GOZNYM CYBER-CRIMINAL NETWORK OPERATING OUT OF EUROPE TARGETING AMERICAN ENTITIES DISMANTLED IN INTE

https://www.justice.gov/usao-wdpa/pr/goznym-cyber-criminal-network-operating-out-europe-targeting-american-entities

Department of Justice
U.S. Attorney’s Office
Western District of Pennsylvania

FOR IMMEDIATE RELEASE
Thursday, May 16, 2019

GOZNYM CYBER-CRIMINAL NETWORK OPERATING OUT OF EUROPE TARGETING AMERICAN ENTITIES DISMANTLED IN INTERATIONAL OPERATION

PITTSBURGH – A complex transnational organized cybercrime network that used GozNym malware in an attempt to steal an estimated $100 million from unsuspecting victims in the United States and around the world has been dismantled as part of an international law enforcement operation. GozNym infected tens of thousands of victim computers worldwide, primarily in the United States and Europe. The operation was highlighted by the unprecedented initiation of criminal prosecutions against members of the network in four different countries as a result of cooperation between the United States, Georgia, Ukraine, Moldova, Germany, Bulgaria, Europol and Eurojust.
(snip)

Earlier today, the U.S. Attorney’s Office for the Western District of Pennsylvania unsealed an Indictment returned by a federal grand jury in Pittsburgh charging 10 members of the GozNym criminal network with conspiracy to commit computer fraud, conspiracy to commit wire fraud and bank fraud, and conspiracy to commit money laundering. An eleventh member of the conspiracy was previously charged in a related Indictment. The victims of these crimes were primarily U.S. businesses and their financial institutions, including a number of victims located in the Western District of Pennsylvania.
(snip)

According to the Indictment, the defendants conspired to:
•infect victims’ computers with GozNym malware designed to capture victims’ online banking login credentials;
•use the captured login credentials to fraudulently gain unauthorized access to victims’ online bank accounts; and,
•steal money from victims’ bank accounts and launder those funds using U.S. and foreign beneficiary bank accounts controlled by the defendants.
(snip)

The GozNym network exemplified the concept of “cybercrime as a service.” According to the Indictment, the defendants advertised their specialized technical skills and services on underground, Russian-language, online criminal forums. The GozNym network was formed when these individuals were recruited from the online forums and came together to use their specialized technical skills and services in furtherance of the conspiracy.

According to the Indictment, Alexander Konovolov, aka “NoNe,” and “none_1,” age 35, of Tbilisi, Georgia, was the primary organizer and leader of the GozNym network who controlled more than 41,000 victim computers infected with GozNym malware. Konovolov assembled the team of cybercriminals charged in the Indictment, in part by recruiting them through the underground online criminal forums. Marat Kazandjian, aka “phant0m,” age 31, of Kazakhstan and Tbilisi, Georgia, was allegedly Konovolov’s primary assistant and technical administrator. Konovolov and Kazandjian are being prosecuted in Georgia for their respective roles in the GozNym criminal network.
(snip)