Threat Management, Threat Intelligence, Malware, Vulnerability Management

Hacker “soldier” steals $3.2 million from U.S. companies

A hacker known in the cybercriminal underground as “soldier” has stolen $3.2 million from major U.S. corporations in the past six months, according to researchers at anti-virus firm Trend Micro.

The attacker, believed to be in his early 20s and residing in Russia, used various toolkits, such as SpyEye and Zeus, to plunder millions of dollars from corporate bank accounts since January, Jamz Yaneza, threat research manager at Trend Micro, told SCMagazineUS.com on Thursday. The hacker oversees a network of money mules and accomplices, who are believed to reside in West Hollywood and Venice, Calif.

Trend researchers have been investigating the hacker's operations since April and have notified federal authorities, Yaneza said.

Affected organizations run the gamut in terms of sector and include the U.S. military, educational and research institutions; airports; banks; and automobile, media and technology firms. Yaneza said he could not name the victim corporations due to an active federal law enforcement investigation.

A number of home users also have been victimized, he said. While nearly all of the victims are located in the United States, a small amount reside in some 90 countries, including the U.K, Brazil, Mexico, Thailand, Turkey, Saudi Arabia, India, Romania, and Canada.

Yaneza said the hacker heavily relied on the SpyEye and Zeus tookits, which come with full support and regular updates, and are available for purchase on black market.

Starting around January, the intruder began using Zeus to compromise users' systems via drive-by downloads.

Once compromised, computers were infected with banking trojans that automate the process of conducting online banking fraud, Yaneza said. The malware is capable of siphoning small increments of money at a time out of bank accounts without users noticing.

SpyEye and Zeus also routinely are used to steal credentials from high-profile sites such as Facebook, Yahoo, Google, eBay, Amazon, Twitter, PayPal and Skype.

To increase the number of infected computers under his control, the hacker began using the stolen funds accrued from the operation to lease out infected machines from other criminals.

Between April 19 and June 29, the hacker amassed a botnet of more than 25,000 systems, 57 percent of which were running Windows XP, according to Trend Micro researchers. Some 4,500 infected systems were running the latest Windows operating system, Windows 7.

“Given that the tools are being sold on the underground, this is just one example of what dozens [of criminals] could be doing,” Yaneza said.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.