The National Crime Agency (NCA) has announced that it has made 14 arrests related to a major cyber crime network. The group arrested are suspected of laundering over £11 million stolen by malware. The money was stolen from the bank accounts of small to mid-sized businesses (SMB) using two pieces of malware; Dridex and Dyre.
According to Mike Hulett, Head of Operations at the NCA’s National Cyber Crime Unit: “Those responsible for writing, developing and deploying malware code also rely heavily on other organised criminals like money launderers, and their fraudulent proceeds can then be used to fund other criminality. The NCA has had tremendous support from colleagues across law enforcement and the banking industry, to close down this money laundering network. Together we have made a hole in the system which will cause significant disruption to other organised criminals.”
How did the cyber criminals steal the money?
The malware was installed when users opened infected email attachments. It then sat on the users machine monitoring their network connection for any connection to banking systems. Once detected, it recorded usernames, passwords and any other security and account data. It then used that data to transfer monies from the bank accounts of the businesses to bank accounts controlled by the cyber criminals. Some of those accounts were in the UK while others were in Eastern Europe where the malware was created.
Hundreds of mule accounts, as they are known, were created in the UK using false documents. Those who manage the accounts for the cyber criminals are known as money mules. They receive payment for opening the accounts and moving the money. Some of the money is transferred into other accounts while some is withdrawn and taken to other countries by the money mules.
An international effort
The arrests were coordinated by the NCA and four other police forces. Also on the raids were members of the Immigration Enforcement teams and representatives from Moldova and Romania. A total of 14 people including one woman were arrested. The NCA has said that some of the arrests were foreign nationals but others were British. Most of the arrests took place in London.
The NCA has reported that it has seized quantities of cash, false documents and a number of electronic devices. It is hoped that these will reveal more details of the cyber criminals money laundering information when they are examined.
Conclusion
This is a good win for the NCA. It will give them an insight into how this particular money laundering network was being run. What is not clear however is just how much cash they have recovered and if they can link it to specific victims.
