PhishEye Banking Crew Stole More Than $320,000 from Russian Customers
Summary
Group-IB describes how the PhishEye group used banking Trojans, phishing pages, and phone scams to steal from thousands of Russian bank customers before its leaders and accomplices were arrested and sentenced.
Key points
- The Popelysh twins and their associates used Trojans to redirect customers from legitimate online banking sites to phishing pages that stole login details and confirmation codes.
- The group used callers posing as bank employees to persuade victims to disclose transfer confirmation codes.
- From March 2013 to May 2015, the group accessed more than 7,000 customer accounts and stole over $320,000.
- The twins had previously received suspended sentences for bank-customer thefts, then resumed criminal activity using updated malware and automated theft processes.
- Group-IB assisted law enforcement with digital forensics and evidence analysis during the investigation.
- In 2018, the twins were sentenced to eight years in prison; their accomplices also received prison or suspended sentences.
Article Details
- Victim Organization
- Customers of various Russian banks
- Incident Type
- Banking credential theft using PC Trojans, phishing, and vishing
- Data Types Exposed
- Online banking logins
- Passwords
- SMS verification and transfer confirmation codes
- Affected Records
- More than 7,000 customer accounts were accessed between March 2013 and May 2015. Earlier activity affected 16 customers between September and December 2010, and 170 customers by February 2011.
- Operational Impact
- Funds were stolen from customer accounts. The article reports more than $320,000 stolen between March 2013 and May 2015, approximately $67,000 from 16 customers between September and December 2010, and a total of $448,000 by February 2011.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
People
Alexander SarbinDescribed as a hacker who carried out early attacks on banking customers with the Popelysh twins.Dmitry PopelyshIdentified as one of the Popelysh twins who led the banking-theft group and was sentenced to eight years in prison in 2018.Evgeny PopelyshIdentified as one of the Popelysh twins who led the banking-theft group and was sentenced to eight years in prison in 2018.Sergey LupaninFormer Head of Group-IB Investigations; named in the article.
Threat Actors
Malware
Patched.IBThey equipped themselves with new malware (QHost and Patched.IB), automated the theft process, and continually updated the viruses themselves, thereby managing to evade anti-virus systems.QHostThey equipped themselves with new malware (QHost and Patched.IB), automated the theft process, and continually updated the viruses themselves, thereby managing to evade anti-virus systems.Trojan.Win32.VKhostThe criminals infected computers with a virus called Trojan.Win32.VKhost, which redirected customers from the official online banking services of a major Russian bank to a phishing page.