Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

Cybercriminals Stole $45 Million in Multi-National Bank Heist: US

Cybercriminals Stole $45 Million in Multi-national Bank Heist: US

Cybercriminals Stole $45 Million in Multi-national Bank Heist: US

Cyber thieves around the world stole $45 million by hacking into debit card companies, scrapping withdrawal limits and helping themselves from cash machines, US authorities said Thursday.

The massive heist unfolded “in a matter of hours,” said the US prosecutor’s office for Brooklyn, New York.

Prosecutors unveiled charges against eight people accused of forming the New York cell of the plot, which stretched across 26 countries. In their case, they allegedly lifted $2.8 million in cash and now face charges of conspiracy to commit access device fraud and money laundering.

Seven of the eight have been arrested, the US attorney’s office said. The eighth, Alberto Yusi Lajud-Pena, who was the leader and was nicknamed “Prime” and “Albertico,” is reported to have been murdered two weeks ago, the office said.

“The defendants and their co-conspirators participated in a massive 21st century bank heist that reached across the Internet and stretched around the globe,” US Attorney Loretta Lynch said in a statement.

“In the place of guns and masks, this cybercrime organization used laptops and the Internet.”

The type of heist is known to criminals as an “unlimited operation” and two were allegedly carried out: first on December 22 last year and again on February 19-20 this year.

In the initial stage, taking several months, sophisticated hackers allegedly infiltrated credit card processors’ computer networks, looking into databases of prepaid debit cards, a tool used often by employers and aid organizations.

Advertisement. Scroll to continue reading.

Breaking into the system, the hackers eliminated withdrawal limits imposed by banks.

Next, the hackers cybergang distributed the debit card numbers to its street associates called “cashers,” who loaded other magnetic stripe cards, like gift cards, with the stolen data.

Finally, the cashers were given stolen PIN numbers and sent to harvest the loot, going from ATM to ATM and withdrawing as much as cash as they could for the organization.

In the first alleged raid, hackers targeted RAKABANK in the United Arab Emirates. After manipulating the withdrawal limits, casher gangs worldwide hit the ATMs, conducting some 4,500 transactions worth $5 million across about 20 countries.

In the second attack, US prosecutors say, the group broke into the Bank of Muscat based in Oman. Then in the space of 10 hours, casher cells in 24 countries conducted some 36,000 transactions, withdrawing $40 million from ATMs.

The New York cell, the US attorney’s office says, took $400,000 in the first raid and $2.4 million on the second, when it made some 3,000 ATM withdrawals.

The prosecutor’s office highlighted the “surgical precision” of the alleged plot and “the speed and coordination with which the organization executes its operations on the ground. These attacks rely upon both highly sophisticated hackers and organized criminal cells whose role is to withdraw the cash as quickly as possible.”

According to the indictment of the New York defendants, they quickly moved to launder their cash, opening a Miami bank account and pouring money into cars, including a Porsche and a Mercedes, and two Rolex watches. There was no detail given on the apparent murder of their leader just over two months after the second alleged heist.

Nor did prosecutors give details of where else the alleged criminal operations unfolded abroad.

However, they gave some idea of the scope of the alleged crime by thanking authorities from more than a dozen countries: Belgium, Britain, Canada, the Dominican Republic, Estonia, France, Germany, Italy, Japan, Latvia, Malaysia, Mexico, Romania, Spain, Thailand, and the United Arab Emirates.

Updated: 05/10/13 10:15AM with additional content.

Written By

AFP 2023

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Don’t miss this Live Attack demonstration to learn how hackers operate and gain the knowledge to strengthen your defenses.

Register

Join us as we share best practices for uncovering risks and determining next steps when vetting external resources, implementing solutions, and procuring post-installation support.

Register

People on the Move

SSH Communications Security has appointed Pauli Haikonen as the company’s Chief Information Security Officer (CISO).

Cloud and container security firm Sysdig has tapped William Welch as CEO on its path to an IPO.

Dave Scher has been promoted to Deputy Chief Information Officer at MITRE.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.