Denis K. had allegedly directed the international cybercriminal gang from Spain since 2013.

Read more: Greece says hackers hit banks with bitcoin ransom demand

How they stole the money

The syndicate sent phishing emails to bank employees with attachments containing software known as "Carbanak" and "Cobalt." Once an email was opened, the software installed itself on the bank's server, allowing the hackers to gain control of bank accounts and automatic teller machines.

"With that level of access, the nefarious individuals authorize fraudulent bank transfers, raise the balances of mule accounts or command affected ATMs to spit out the money for them," Europol said.

"The Cobalt malware alone allowed criminals to steal up to €10 million per heist," the pan-European police body added.

Read more: Cybercrime laws as a weapon against expression

The syndicate's earnings were converted into bitcoins at exchange houses in Ukraine and Russia before being transferred to their accounts, Spain's Interior Ministry said.

Denis K. reportedly used financial platforms in Gibraltar and the UK to load prepaid cards with bitcoin and spend them in Spain on cars, homes and other goods.

Read more: Cybercrime just tip of iceberg in organized criminality, study finds

The criminal investigation was led by Spanish police, with assistance from various software companies, as well as law enforcement authorities in the United States, Romania, Belarus and Taiwan.

Every evening at 1830 UTC, DW's editors send out a selection of the day's hard news and quality feature journalism. You can sign up to receive it directly here.</s>LOUISVILLE, Ky. (WDRB) -- Three people were arrested at a home in the Portland neighborhood Monday afternoon after police say they found drugs and stolen property -- as well as two small children -- in the residence.

According to an arrest report, the Louisville Metro Police SWAT team, along with 1st Division officers, showed up in the 500 block of North 19th Street, near Portland Avenue, in order to execute a search warrant at the home of 54-year-old Melvin Haycraft, 46-year-old Kathy Woosley and 46-year-old Tracy Branch.

Police say Haycraft and Woosley were the targets of the search warrant.

Inside the home, police say they found a "baseball" sized bag of suspected methamphetamine, as well as several items of stolen property. Police say serial numbers had been removed from some of the stolen items.

According to the arrest reports, Haycraft admitted to conducting a scheme where he would trade stolen property for drugs or money.

Police say when they searched Branch, they found a baggie that contained suspected meth.

There were also two children -- ages 3 and 2 -- in the home.

Haycraft, Woosley and Branch were all arrested and charged with trafficking in a controlled substance (methamphetamine) and possession of drug paraphernalia. Haycraft and Woosley were also charged with endangering the welfare of a minor, receipt of stolen property and obscuring the identity of a machine.

All three of the suspects are currently being held in Louisville Metro Corrections.</s>Police in Spain have captured a cybercrime gang made up of Ukrainians and Russians that allegedly stole more than 1 billion euros ($1.24 billion) from financial institutions worldwide in a five-year spree, authorities said Monday.

The gang's alleged mastermind, identified as a Ukrainian and named only as "Denis K.," was arrested in the coastal city of Alicante, 350 kilometers (220 miles) southeast of Madrid, according to statements issued by Spanish police and European Union law enforcement agency Europol.

Three suspected accomplices, said to be Russian and Ukrainian, were also arrested. Authorities didn't say when the arrests took place.

The gang used malware to target more than 100 financial institutions worldwide, sometimes stealing up to 10 million euros in each heist. Almost all of Russia's banks were targeted, and about 50 of them lost money in the attacks, authorities said.

The gang sent phishing emails with a malicious attachment to bank workers, Europol said. The software gave the gang remote control of infected machines, providing them with access to the internal banking network and infecting servers controlling ATMs.

ATMs were instructed to dispense cash at a pre-determined time, and the money was collected by organized crime groups supporting the main gang.

The gang converted its illicit gains into bitcoins and used the cryptocurrency to purchase assets, including houses and vehicles, in Spain.
Spanish police in Alicante arrest the suspected leader of a bank hacking scheme believed to have stolen over €1 billion.