Trouble Ahead After DPRK’s FM Visit to Tehran

Posted on August 9, 2018August 9, 2018 by Denise Simon

So, it appears there is more to the teaming up between Tehran and Pyongyang.

The Iranian President Rouhani told the North Korean Foreign Minister in a recent confab to NOT trust the United States.

Meanwhile, SecState, Mike Pompeo issued a proposal to North Korea calling for a timeline Pompeo that would mandate North Korea hand over 60 to 70 percent of its nuclear warheads to a third party within six to eight months, according to the report.

North Korea has reportedly rejected a formal timeline for its denuclearization proposed by Secretary of State Mike Pompeo.

Vox reported Wednesday that Pyongyang has rejected the timeline several times over the past two months amid continued negotiations over North Korea’s nuclear program.

The timeline Pompeo proposed would mandate North Korea hand over 60 to 70 percent of its nuclear warheads to a third party within six to eight months, according to the report.

However, it is unclear how many warheads North Korean leader Kim Jong Un has, making it difficult to verify that Pyongyang has actually turned over an agreed-upon percentage.

Trump administration officials in recent weeks have expressed frustration with North Korea’s efforts to denuclearize despite President Trump hailing his June summit with Kim in Singapore as a success.

“The ultimate timeline for denuclearization will be set by Chairman Kim, at least in part,” Pompeo told Channel NewsAsia in an interview last week.

“The decision is his. He made a commitment, and we’re very hopeful that over the coming weeks and months we can make substantial progress towards that and put the North Korean people on a trajectory towards a brighter future very quickly.”

White House national security adviser John Bolton told Fox News on Tuesday that “North Korea that has not taken the steps we feel are necessary to denuclearize.”

photo

Then we have yet another emerging hacking warning from CERT.

The Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI) have identified a Trojan malware variant—referred to as KEYMARBLE—used by the North Korean government. The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA.

US-CERT encourages users and administrators to review Malware Analysis Report (MAR) MAR-10135536-17 and the US-CERT page on HIDDEN COBRA – North Korean Malicious Cyber Activity for more information.

Not to leave out Iran’s cyber attack warnings.

Iranian hackers have laid the groundwork to carry out extensive cyber attacks against private U.S. and European companies, U.S. officials warn, according to NBC News. Although experts don’t believe any such attack is imminent, the preparations could enable denial-of-service attacks on infrastructure including electric grids and water plants, plus health care and technology companies across the U.S., Europe, and Middle East, say U.S. officials at the 2018 Aspen Security Forum.

A spokesperson for the Iranian mission to the United Nations, Alireza Miryousefi, told NBC News that the U.S. is more aggressive in terms of cyber attacks, and Iran’s moves are merely defensive.

***

As sanctions reimposed in response to its nuclear program begin to bite, Iran seems poised to follow the trail North Korea blazed in cyberspace: state-directed hacking that aims at direct theft to redress economic pain. Accenture researchers have been tracking ransomware strains, many of them requiring payment in Bitcoin or other cryptocurrencies, and they’ve concluded that they represent an incipient Iranian campaign against targets of opportunity that offer the prospect of quick financial gain. Tehran’s state-directed hackers have a reputation as being relatively less sophisticated than those run by Russia and China (and indeed those run by major Western powers, the Five Eyes and their closest friends) but they also have a reputation as determined fast-learners.

CCN: As the US gets ready to impose sanctions on Iran, hackers in that country are working on ransomware to secure bitcoin, according to cybersecurity experts interviewed by The Wall Street Journal.

Accenture PLC’s cybersecurity intelligence group has followed five Iranian built ransomware variations in the last two years. The hackers are hoping to secure payments in cryptocurrencies, according to Jim Guinn, who oversees the industrial cybersecurity business at Accenture.

Several clues link the ransomware to Iran. Samples include messages in Farsi that are connected to Iran based computers.

A recent Accenture report noted the ransomware could be driven by Iranian government supported parties, criminals, or both.

Scourge Continues

Ransomware has plagued both businesses and governments for years, having disabled payment systems at the San Francisco Municipal Transportation Agency, U.K hospitals and cargo shipments. Government supported hackers in some instances have obtained cryptocurrency payments from victims.

One variant of ransomware that iDefense discovered has been linked to Iran’s government, according to CrowdStrike Inc., another cybersecurity firm. The software, called Tyrant, was developed to discourage Iranian citizens from downloading software designed to discourage government snooping, CrowdStrike noted.

Palo Alto Networks Inc. and Symantec Corp. issued reports last month that described a pair of data stealing operations connected to Iran.

Crypto Mining Linked To Iran

Crypto mining software, which robs computers of their processing power to mine cryptocurrencies, has also been linked to Iran.

Accenture cited crypto mining software installed on Middle Eastern customer networks equipped with digital clues to Iran.

Crypto mining software has created problems in gas and oil facilities in the Middle East, Guinn said. He estimated millions of dollars of compute cycles have been stolen in the last year.

Iran Denies Culpability

Iran has claimed it has not been involved in cyber attacks, and that it has been a hacking victim.

A cyber attack called Stuxnet initiated by the U.S. and Israel about a decade ago disabled uranium-enrichment centrifuges for Iran’s nuclear program. Iran has since focused on enhancing its own cyber capabilities, according to government officials and security researchers.

Keith Alexander, chief executive of IronNet Cybersecurity Inc. and former director of the U.S. Cyber Command and the National Security Agency said crypto mining and theft is a way for cash-strapped countries to make fast profits.

Guinn said hackers have also stolen intellectual property.

New Mexico Compound was Training for School Shooting

Posted on August 8, 2018August 8, 2018 by Denise Simon

Timeline:

TAOS, N.M. (AP) — The Latest on 11 children found living in a filthy, makeshift compound in New Mexico (all times local):

12:30 p.m.

Prosecutors say in court documents that the father of a missing Georgia boy was training children at a New Mexico compound to commit school shootings.

The documents filed Wednesday say Siraj Ibn Wahhaj (see-DAHJ’ IBN wah-HAJ’) was conducting weapons training at the compound near the Colorado border where 11 hungry children were found in filthy conditions.

Prosecutors filed the documents while asking that Wahhaj be held without bail.

Wahhaj was arrested last week with four other adults. They are facing child abuse charges.

Authorities say the remains of a boy also were found on the compound but have not been positively identified by a medical examiners.

__

9:30 a.m.

New Mexico officials investigating a makeshift compound where 11 children were found hungry plan to ask a judge to hold the father of a missing boy without bail.

New Mexico 8th Judicial District Attorney Donald Gallegos said Tuesday that prosecutors are putting together evidence to ask a judge to hold Siraj Ibn Wahhaj (see-DAHJ’ IBN wah-HAJ’) without bond.

A warrant from Georgia seeks the extradition of Wahhaj to face a charge of abducting his son from that state last December.

He is scheduled to appear in a Taos County court on Wednesday. Wahhaj and four other adults also face felony child abuse charges after a raid by authorities found the 11 children living in filth.

The missing boy was not among the children found in that initial search but authorities say they found the remains of a child that they are working to identify.

___

12 a.m.

The father of a missing boy is due in court Wednesday as authorities work to identify a child’s remains uncovered in an isolated New Mexico compound where he was arrested last week.

A warrant from Georgia seeks the extradition of Siraj Ibn Wahhaj to face a charge of abducting his son from that state last December.

Wahhaj and four other adults also face felony child abuse charges after a raid by authorities revealed 11 hungry children living in filth.

The missing boy was not among the children found in that initial search.

The district attorney said he would withhold comment on the potential for additional charges until investigators identified the remains found on the site.

***

CORRECTS LAST NAME TO MORTON, NOT MORTEN – This photo provided by the Taos County Sheriff’s Department shows Lucas Morton, left, and Siraj Wahhaj. Morton and Wahhaj were arrested after law enforcement officers searching a rural northern New Mexico compound for a missing 3-year-old boy found 11 children in filthy conditions and hardly any food. (Taos County Sheriff’s Department via AP)

AMALIA, N.M. (AP) — For months, neighbors worried about a squalid compound built along a remote New Mexico plain, saying they brought their concerns to authorities long before sheriff’s officials first found 11 hungry children on the lot, and then the remains of a small boy.

Two men and three women also had been living at the compound, and were arrested following a raid Friday that came as officials searched for a missing Georgia boy with severe medical issues.

Medical examiners still must confirm whether the body found at the property in a second search on Monday is that of Abdul-ghani Wahhaj, who was 3 in December when police say his father took him from his mother in Jonesboro, Georgia.

The boy’s father, Siraj Ibn Wahhaj, was among those arrested in the compound raid that has since resulted in the series of startling revelations on the outskirts of Amalia, a tiny town near the Colorado state line marked by scattered homes and sagebrush. Authorities said they found the father armed with multiple firearms, including an assault rifle.

Siraj Ibn Wahhaj was scheduled to appear in court Wednesday on a warrant from Georgia that seeks his extradition to face a charge of abducting his son from that state last December. He had expressed wanting to perform an exorcism on his son, the warrant said.

The group arrived in Amalia in December, with enough money to buy groceries and construction supplies, according to Tyler Anderson, a 41-year-old auto mechanic who lives nearby.

He said Tuesday he helped the newcomers install solar panels after they arrived but eventually stopped visiting.

Anderson said he met both of the men in the group, but never the women, who authorities have said are the mothers of the 11 children, ages 1 to 15.

Anderson did not recall seeing the Georgia boy who was missing. But he said some of the smaller children from the compound turned up to play with children at neighboring properties after the group first arrived.

“We just figured they were doing what we were doing, getting a piece of land and getting off the grid,” said Anderson, who moved to New Mexico from Seattle with his wife seven years ago.

As the months passed, however, they stopped seeing the smaller children playing in the area. They also stopped hearing guns fired off at a shooting range on the property, he said.

Jason Badger, who owned the property where the compound was built, said he and his wife had pressed authorities to remove the group after becoming concerned about the children. The group had built the compound on their acreage instead of a neighboring tract owned by Lucas Morton, one of the men arrested during the raid.

“I started to try and kick them off about three months ago and everything I tried to do kept getting knocked down,” said Badger said.

A judge dismissed an eviction notice filed by Badger against Morton in June, court records said. The records did not provide further details on the judge’s decision.

After the raid, Anderson went over and looked at the property for the first time in months.

“I was flabbergasted from what it had turned into from the last time I saw it,” he said.

Authorities said the compound shielded by old tires, wooden pallets and an earthen wall studded with broken glass had been littered with “odorous trash.”

The 11 children found living at the encampment — described as a small trailer embedded in the ground — had been without clean water and appeared to have not eaten in days, according to Taos County Sheriff Jerry Hogrefe.

At a news conference in Taos, Hogrefe described FBI surveillance efforts in recent months that included photographs of the compound and interviews. He said the images were shared with the mother of Abdul-ghani but she did not spot her son, and that the photographs never indicated the boy’s father was at the compound.

“I had no probable cause to get a search warrant to go onto this property,” the sheriff said.

He said FBI officials were invited to the news conference but declined to attend. An FBI spokesman did not immediately return a call seeking comment.

Hogrefe said the “breaking point” in seeking a search warrant came when Georgia authorities received a message that may have originated within the compound that children were starving inside.

It was not clear who sent the message or how it was communicated. Georgia detectives forwarded it to the Taos County Sheriff’s Office.

Authorities returned to search the compound after interviews on Friday and Saturday led them to believe the boy might still be on the property.

“We discovered the remains yesterday on Abdul’s fourth birthday,” Hogrefe said, appearing to fight back tears.

Aleks Kostich, managing attorney in the Taos County public defender’s office, said the office was gathering information and assigning attorneys to the defendants. He declined to comment on their behalf, saying the case was in its early stages.

However, he questioned the “legal sufficiency” of the criminal complaints filed against the men and women, saying they were vague.

“I’m not sure how much investigating has been done,” he said. “I’m not sure how much law enforcement knows and how long they’ve known it for.”

___

AP writers Kate Brumback in Jonesboro, Georgia, contributed to this report. Hudetz reported from Albuquerque.

MisInformationCom and Election Security

Posted on August 6, 2018August 6, 2018 by Denise Simon

Election security top priority for U.S.: DHS chief - newsR ...

So, Dana Perino of Fox News/Daily Briefing had Mary Anne Marsh on the show today to discuss voting security. Mary Ann went on and on about how the Trump administration is not doing enough to ensure foreign interference/election meddling is prevented in the 2018 mid-terms and all the way to the general election in 2020.

Meanwhile, Who Oversees the Election Process in the U.S.?

Clearly Mary Ann has not been a part of the countless sessions that DHS has hosted for the benefit of each state to protect and harden their respective systems. Frankly, I have participated in 2 conference calls and have watched congressional hearings as well as read documents provided as to the activities on behalf of DHS and the FBI.

Then while few people know, the Justice Department produced a lengthy document by the titled ‘The Cyber Digital Task Force that speaks to all foreign intrusion operations including the matter of the election infrastructure. Pass this on to Mary Ann please. Just one of hundreds of paragraphs is below:

Covert influence operations, including disinformation operations, to influence

public opinion and sow division.

Using false U.S. personas, adversaries could covertly create and operate social media pages and other forums designed to attract U.S. audiences and spread disinformation or divisive messages. This could happen in isolation or in combination with other operations, and could be intended to foster specific narratives that advance foreign political objectives, or could be intended simply to turn citizens against each other. These messages need not relate directly to political campaigns. They could seek to depress voter turnout among particular groups, encourage third-party voting, or convince the public of widespread voter fraud to undermine confidence in election results. These messages could target discrete U.S. populations based on their political

and demographic characteristics. They may mobilize Americans to sign online petitions

and join issue-related rallies and protests, or even to incite violence. For example, advertisements from at least 2015 to 2017 linked to a Russian organization called the Internet Research Agency focused on divisive issues, including illegal immigration and gun rights, among others, and targeted those messages to groups most likely to react.

Meanwhile, there is an external organization made up of subject matter experts collecting evidence and stories of which the Deputy Assistant Attorney General Adam S. Hickey for the National Security Division Delivered Remarks at Misinfo Con.

Thank you for the invitation to speak today, and for the important work you are doing: in organizing this conference devoted to the challenges of misinformation, and, by attending, bringing your experience and expertise to bear on the problem.

It’s a privilege to help kick off this first day of MisinfoCon, focused on state-sponsored misinformation. To do that, I am going to give you an overview of how the Department of Justice views the problem, where it fits in the context of related national security threats, and how we are addressing it.

As you probably know, the Justice Department recently obtained an indictment of 13 Russian individuals and three entities, including the Internet Research Agency (or IRA), for federal crimes in connection with an effort to interfere in the 2016 Presidential election. The defendants allegedly conducted what they called “information warfare against the United States,” with the stated goal of “spread[ing] distrust towards the candidates and the political system in general.”

According to the indictment, the IRA was a structured organization headed by a management group and arranged in departments. It had a “translator project,” designed to focus on the U.S. population, with more than 80 employees assigned by July 2016. They posed as politically and socially active Americans, advocating for and against particular political candidates. They established social media pages and groups to communicate with unwitting Americans. They also purchased political advertisements on social media.

One of the so-called trolls who worked for the IRA recently spoke to the Washington Post about his work in a different department, attempting to influence a domestic, Russian audience. He described it as “a place where you have to write that white is black and black is white.” Hundreds of people “were all writing absolute untruths.”

But as the indictment alleges it, what made the defendants’ conduct illegal in the United States was not the substance of their message, the “accuracy” of their opinions: it was their conspiracy to defraud by, among other ways, lying about who the messenger was. They were not Americans expressing their own viewpoints; they were Russians on the payroll of a foreign company.

Now, the problem of covert foreign influence is not new. In 1938, a congressional committee found that the Nazi government had established an extensive, underground propaganda apparatus inside the United States using American firms and citizens. The response was to recommend a law that would (in the committee’s words) throw these activities under the “spotlight of pitiless publicity.” The result is the Foreign Agents Registration Act (FARA), a disclosure statute that, notably, does not prohibit speech. Rather, FARA requires agents of foreign principals who engage in political activities within the United States to file periodic public disclosures with the Department.

The Act’s purpose is to ensure that the American public and our lawmakers know the source of information provided at the behest of a foreign principal, enhancing the public’s and the government’s ability to evaluate such information.

Transparency, not prohibition, has been the government’s response to misinformation. In the 1980s, the government established an interagency committee, the “Active Measures Working Group,” to counter Soviet disinformation. It did so by exposing forgeries and other propaganda, such as fake stories that the Pentagon developed the AIDS virus as part of a biological weapons research program.

Today, we confront misinformation as only one component of a broader, malign foreign influence effort. As this framework from the Department’s recent Cyber-Digital Task Force report shows, those efforts can also include cyber operations that target election infrastructure or political parties’ networks; covert efforts to assist (or harm) candidates; and overt efforts to influence the American public (for example, through state-run media organizations).

Our responses to those efforts must likewise be multifaceted, from providing indicators and warnings that can help network owners protect themselves from hackers, to criminal investigations and prosecutions, and other measures, like sanctions and expulsions that raise the costs on the states that sponsor such malign activities.

This graphic, also from the Task Force report, depicts the Department’s strategy to counter each phase of a covert influence campaign cycle, from the identification of targets to the production and amplification of content. The middle rows (in red) depict our adversaries’ activities in stages, while the bottom rows (in blue) suggest the means by which private actors and the government can disrupt and deter the activity.

One aspect of this strategy worth highlighting is that the content of a foreign influence campaign may be true or false. Whether the message is accurate or not may not be the point: doxing a candidate or a corporation for political reasons might not involve misinformation, but it may nonetheless violate our laws, threaten our values and way of life, compromise privacy and, sometimes, retaliate against and chill free speech.

Covert foreign influence efforts can take many forms, but recently we have seen increased efforts to influence Americans through social media. To counter these efforts, a key component of our approach is sharing information with social media and other Internet service providers, which we do through the FBI’s Foreign Influence Task Force. It is those providers who bear the primary responsibility for securing their own products and platforms. By sharing information with them, especially about who certain users and account holders actually are, we can assist their own, voluntary initiatives to track foreign influence activity and to enforce their own terms of service.

As the Task Force report also recognizes, there may be circumstances when it is appropriate for the government itself to expose and attribute foreign influence operations as a means of rendering them less effective. But there are often compelling, countervailing considerations, however.

As a general rule, the Department does not confirm, deny, or comment on pending investigations, both to protect the investigation itself as well as the rights of any accused.

We are also constrained to protect the classified sources and methods that may inform our judgment of what foreign governments are doing.

And, most important of all, we must never act to confer any advantage or disadvantage on any political or social group, individual, or organization, and we must strive to avoid even the appearance of partiality. That could constrain the timing and nature of any disclosure we might make.

All of this is to say, and as the Department’s Policy on the Disclosure of Foreign Influence Operations recognizes, we might not be the best messenger to counter a particular piece of misinformation.

That’s why this conference is so important: what we call the private sector (but which includes a lot of people in public spaces, just like you) has a critical role – larger than the federal government’s – in countering covert foreign influence efforts, particularly misinformation, and ensuring that our democracy rests on the active engagement of an informed public.

The former Russian troll I mentioned at the beginning of my remarks, who worked for the IRA, said his work was “pointless” for Russian audiences, that it would not impact them. But in America, that kind of trickery might have an impact, he said, because we “live in a society in which it’s accepted to answer for your words.” My challenge to us during this conference, if I may make one, is that we find ways to ensure we all continue to answer for our words, so that the trust we enjoy as an aspect of our free, democratic society can thrive.

*** Someone help out the democrats and Mary Ann….all discussions inside the Beltway include these multi-track discussions. Back in March, the U.S. spending bill provided $380 million for election cyber security. There was an amendment for an additional $250 million that the Senate Republicans on a floor vote rejected. Why? Because many of the states have either been slow to accept money inside that $380 million or not taken any at all.

U.S. is on the Offensive, Espionage and Cyber

Posted on August 2, 2018August 2, 2018 by Denise Simon

In the last few weeks, there was the Aspen Security Forum, a 3 day event. Then there was a DNI report. Then came 2 separate nationwide conference calls hosted by CERT, the cyber division of DHS.

A remarkable White House press briefing included the heads of intelligence agencies explaining the condition of cyber/espionage and the countermeasures against Russia.

Then there is the military side, a division frankly not well known, the Defense Security Services.

See the whole 2 page release here.

And there is more:

FBI Releases Article on Securing the Internet of Things

The Federal Bureau of Investigation (FBI) has released an article on the risks associated with internet-connected devices, commonly referred to as the Internet of Things (IoT). FBI warns that cyber threat actors can use unsecured IoT devices as proxies to anonymously pursue malicious cyber activities.

As our reliance on IoT becomes an important part of everyday life, being aware of the associated risks is a key part of keeping your information and devices secure. NCCIC encourages users and administrators to review the FBI article for more information and refer to the NCCIC Tip Securing the Internet of Things.

*** IOT?

The internet of things, at its simplest level, is a network of smart devices – from refrigerators that warn you when you’re out of milk to industrial sensors – that are connected to the internet so they can share data, but IoT is far from a simple challenge for IT departments.

Related reading: Five IoT Predictions For 2019

For many companies, it represents a vast influx of new devices, many of which are difficult to secure and manage. It’s comparable to the advent of BYOD, except the new gizmos are potentially more difficult to secure, aren’t all running one of three or four basic operating systems, and there are already more of them.

A lot more, in fact – IDC research says that there are around 13 billion connected devices in use worldwide already, and that that number could expand to 30 billion within the next three years. (There were less than 4 billion smartphone subscriptions active around the world in Ericsson’s most recent Mobility Report.)

With a huge number of companies “doing IoT” – most big-name tech companies, including Google, Microsoft, Apple, Cisco, Intel, and IBM have various types of IoT play – all working to bring as many users as possible into their respective ecosystems, motivation to make sure IoT systems and devices from different companies all work with each other is sometimes lacking.

photo

The problem, of course, is that nobody’s willing to give up on the idea of their own ecosystem becoming a widely accepted standard – think of the benefits to the company whose system wins out! – and so the biggest players in the space focus on their own systems and development of more open technologies lags behind. More here.

Eligible Receiver 97, Red Team Being Applied Today for Cyber Hacks?

Posted on August 2, 2018August 2, 2018 by Denise Simon

An early classified Defense Department cybersecurity exercise named “Eligible Receiver 97” (ER97) featured a previously unpublicized series of mock terror attacks, hostage seizures, and special operations raids that went well beyond pure cyber activities in order to demonstrate the potential scope of threats to U.S. national security posed by attacks in the cyber domain, according to recently declassified documents and a National Security Agency (NSA) video posted today by the nongovernmental National Security Archive at The George Washington University.

“Joint Exercise Eligible Receiver 97”, run during the Clinton presidency, is frequently pointed to as a critical event in the United States’ appreciation of threats in cyber space. The exercise led directly to the formation of what would eventually become United States Cyber Command (USCYBERCOM) and informed key studies such as the formative Marsh Report on critical infrastructure protection. Despite the significance of ER97, however, very little is publicly known about the exercise itself.

ER97 involved an NSA Red Team playing the role of North Korean, Iranian and Cuban hostile forces whose putative aim was to attack critical infrastructure as well as military command-and-control capabilities to pressure the U.S. government into changing its policies toward those states. An interagency Blue Team was required to provide recommendations to personnel enacting defensive responses. Until now, only two phases out of three (infrastructure and command-and-control) had been publicly known. The video and documents posted today provide new details about the third phase involving kinetic attacks in the physical domain – i.e. more traditional terrorist assaults on civilian targets – which were built upon intelligence gathered through the Red Team’s successes. Read more here on the declassified files.

*** With all the cyber terror going on today in the United States, are we doing more ‘red team’ exercises? Perhaps some of those tactics are paying off many years later.

3 Carbanak (FIN7) Hackers Charged With Stealing 15 Million ...

Three Members of Notorious International Cybercrime Group “Fin7” in Custody for Role in Attacking Over 100 U.S. Companies

Victim Companies in 47 U.S. States; Used Front Company ‘Combi Security’ to Recruit Hackers to Criminal Enterprise

SEATTLE – Three high-ranking members of a sophisticated international cybercrime group operating out of Eastern Europe have been arrested and are currently in custody facing charges filed in U.S. District Court in Seattle, announced U.S. Attorney Annette L. Hayes, Assistant Attorney General Brian A. Benczkowski of the Justice Department’s Criminal Division and Special Agent in Charge Jay S. Tabb Jr. of the FBI’s Seattle Field Office.

According to three federal indictments unsealed today, Ukrainian nationals Dmytro Fedorov, 44, Fedir Hladyr, 33, and Andrii Kolpakov, 30, are members of a prolific hacking group widely known as FIN7 (also referred to as the Carbanak Group and the Navigator Group, among other names). Since at least 2015, FIN7 members engaged in a highly sophisticated malware campaign to attack more than 100 U.S. companies, predominantly in the restaurant, gaming, and hospitality industries. As set forth in the indictments, FIN7 hacked into thousands of computer systems and stole millions of customer credit and debit card numbers which were used or sold for profit.

In the United States alone, FIN7 successfully breached the computer networks of businesses in 47 states and the District of Columbia, stealing more than 15 million customer card records from over 6,500 individual point-of-sale terminals at more than 3,600 separate business locations. Additional intrusions occurred abroad, including in the United Kingdom, Australia, and France. Companies that have publicly disclosed hacks attributable to FIN7 include such familiar chains as Chipotle Mexican Grill, Chili’s, Arby’s, Red Robin and Jason’s Deli. Additionally here in Western Washington FIN7 targeted the Emerald Queen Casino (EQC) and other local businesses. The Emerald Queen Casino was able to stop the intrusion and no customer data was stolen.

“Protecting consumers and companies who use the internet to conduct business – both large chains and small ‘mom and pop’ stores — is a top priority for all of us in the Department of Justice,” said U.S. Attorney Annette L. Hayes. “Cyber criminals who believe that they can hide in faraway countries and operate from behind keyboards without getting caught are just plain wrong. We will continue our longstanding work with partners around the world to ensure cyber criminals are identified and held to account for the harm that they do – both to our pocketbooks and our ability to rely on the cyber networks we use.”

“The three Ukrainian nationals indicted today allegedly were part of a prolific hacking group that targeted American companies and citizens by stealing valuable consumer data, including personal credit card information, that they then sold on the Darknet,” said Assistant Attorney General Benczkowski. “Because hackers are committed to finding new ways to harm the American public and our economy, the Department of Justice remains steadfast in its commitment to working with our law enforcement partners to identify, interdict, and prosecute those responsible for these threats.”

“The naming of these FIN7 leaders marks a major step towards dismantling this sophisticated criminal enterprise,” said Special Agent in Charge Jay S. Tabb Jr., of the FBI’s Seattle Field Office. “As the lead federal agency for cyber-attack investigations, the FBI will continue to work with its law enforcement partners worldwide to pursue the members of this devious group, and hold them accountable for stealing from American businesses and individuals.”

Each of the three FIN7 conspirators is charged with 26 felony counts alleging conspiracy, wire fraud, computer hacking, access device fraud, and aggravated identity theft.

In January 2018, at the request of U.S. officials, foreign authorities separately arrested Ukrainian Fedir Hladyr and a second FIN7 member, Dmytro Fedorov. Hladyr was arrested in Dresden, Germany, and is currently detained in Seattle pending trial. Hladyr allegedly served as FIN7’s systems administrator who, among other things, maintained servers and communication channels used by the organization and held a managerial role by delegating tasks and by providing instruction to other members of the scheme. Hladyr’s trial is currently scheduled for October 22, 2018.

Fedorov, a high-level hacker and manager who allegedly supervised other hackers tasked with breaching the security of victims’ computer systems, was arrested in Bielsko-Biala, Poland. Fedorov remains detained in Poland pending his extradition to the United States.

In late June 2018, foreign authorities arrested a third FIN7 member, Ukrainian Andrii Kolpakov in Lepe, Spain. Kolpakov, also is alleged to be a supervisor of a group of hackers, remains detained in Spain pending the United States’ request for extradition.

According to the indictments, FIN7, through its dozens of members, launched numerous waves of malicious cyberattacks on numerous businesses operating in the United States and abroad. FIN7 carefully crafted email messages that would appear legitimate to a business’ employee, and accompanied emails with telephone calls intended to further legitimize the email. Once an attached file was opened and activated, FIN7 would use an adapted version of the notorious Carbanak malware in addition to an arsenal of other tools to ultimately access and steal payment card data for the business’ customers. Since 2015, many of the stolen payment card numbers have been offered for sale through online underground marketplaces. (Supplemental document “How FIN7 Attacked and Stole Data” explains the scheme in greater detail.)

FIN7 used a front company, Combi Security, purportedly headquartered in Russia and Israel, to provide a guise of legitimacy and to recruit hackers to join the criminal enterprise. Combi Security’s website indicated that it provided a number of security services such as penetration testing. Ironically, the sham company’s website listed multiple U.S. victims among its purported clients.

The charges in the indictments are merely allegations, and the defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

The indictments are the result of an investigation conducted by the Seattle Cyber Task Force of the FBI and the U.S. Attorney’s Office for the Western District of Washington, with the assistance of the Justice Department’s Computer Crime and Intellectual Property Section and Office of International Affairs, the National Cyber-Forensics and Training Alliance, numerous computer security firms and financial institutions, FBI offices across the nation and globe, as well as numerous international agencies. Arrests overseas were executed in Poland by the “Shadow Hunters” from CBŚP (Polish Central Bureau of Investigation); in Germany by LKA Sachsen – Dezernat 33, (German State Criminal Police Office) and the Polizeidirektion Dresden (Dresden Police); and in Spain by the Grupo de Seguridad Logica within the Unidad de Investigación Technologica of the Cuerpo Nacional de Policía (Spanish National Police).

This case is being prosecuted by Assistant U.S. Attorneys Francis Franze-Nakamura and Steven Masada of the Western District of Washington, and Trial Attorney Anthony Teelucksingh of the Justice Department’s Computer Crime and Intellectual Property Section.

how_fin7_attacked_and_stole_data.pdf