Is the Game Over for GameOver Zeus?

Several weeks ago law enforcement friends in Pittsburgh started asking people not to publish anything too public about GameOver Zeus. When we asked why, we got a teasing "You'll see!" Now our ISP friends that were participating in the effort are grinning ear to ear as we may actually have a chance to disrupt Zeus in a meaningful way. Being a legal geek, I was excited to have the documents published on the main Justice website today at www.justice.gov/opa/gameover-zeus.html.

The Complaint against Evgeniy Mikhailovich Bogachev aka Slavik, aka Pollingsoon was unsealed in court where the Pittsburgh FBI led the investigation into CryptoLocker and GameOver Zeus. In addition to Bogachev, charges are filed against several aliases of as-yet-unidentified hackers, "Temp Special", "Ded", Chingiz (aka Chingiz 911), and Mr.KyKyPyKy. The Complaint charges that "Together, GOZ and Cryptolocker have infected hundreds of thousands of computers around the world and have generated losses that exceed $100 million."

Some of the specific cases mentioned in the complaint include:

• A composite materials company in the Western District of Pennsylvania which lost more than $198,000 from its bank account using credentials stolen by the Defendants through the use of GOZ; (The Pittsburgh Indictment shares more details, telling us this was Haysite Reinforced Plastics, whose PNC Bank account was fraudulently accessed and used to send their money to a Mule account in the name of Lynch Enterprises, LLC, at SunTrust Bank in Atlanta, Georgia, after they clicked on a NACHA email informing them their ACH payment had failed, in October 2011. They also transfered $175,756.91 to an account belonging to R&R Jewelers, and ATTEMPTED six additional transfers, all on October 20, 2011. The money in the SunTrust account was quickly moved on ($99,822 of it, anyway) to an HSBC account in London.)
• An Indian tribe in Washington - $277,000
• A corporation managing assisted living facilities in Pennsylvania - $190,800
• A regional bank in Northern Florida - $7 Million

CryptoLocker is described separately as having "first emerged in mid-to-late 2013" and infected "more than 230,000 computers, including more than $120,000 in the United States.

Just between October 15, 2013 and December 18, 2013, we know that $27 million in ransom payments were made, just by tracking the ransom payments made using Bitcoin!

The charges in the criminal complaint are:

Count I: Wire fraud: 18 USC Section 1343 "Having devised a scheme or artifice to defraud and for obtaining money by means of false or fraudulent pretenses and transmitting and causing to be transmitted by means of wire communications in interstate and foreign commerce, writings, signs, and signals for the purpose of executing such scheme or artifice.

Count II: Bank Fraud: 18 USC Section 1344 "knowingly executing a scheme or artifice to defraud financial institutions insured by the FDIC and to obtain moneys under the custody and control of these institutions by means of false and fraudulent pretenses and representations.

Count III: Unauthorized interception of electronic communications: 18 USC Section 2511 "intentionally intercepting electronic communications, and intentionally using and endeavoring to use the contents of the electronic communications knowing that the information is obtained through the unauthorized interception of electronic communications."

all of which, according to 18 USC Section 1345(a) and (b) allows Injunctive Relief to prevent a continuing and substantial injury to the owners and legitimate users of the infected computers.

An FBI Pittsburgh cyber agent was the affiant in the 28 page Application for Temporary Restraining Order recounts that while the largest known single wire transfer was a $6.9 million wire, fraudulent wires in the amount of $1 million dollars were "very common." A single bank experienced 11 fraudulent wires, with six being for more than $950,000 and the largest being 2 million dollars!

The GOZ affidavit mentions a few email addresses, Bogachev uses as one email address, bollinger.evgeniy@yandex.ru, while Chingiz 911 uses charajiang16@gmail.com. Seeing the nickname "Ded" as one of the members of the gang, I can't help but recall "Ded Pixto" the nickname for Stanislav Avdeiko the Koobface malware author.

So how will this "takedown" actually work? First, some hard work by a couple genius malware reverse engineers at Dell Secure Works and CrowdStrike helped the Pittsburgh FBI agent to understand the current Command & Control infrastructure so it could be rendered harmless. The problem though, is that both GOZ and Cryptolocker have a built-in backup plan in the form of a Domain Generation Algorithm. The job of a DGA is to allow the botmaster to IN THE FUTURE reconnect to his bots using infrastructure that neither the bots nor the botmaster have even created yet. A formula is used to calculate a domain name based on a timestamp. So, if NONE of the hard-coded IP addresses are able to be reached, the bot will look up the current date and begin "guessing" domains that the criminal may have registered for use to update the bot with new hard-coded addresses. As a few examples, on July 1, 2014, CryptoLocker will try to connect to 1,000 domains, including:

wncbbejfurrw.net
kbdnkmpgxlxh.biz
aevmpupnouqy.ru
nrwyydvorowj.org
bvgurlkgcwya.co.uk
ojhhbtqhfqfk.info
eqcoayuicfrp.com
fsdnbhyofoiv.net
fimwcppbphaq.biz
gknvdxthsqqw.ru
iygiqgvjjkys.org
jbhhroapmtpy.co.uk
jqqqswqcwmht.info
ksrptfuiavxa.com
klrmfgyihrch.net
xysyolodvgen.biz
mgcjywthscyu.ru
atdvicjchqbb.org
otvgvnajowjk.co.uk

The Temporary Restraining Order (TRO) seeks an Order that:

1) directs four U.S. based internet domain Registries to block access to around 900 PAGES of domain names seemingly the "future" list of DGA-generated domain names for CryptoLocker and GOZ. The GameOver Zeus domains are listed in Appendix A while the CryptoLocker domains are listed in Appendix B. Because ICANN only has jurisdiction over the Generic TLDs, this approach doesn't work for the ".ru" domains. CryptoLocker also uses ".co.uk" domains, so one would hope that the British government has asked for a similar favor from their counterpart registries. The four Registries in the US were, VeriSign, Inc., representing .com and .net, Neustar, Inc., representing .biz, Affilias USA, Inc., representing .info, and Public Interest Registry, representing .org.

Appendix A actually contains 25,937 domains for Game Over Zeus, arranged in ten columns, with three columns of domains listed on pages 1-69, 70-138, 139-207, and then a single column on pages 208 to 276. Its actually seven columns of 2594 domains and three columns of 2593 domains or 25,937 domains for Game Over Zeus.

Appendix B has six columns on pp. 1-176, pp.177-352, and then six columns of various length from 353 to the end of the 704 page document, for a total of 130,421 domains for CryptoLocker.

Affilias, Neustar, Verisign, and Public Interest Registry are ordered to redirect all of those 156,000 or so domains to use the nameservers ns1.kratosdns.net and ns2.kratosdns.net, preventing the criminals from using those domains to re-establish control of their botnet.

2) directs the twenty largest ISPs in America to not allow access from their networks to the .RU domains that the DGA can make, as the .RU domains are not under ICANN control. The ISPs named here are:

Cablevision, AT&T, Cox, Comcast, Mediacom, AOL, Frontier, Sprint, Time Warner Cable, Verizon, Charter, CenturyLink, Suddenlink, Wide Open West, Windstream, Level 3, Armstrong Group of Companies, Bright House, Earthlink, and NTT America.

Those ISPs are forbidden to allow traffic to the .ru domains listed in Appendix C.

3) To redirect all traffic intended for one of those domains to .gov controlled servers

and

4) to seek a Pen Register/Trap and Trace Order that would gather information about the nodes directed to those replacement boxes, and to share that information back to the ISPs and victims to help protect themselves. This "Dialing, Routing, Addressing, and Signaling" data (called DRAS in telephone-legalese) is to be turned over to the government so that attempts can be made to clean up these victims computers.

In cooperation with these efforts, McAfee is providing their "Stinger" program to be used by any victims to clean and remove GameOver Zeus or CryptoLocker infections.

All of that is now in play ... it is too early to tell if the game is really over, but best of luck and congratulations to the fine agents and CCIPS lawyers who made this possible!

Blackshades RAT leads to 97 Arrests in 16 countries

On May 19, 2014, the FBI announced a worldwide coordinated action against criminals who created, sold, and used a Remote Administration Trojan (RAT) known as BlackShades. In the FBI's BlackShades Press Release they shared that 40 participating FBI Field Offices had conducted 100 interviews, executed more than 100 e-mail and physical search warrants and seized more than 1,900 domains used by BlackShades to control victims' computers.

(image from FBI.gov)

The case actually was a spin-off from another major international operation called "Operation Card Shop" that we wrote about in April 2012 (see SOCA & FBI seize 36 Criminal Credit Card Stores. As Law Enforcement reviewed the seized websites from that case, they began to realize the extent of the role of the BlackShades RAT in the theft of credit card information, but realized also that it was much larger than they had at first believed. One of those arrested during Operation Card Shop was Michael Hogue, one of the co-authors of Blackshades, who agreed to cooperate in unveiling the rest of the BlackShades operation.

Blackshades and Miss Teen USA

For many Americans, the first time they heard of Blackshades was in the case of Miss Teen USA 2013, Cassidy Wolf. In that case, Blackshades customer Jared James Abrahams, a 20-year-old college student, used Blackshades to begin capturing video from Cassidy's webcam. The victim, unaware that their webcam is even recording, goes about their business, including dressing and undressing. Like most teens, having a laptop on in the bedroom is not unusual, and after capturing some nude images, Abrahams attempted to extort additional videos in exchange for not releasing the first images to Cassidy's friends on Facebook. But Blackshades is able to do so much more than capturing an occasional nude image! While most commonly used for good old fashioned credential and credit card theft, Blackshades has also been used to infiltrate Syrian rebel computers, as first reported by the EFF and with many more details shared by MalwareBytes.

Blackshades CoCreators HOGUE and YÜCEL

Michael Hogue, who used the hacker name xVisceral, was originally arrested in Tucson, Arizona as part of a group of arrests announced by Preet Bharara, the US Attorney in the Southern District of New York, on June 26, 2012 as part of the follow-up to Card Shop. In addition to xVisceral/Hogue that sweep grabbed up 404myth (Christian Cangeopol of Lawrencevill, Georgia), Cubby (Mark Caparelli of San Diego, California), Kabraxis314 (Sean Harper of Albuquerque, New Mexico), kool+kake (Alex Hatala of Jacksonville, Florida), OxideDox (Joshua Hicks of Bronx, New York), JoshTheGod (Mir Islam of Manhattan, new York), IwearaMAGNUM (Peter Ketchum of Pittsfield, Massachusetts), theboner1 (Steven Hansen, who was already in jail in Wisconsin) as well as 13 others in the UK (6), Bosnia (2), Bulgaria (1), Norway (1), and Germany. (See: Manhattan U.S. Attorney and FBI Assistant Director in Charge Announce 24 Arrests in Eight Countries as Part of International Cyber Crime Takedown).

For a fascinating "how I became a hacker" biography interview, please see The Rise and Fall of xVisceral which details how as a 17 year old Halo player, xVisceral first was introduced to hacking as a way to cheat other Halo players, and a detailed history of how this led to ever-more-advanced hacking tools and ultimately the creation of Blackshades. (the original source is currently unavailable, this is an archived copy of an article from:

The Charges against Hogue (filed January 9, 2013) say that "Michael Hogue a/k/a xVisceral, the defendant, and others known and unknown, willfully and knowingly combined, conspired, confederated, and agreed together and with each other to engage in computer hacking in violation of Title 18, USC, Section 1030(a)(5)(A)." It was part of the conspiracy that Hogue and others "did cause the transmission of a program, information, code and command, and as a result of such conduct, wouuld and did intentionally cause damage without authorization, to a protected computer, which would and did cause damage affecting 10 and more protected computers during a one-year period, in violation of Title 18, USC Sections 1030(a)(5)(A), 1030(c)(4)(B)(i), and (c)(4)(A)(i)(VI), to wit, HOGUES used malware to infect computers and sold that malware to others, enabling them to infect and remotely control victims' computers."

Like most RATs, once a victim has been tricked into clicking on the installer, the RAT is controlled by connecting to a server used for that purpose. The FBI was able to learn considerably more about the person being described as the "co-creator" of BlackShades, Alex YÜCEL, (also spelled Alex Yucel, Alex Yucle, Alex Yuecel), AKA marjinz, AKA Victor Soltan, by tracking one of his servers. As they investigated the various domains used to host the servers for the malware. In one case, Alex contacted a company to lease certain computers for this purpose (November 8, 2012) paying for them on January 30, 2013. On March 18, 2013, he sent email requesting tech support due to a problem with his servers. Alex was the administrator of "www.blackshades.ru" and "www.bshades.eu". Alex is a 24 year old citizen of Sweden, arrested in Moldova and awaiting extradition to the United States.

Symantec actually has an interesting screenshot from 2011 where Hogue claims to be resigning from Blackshades and turning full control over to "marjinz" in a post shared in their article from June 2012 when Hogue was first arrested. The fact that so many "script kiddie" hackers use Hack Forum may be part of why Blackshades was so popular:

(Source: www.symantec.com/connect/blogs/w32shadesrat-blackshades-author-arrested )

A Sample Customer: kbello

A look at the Criminal Complaint against one of his customers may be revealing. Kyle Fedorek (aka kbello) was charged May 15, 2014 in the Southern District of New York. On Septmeber 12, 2012, kbello purchased a copy of Blackshades over the Internet. An undercover FBI agent in New York had also purchased the software on June 30, 2010 from the same source. The FBI used this criminal complaint to document the scope and abilities of Blackshades. Between September 12, 2012 and March 2014, kbello acquired "thousands" of credit card numbers and financial account numbers through hacking using the RAT. According the the Criminal Complaint the FBI agent described Blackshades as giving the hacker "Free rein to, among other things, access and view documents, photographs and other files on the victim's computer, record all of the keystrokes entered on the victim's keyboard, steal the passwords to the victim's online accounts, and even activate the victim's web camera to spy on the victim -- all of which could be done without the victim's knowledge."

The FBI's investigation has shown that the RAT was purchased by at least several thousand users in more than 100 countries and used to infect more than half a million computers worldwide.

After kbello purchased his copy of the RAT, it was used against at least 400 victims, and was also part of a suite of additional malware that he installed on the victims' computers. After a victim was infected, the hacker could activate the "Spreader" module on that victim's computer, which would use that victim's chat programs (AOL/AIM, ICQ, MSN) and any USB devices attached to the computer to attempt to infect others.

Other modules of the program allowed the hacker to encrypt any files on the system and share a Ransomware message, demanding that payment be sent to decrypt the module. The message could be customized per victim, or the same message could be sent to many victims.

Many other modules were available, including password stealers, webcam capture tools, DDOS attack tools, and others.

Records from the primary Blackshades server indicate that the program, which often sold for as little as $40 per copy, had generated $350,000 in direct sales between September 2010 and April 2014. When a purchase was made, the purchasing hacker would establish a domain name that he or she would use as their main "controlling" domain. A custom version of the software was then generated which would only take infected users to that domain. The logs on the server indicate there were at least 6,000 Blackshades customer accounts for users in 100 countries, and that at least 1900 domain names had been registered by customers to control infected computers. All 1900 of these domains have been seized by the FBI, disabling the RAT from controlling the infected computers any more.

In February 2013, the FBI obtained a warrant to search the email account "blackshadessupport@hotmail.com" - which Yucel used to communicate with his employees who were offering technical support and administering his various infrastructure. The search revealed many email communications requesting customer support and also contained copies of receipts sent to customers for various products and services offered by the Blackshades organization.

This search warrant revealed a home address in Stony Point, New York for Kyle Fedorek when he purchased "Blackshades Remote Controller (R.A.T.) for 40.00 USD". The seized Blackshades Server also provided the information that KBello had registered the hostnames "kbella.zapto.org" and "kbello.zapto.org" as his controllers. The IP address to which these names resolved in April and May of 2013 were subscribed to at the Fedorek Residence.

In a subsequent search warrant, executed March 6, 2014, agents seized a laptop from the bedroom of Kyle Fedorek, where the username of the laptop was Kyle, and recovered a copy of the Blackshades RAT. The RAT was configured to run the "Form Grabber" (stealing any information victims typed into a webform, such as a userid and password prompt box on a banking website). At least 400 victims had provided information unwittingly to Fedorek through this form grabber. The laptop also was being used to run other malware schemes, including CARBERP, Andromeda, and Citadel, and had evidence of having been used to create Phishing sites as well. DDOS tools, SQL Injection tools were also present. More than 9,000 sets of userids and passwords and 50,000 sets of credit card information were found on the laptop.

The UK's National Crime Agency

The UK's National Crime Agency (NCA, formerly SOCA), issued their own press release. (See Unprecedented UK Operation aids global strike against Blackshades malware) indicating that 17 Blackshades customers were apprehended in the UK and that their records suggested that at least 200,000 worldwide victims had their information harvested by Blackshades customers in the UK.

EuroJust

The European Union's Judicial Cooperation Unit in The Hague also issued a press release. (See International operation hits Blackshades users.) They indicated that at least 359 "house searches" were carried out worldwide and that 97 people had been arrested. 1100 data storage devices had been seized in those searches, including computers, mobile phones, external hard drives, and USB memory sticks, in addition to "substantial quantities" of cash, illegal firearms, and drugs.

Dutch High Tech Crime Team

The Dutch High Tech Crime Team was able to secure a server in Delft operated by an 18 year old Black Shades customer. One of their most high-profile Blackshades customers was a 19 year old man who was controlling more than 2,000 webcams being used to capture photos and videos of female victims. The Dutch police seized 96 computers and laptops, 18 mobile phones, and 87 USB sticks and hard drives during searches on 34 residences. (See: 34 Dutch homes raided in worldwide crackdown on hacking software.

Dutch High Tech Crimes statement - www.om.nl/actueel/nieuwsberichten/@162701/wereldwijde-actie/