An investigation into the Carbanakby journalist Brian Krebs and security researcher Ron Guilmette has uncovered evidence pointing to a security firm based in Russia and its CEO, a 28-year-old Russian named Artem Tveritinov.
Carbanak is the name of a criminal group that, according to a Kaspersky investigation, has used the Carbanak malware to steal an estimated $1 billion from banks around the world in the past year, and they have returned with new attacks in recent months.
Guilmette says he studied the Whois records of domains used to send spam that spread the Carbanak malware, which he found in the reports of various security services companies.
He discovered that many of these domains were registered using the email address williamdanielsen@yahoo.com, under the name of a Chinese company, Xicheng Co..
Another security firm, ThreatConnect, followed up Guilmette's research and found at least 484 sites linked to the same email address, or to 26 other email addresses that have the same phone numbers or the same Chinese company name.
ThreatConnect said that 304 of those 484 domain names had been used to distribute malicious content as part of the Carbanak attacks.
Among the domains that had these two phone numbers was the domain of Cubehost.biz, a web hosting company.
During the conversation via email and phone, Infocube's CEO, denied any association with Cubehost.biz.
But Krebs' investigation didn't stop there, and he pointed out on his blog that the Infocube and Cubehost domains run on the same IP addresses, which appear to belong to an individual named Ras Al Khaimah.
Many of the domain names used in the Carbanak attacks were hosted on this IP block.
Gulimette complements Krebs' discovery by noting that this same block also hosted the domains used in the Citadel banking trojan infrastructure.
