Cybercrime Exposed

Andrei Tarasov has an intricate tattoo on his back of a circuitboard. The tattoo is appropriate because technology has played a big part in what he does for a living: cybercrime. Tarasov creates tools others use to steal money and data online. While doing e-crime, Tarasov skimmed across borders, out of his native Russia, a country he extensively criticized, including the country’s war against Ukraine, where Tarasov had friends. This criticism comes back to haunt him when authorities catch up to him, and he’s forced to make difficult choices to keep his freedom.

Participants:
Ashley Jess, Senior Intelligence Analyst, Intel 471
Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471

DukeEugene is a Russian hacker, heavily tattooed with a large swastika on his chest. He specializes in developing malicious software for Android phones. The malware is aimed at stealing credentials and data in order to drain its victims’ bank accounts. Despite developing malware, DukeEugene isn’t a very great coder, but he’s well-known and has many connections in the cybercriminal underground – developers, crypters, hosting providers. His business is successful, but he has a big problem. He finds a possible way to solve it but he has to put everything he’s worked for on the line.

Participants:
Simon Williams, Senior Director, Government & Law Enforcement Liaison, Intel 471
Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471

Information stealing malware is one of the most common ways that organizations end up infiltrated by malicious hackers. For several years, one type of infostealer called Raccoon Stealer ruled them all. If a computer was infected with Raccoon Stealer, all data – ranging from login credentials, payment card data, cryptocurrency accounts, session tokens – are vacuumed up from the machine and sent off to the hackers. Raccoon Stealer was dead easy to use and didn’t require coding knowledge. This meant that anyone could start stealing data from other people’s computers. It also had great customer service. But the elusive operator of Raccoon made critical mistakes – including a revealing photograph on Instagram – that jeopardized his business and himself.

 

Participants:

Quentin Bourge, Lead Cybercrime Analyst, Threat Detection
& Research Team, Sekoia.io

Jeremy Kirk, Executive Editor, Cyber Threat Intelligence,
Intel 471

In 2006, a new type of malware appeared on the scene. Its name was Zeus. It was enormously profitable for its cybercriminal developers, who used it to steal tens of millions of dollars from businesses and organizations of all sizes. Those behind the scheme had honed a new model: cybercrime-as-as-service, where individuals focus on their specialities – creating malware, employing money mules, acting as system administrators. Zeus frustrated victims and left some in ruins. It defeated security processes in financial systems. And it led law enforcement along trails that that went from small businesses in America to Eastern Ukraine and Russia. Sometimes, the trails ran cold. But eventually, one threat actor’s luck ran out.

Participants:

Jason Passwaters, CEO and Co-Founder, Intel 471

Jim Craig, Senior Director, Intelligence Collection Management, Intel 471

Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471

The online game Axie Infinity is colorful and eye catching. It resembles Pokemon and is filled with cute digital creatures. To play the game, players use virtual currency to buy and sell these creatures and can earn it by battling each other. In 2021, the company behind Axie Infinity was worth $3 billion and backed by Silicon Valley dollars. But this virtual world and the enormous amount of virtual money in this world came into the sights of an adversary. In a matter of minutes in March 2022, Axie Infinity saw nearly $600 million worth of virtual currency stolen from its wallets. The hackers weren’t just cybercriminals. They were nation-state hackers from North Korea. But investigators were hot on their heels.

Participants:

Erin Plante, Vice President, Investigations, Chainalysis

Jeremy Kirk, Executive Editor, Cyber Threat Intelligence,
Intel 471