Operation Lyrebird: INTERPOL and Moroccan Police Apprehend Suspected Cybercriminal
Summary
A two-year Group-IB investigation helped INTERPOL and Moroccan police apprehend a suspect linked to phishing, fraud, malware development, and attacks on French companies and more than 130 websites.
Key points
- The suspect, known as Dr. HeX, was apprehended by Moroccan police in 2021 after a two-year investigation supported by Group-IB.
- The investigation linked the suspect to attacks targeting French telecommunications companies, major banks, and multinational corporations.
- Group-IB traced the suspect through a phishing kit targeting a large French bank; its scripts contained a nickname and contact email that helped identify related online accounts and domains.
- The phishing kit spoofed a company website, solicited login credentials through mass-distributed emails, and redirected collected credentials to the perpetrator.
- Group-IB attributed defacement of 134 websites between 2009 and 2018 to the suspect and found evidence of involvement in phishing, malware development, fraud, and carding.
- Group-IB shared its findings with INTERPOL, enabling cooperation with Moroccan police to locate and apprehend the suspect.
Article Details
- Event Type
- A two-year international investigation, Operation Lyrebird, led to the apprehension in 2021 of a Moroccan suspect accused of cybercrime.
- Impact
- Group-IB reported that the suspect was responsible for attacks on 134 websites between 2009 and 2018 and was linked to phishing, defacement, fraud, carding, and malware development. The phishing scheme collected victims’ login credentials; Group-IB also reported evidence suggesting attacks aimed at stealing bank-card data from French corporations.