Europol has uncovered a global cybercrime network that used the malware GozNym to steal around $100 million, the company said in a statement on Thursday.
Five members of the network have been arrested in Georgia, Moldova, Ukraine and Russia, while five remain at large. All ten have been charged by the US with conspiracy to infect victims' computers with malware, steal login credentials and steal funds.
Criminals primarily target businesses and financial institutions, using sophisticated GozNym malware to infect victims’ computers. The malware allowed them to steal login credentials and gain unauthorized access to victims’ online banking accounts, steal the money, and then transfer it to U.S. and foreign bank accounts.
Europol, which works with Eurojust, the European Union's judicial cooperation unit, and the US Department of Justice, says the criminals are sophisticated and well-organized. They used their technical skills and several criminal services to identify victims, carry out phishing attacks, encrypt the malware so it cannot be detected by anti-virus tools and launder the money.
The gang leader, as well as his technical assistant, are being prosecuted in Georgia.
GozNym is an advanced malware created by two different malware strains (Gozi ISFB and Nymaim) and designed to attack financial institutions. Europol estimates that the criminal network stole more than 41,000 victims using the malware.
According to Europol, GozNym was provided with bulletproof hosting services by an operator of the Avalanche network of compromised systems. The Avalanche operator is now facing prosecution in Ukraine for his role in providing hosting services to the GozNym criminal network.
