Carberp Banking Trojan Gang Dismantled After Investigation and Prosecutions
Summary
Group-IB assisted law enforcement in investigating Carberp, a banking Trojan operation that infected more than 1.5 million computers and stole funds. Eight members were arrested in 2012, and two organizers were sentenced in 2014.
Key points
- Carberp infected more than 1.5 million computers and targeted remote banking systems, initially in Russia and later in other countries.
- The Trojan stole banking credentials and electronic signature keys, then enabled fraudulent transfers and money laundering through mule accounts.
- Compromised websites and exploit kits were used to deliver the malware through drive-by downloads.
- In March 2012, law enforcement arrested eight members and seized devices, forged materials, bank cards, and more than $250,000 in cash.
- Two organizers were sentenced to five and eight years in prison in 2014.
- The malware continued to circulate after the botnet operators were arrested, and other groups used modified Carberp variants.
Article Details
- Event Type
- Investigation and law-enforcement action against the Carberp cybercrime group, resulting in arrests and convictions.
- Impact
- The investigation helped identify Carberp members and its command-and-control servers, and contributed to arrests and convictions. Group-IB reports that its work with organizations in multiple countries prevented further thefts affecting customers of more than 100 banks. Carberp had infected more than 1.5 million computers and stolen money from accounts belonging to over 1,000 Russian citizens and companies.
People
Threat Actors
Malware
BlackHoleThese websites, already infected with exploit kits such as BlackHole, served as launch points for drive-by download attacks.CarberpGroup-IB helped bring to justice members of Carberp, a hacker group responsible for large-scale attacks on remote banking systems. The group had operated an extensive botnet and infected more than 1.5 million computers.
Vendors
Countries
Canadaand servers, in cooperation with organizations from various countries (including the Netherlands and Canada), prevented further thefts from customers at more than one hundred banks around the world.ItalyThe group later expanded its range to Western financial organizations, however, including in Turkey, the United Kingdom, Spain, the United States, and Italy.Netherlandsgroup’s botnet and servers, in cooperation with organizations from various countries (including the Netherlands and Canada), prevented further thefts from customers at more than one hundred banks around the world.Russiawere involved in 92% of the cases. By December 2011, the largest botnet targeting banks (initially in Russia and later worldwide) had infected more than 1.5 million computers. This notorious botnet was known asSpainThe group later expanded its range to Western financial organizations, however, including in Turkey, the United Kingdom, Spain, the United States, and Italy.TurkeyThe group later expanded its range to Western financial organizations, however, including in Turkey, the United Kingdom, Spain, the United States, and Italy.United KingdomThe group later expanded its range to Western financial organizations, however, including in Turkey, the United Kingdom, Spain, the United States, and Italy.United StatesThe group later expanded its range to Western financial organizations, however, including in Turkey, the United Kingdom, Spain, the United States, and Italy.