Accused Romanian hackers and financial fraudsters extradited to U.S.

A pair of Romanians accused of an international hacking and identity theft conspiracy were extradited from Romania to the United States on Friday to face 31 criminal charges in federal court. Teodor Laurentiu Costea, 41, and Robert Codrut Dumitrescu, 40, allegedly installed interactive voice response software on vulnerable computers as part of a phone scamming plot pretending to make calls from financial institutions in order to steal account numbers, PINs, and Social Security numbers from victims. The Justice Department’s announcement on the extradition characterize the tactics as “vishing” and “smishing” — phishing by voice and text messages respectively. Costea and Dumitrescu then allegedly sold the information. American officials estimate the losses from the scheme amount to over $18 million. The U.S. government has extradited a number of criminals tied to cybercrime in the past few months. In March, the Justice Department extradited Yevgeniy Nikulin from the Czech Republic. Nikulin was allegedly breaches tied to LinkedIn, Dropbox […]

The post Accused Romanian hackers and financial fraudsters extradited to U.S. appeared first on Cyberscoop.

Continue reading Accused Romanian hackers and financial fraudsters extradited to U.S.

Two Romanians extradited to Atlanta to face cyber-fraud charges

Two Romanians have been extradited to Atlanta, Georgia to face federal charges of wire fraud conspiracy, wire fraud, computer fraud and abuse, and aggravated identity theft, the Northern District of Georgia said in a press release From October 2011 unt… Continue reading Two Romanians extradited to Atlanta to face cyber-fraud charges

Atos, IT provider for Winter Olympics, hacked months before Opening Ceremony cyberattack

Hackers armed with destructive malware appear to have compromised the main IT service provider for the Winter Olympic Games months before last week’s highly publicized cyberattack. Publicly available evidence analyzed by experts and reviewed by CyberScoop suggests that whoever deployed the Olympic Destroyer malware on Feb. 9 likely previously penetrated a series of computer systems in December belonging to Atos, a multinational information technology service provider that is hosting the cloud infrastructure for the Pyeongchang games. The evidence was recently posted to the VirusTotal repository, but information associated with the malware samples carries indications that the hackers were inside Atos systems since at least December. Some of the earliest samples were uploaded by unnamed VirusTotal users geographically located in France, where Atos is headquartered, and Romania, where some members of Atos’ security team work. On Feb. 9, the official Winter Olympics website went down for several hours, causing a disruption to ticket sales and downloads during the […]

The post Atos, IT provider for Winter Olympics, hacked months before Opening Ceremony cyberattack appeared first on Cyberscoop.

Continue reading Atos, IT provider for Winter Olympics, hacked months before Opening Ceremony cyberattack

Europol releases dramatic video of Romanians arrested for spreading CTB Locker and Cerber ransomware

As part of an extensive law enforcement operation called “Bakovia,” Romanian authorities on Wednesday arrested five individuals suspected of infecting tens of thousands of computers across Europe and the United States using the infamous Ran… Continue reading Europol releases dramatic video of Romanians arrested for spreading CTB Locker and Cerber ransomware

Russia-linked hackers impersonate NATO in attempt to hack Romanian government

An elite hacking group linked to the Russian government masqueraded as a NATO representative to send a barrage of phishing emails to diplomatic organizations in Europe, including Romania’s Foreign Ministry of Affairs, documents show. CyberScoop obtained a copy of one such phishing email that researchers have attributed to the hacking group, which is known as APT28 or Fancy Bear. The email, which carries a booby-trapped attachment that leverages two recently disclosed Microsoft Word vulnerabilities, shows that the government-backed hacking group effectively spoofed a NATO email address to make the message appear authentic. The hq.nato.intl domain is currently used by NATO employees. The file has already been submitted to Virus Total, a publicly maintained library of computer viruses. Typically files don’t appear on the site unless they have been found in the wild. An analyst from cybersecurity firm FireEye confirmed the phishing email pictured above is in fact authentic and related to APT28 activity. […]

The post Russia-linked hackers impersonate NATO in attempt to hack Romanian government appeared first on Cyberscoop.

Continue reading Russia-linked hackers impersonate NATO in attempt to hack Romanian government