Showing posts with label Romania. Show all posts
Showing posts with label Romania. Show all posts

Tuesday, October 15, 2019

18 Members of ATM Skimmer Gang Arrested -- Mostly Romanian

DOJ Press Release: 18 Members of International Fraud and Money Laundering Conspiracy
The Southern District of New York brought charges on 18 people for their involvement in an ATM Skimming ring that planted hundreds of skimming devices in at least 17 states and stole more than $20 Million dollars.  Those charged, from the DOJ Press Release about the ATM Skimming organization, are listed below.  The operation involved many cooperating agencies, including the FBI, Customs and Border Protection, the NYPD, the US Postal Inspection Service, INTERPOL-Rome, INTERPOL-Mexico City, and Mexico's Agencia de Investigación Criminal and Instituto Nacional de Migración.

What the press release does NOT make clear is the ties to Intercash, the largest Romanian ATM Skimming ring in history, and the primary reason that when you see "Skimming arrests" in the United States, they will almost always involve Romanians.

LIMBERATOS, COSTEA, LYMBERATOS, ELIOPOULOS, SAMOLIS, LAM, and MIHAILESCU were arrested in and around Manhattan on October 10, 2019.

M. CONSTANTINESCU, CALUGARU, I. CONSTANTINESCU, and SERBAN were arrested in Miami on October 10, 2019.

MARTIN (Pictured here as "Florian M") was arrested in Cabo San Lucas, Mexico.  Although he was the only one charged in the SDNY case, he was actually arrested as the leader of a group of 7 Romanians all arrested together in Mexico.  In Romanian news, he is described as "the brother of Rechinu".  Rechinu, which means "shark" in Romanian, is believed by the Romanians to be the big boss of an international skimmer ring, named Florian Tudor.  Brian Krebs, the world's leading investigative  security journalist, shared many more details about Rechinu's gang in April 2019, in a follow-up to his three part series about Instacash - a Romanian crime syndicate that dominates the skimming world. That KrebsOnSecurity story, "Alleged Chief of Romanian ATM Skimming Gang Arrested in Mexico" includes many details learned by interviewing the brother of a bodyguard that was assassinated by Tudor.

Romanian press says that Rechinu was also a human smuggler, helping "hundreds of Romanians" migrate to Mexico using counterfeit documents and then cross the border into the United States to participate in criminal activity.  Not only did Rechinu run an enormous international crime ring, but through shell companies, he was the owner of a company in Mexico that installed and maintained ATM machines for banks in Mexico!  Using the knowledge and access his employees gained by having "legitimate" access to such equipment, it is no wonder that InterCash dominated the skimming market!

Tudor Florian has managed his network, most of the time, in Mexico, under the screen of some companies that set up ATMs and ensure their maintenance! On the legally installed ATMs, skimming devices were mounted, which copied the cards of the people who were making money. 

"After fraudulently obtaining the computer data, teams were made up of other members of the group who traveled to other states such as USA, India, Paraguay, Indonesia, etc., from which they withdrew the existing amounts of money in the bank accounts related to electronic payment instruments. copied ”, claims DIICOT.  -- Translated from the Libertatea.ro story "DIICOT Release: The Shark Clan in Craiova had companies that legally set up ATMs in Mexico, where they later cloned the cards!"

(Libertatea - "Freedom!" - ran a month-long series of investigative reports about this crime family that they dub "the Shark Clan", including their long involvement with another Romanian crime family that sold them underage girls for sex trafficking)



VIDRASAN was arrested in Perugia, Italy.

PETRESCU, DIACONU, ANCA, and ULMANU were already in custody on other charges and will be later transferred to New York.

The charges were brought in three separate indictments.  Mircea CONSTANTINESCU, Nikolaos LIMBERATOS, Cristian COSTEA, Alin Hanes CALUGARU, Ionela CONSTANTINESCU, Theofrastos LYMBERATOS, Andrew ELIOPOULOS, Valentin PETRESCU, Peter SAMOLIS, Kelly Karki LAM, George SERBAN, Dragos DIACONU, Madlin Alexandru ANCA, Cristian ULMANU, and Iuliana MIHAILESCU were charged in the first indictment with:

  • 18 USC Sections 1029(a)(1), (a)(2), (a)(3), (a)(4), and (a)(5) - access device fraud 
  • 18 USC Section 1029(a)(1) producing and trafficking in counterfeit access devices
  • 18 USC Section 1029(a)(2) using a counterfeit access device to obtain a thing of value
  • 18 USC Section 1029(a)(3) aggravated identity theft (possessing with intent to obtain a thing of value more than 15 counterfeit access devices
  • 18 USC Section 1029(a)(4) producing, trafficking in, having custody and control of and possessing counterfeit access device-making equipment
  • 18 USC Section 1029(a)(5) conducting transactions with access devices issued to another person to receive payment exceeding $1,000 in a single year.  (Yep, $20M > $1,000)
  • 18 USC Section 1343  Bank Fraud , Wire Fraud, 
  • 18 USC Section 1349  obtaining money from FDIC insured institutions by means of false and fraudulent pretenses 
  • 18 USC Sections 1028(a)(1), (b), and 2.
  • 18 USC 1956(a)(1)(A)(i) conspiracy to commit wire fraud and bank fraud 
  • 18 USC  1956(a)(1)(B)(i)  conspiracy to commit access device fraud 
  • 18 USC  1957(a) conspiracy to commit wire fraud 
CONSTANTINESCU shipped a credit card point of sale terminal from Mt. Pocono, Pennsylvania to Veracruz, Mexico for the purpose of having a custom skimmer created for the terminal. SERBAN shipped skimmers from Miami to Tobyhanna, Pennsylvania.

Others installed skimmers in at least Babylon, NY (N. LIMBERATOS); Canterbury, CT (CALUGARU); Manchester, NH (T. LYMBERATOS); Glen Cover, Westbury, and Whitestone (ELIOPOULOS), NY; Boston, MA (PETRESCU); Queens, NY (SAMOLIS); Somerville, MA (ULMANU); Boston, Brookline, Sturbridge, Brighton, and Natick, MA (MIHAILESCU).

Others used cards to withdraw funds using counterfeit ATM cards coded with the magnetic stripes stolen by the gang's skimmers in at least New York City, NY (CONSTANTINESCU), Chattanooga and Ooltewah, TN (DIACONU,  ANCA); 

Others arranged the cash deposits and withdrawals to launder the funds (LAM)

A second indictment separately charges Raul Ionut VIDRASAN with many of the same charges.

A third indictment separately charges Florian Claudia MARTIN (and his host of aliases) and Alex DONATI. Specifically MARTIN is charged with installing a skimming device on an ATM in a hotel in Manhattan.  DONATI is charged with shipping a package containing two skimmers to Manhattan. 


Defendant
Age
Place of Residence
Nationality
FLORIAN CLAUDIU MARTIN,
a/k/a “Florin Claudiu,”
a/k/a “Johnny Ion,”
a/k/a “Jane Hotul,”
a/k/a “Petru Andrioaie,”
a/k/a “Petru Andrioane,”
44
Cabo San Lucas, Mexico
Romania
ALEX DONATI
51
Cabo San Lucas, Mexico
Romania
RAUL IONUT VIDRASAN,
a/k/a “Michu,” a/k/a “The Boy”
27
Perugia, Italy
Romania
MIRCEA CONSTANTINESCU, a/k/a “Sobo”
44
Cooper City, Florida
Romania
NIKOLAOS LIMBERATOS, a/k/a “Nicu Limberto”
53
Deer Park, New York
Greece
CRISTIAN COSTEA, a/k/a “Momo”
44
Queens, New York
Romania
ALIN HANES CALUGARU
39
Sunny Isles, Florida
Romania
IONELA CONSTANTINESCU, a/k/a “Pitica”
35
Cooper City, Florida
Romania
THEOFRASTOS LYMBERATOS
36
Queens, New York
United States
ANDREW ELIOPOULOS
34
Queens, New York
United States
VALENTIN PETRESCU, a/k/a “Gico Cosmin Giscan,” a/k/a “Zoltan Pruma”
32
Russellville, Arkansas
Romania
PETER SAMOLIS
30
Queens, New York
United States
KELLY KARKI LAM
42
New York, New York
United States
GEORGE SERBAN
32
Miami, Florida
Romania
DRAGOS DIACONU
41
Nashville, Tennessee
Romania
MADLIN ALEXANDRU ANCA, a/k/a “Mateo Fernandez Alejandro”
22
Nashville, Tennessee
Romania
CRISTIAN ULMANU, a/k/a “Boris Moravec”
54
Russellville, Arkansas
Romania
IULIANA MIHAILESCU
42
Queens, New York
Romania


Sunday, January 20, 2019

Romanians on a Skimming Crime Spree?

When I posted last month about a Romanian skimming case (see: "Alert Traffic Patrolman Unveils Romanian Skimming Ring") I got two strong reactions.  One was from my Romanian Information Security friends who wanted to remind me that not all Romanians are criminals -- of course not! There are great researchers from Romania!  But the other was email after email telling me about other cases where the people being caught planting skimmers or using the cards stolen by them were also from Romania.

As we looked into this accusation more, it seems to be quite true that Romanians traveling to the United States for the purpose of planting skimmers and cashing out cloned cards seems to be in the news almost every week.

January 5, 2019 - San Luis Obispo, California - has a very nice video in the article  "These foreigners ran a credit card skimmer ring in the Tri-Cities" - in this case four Romanians were arrested with 268 gift cards, each with a separate skimmed mag stripe and PIN already burned onto them.  Emil Kabirov (21), Denis Legun (24), Ana Onici (22) and George Vasile (35) were arrested as they were seen at a Numerica Credit Union using cloned cards to withdraw funds.

Eric Vitale, fraud investigations specialist for San Luis Obispo PD, explains the scam
December 20, 2018 - Nashville, Tennessee - 159 gift cards with cloned stripe data recovered. In a jailhouse interview their American driver says they stole as much as $500,000.  George Zica and Madalin Palanga of Romania were arrested with him.

American Forrest Beard tells about his time with Romanian skimmers  in this WKRN exclusive
November 27, 2018 - Atlanta, Georgia - Romanian Gogut Serban (35) was sentenced for skimming and stealing at least $80,000 from at least 70 credit union customers in Atlanta, Lawrenceville, Norcross, and other locations in Georgia.  He'll serve 26 months in Federal prison.

November 8, 2018 - Nixa, Missouri - Romanian woman Lordeana Baceanu is facing a 49-count felony for planting at least 15 skimming devices and making a large number of withdrawals, including from Southern Bank.  When arrested, she had 49 Visa and American Express gift cards with her that had been re-encoded with the magnetic data from skimmed cards.  She was previously arrested in 2012 as part of a five women three men team who traveled through Wales and the UK, committing at least 30 burglaries in five months.

November 2, 2018 - Springfield, Oregon - two Romanian teens were arrested, aged 15 and 17,  for planting skimmers on ATMs belonging to Northwest Community Credit Union.

October 31, 2018 - Boston, Massachusetts - 3 Romanian men plead guilty in federal court related to their ATM skimming operations.  Nicusor Bonculescu (24), Suedin Chiciu (28), and Florinel Vaduv (22) were actually indicted along with 12 others in 2017.

October 27, 2018 - Houston, Texas - 2 Romanian men have pleaded guilty to traveling to Houston to place card skimmers on ATMs and stealing money from bank accounts.  Crisian Viorel Ciobanu (30) and Bogdan Mirel Constantin (40) were arrested with Daniel Marius Muraretu.  The three used fake cards and stolen PINs to steal at least $390,495.

A nearly undetectable credit card skimming device was discovered at an ATM in Alameda. Photo: Alameda Police
A skimmer on an ATM in Alameda, Texas - Source: https://www.facebook.com/AlamedaPD/posts/1761406967269034
October 9, 2018 - South Strabane - "Elvis Roman", (probably an alias), a 33 year old native of Romania, conducted 255 unauthorized withdrawals from Washington Financial Bank using cards that were cloned after being captured with an ATM skimmer.  After bank surveillance pulled his license plate number, he was pulled over by traffic police and arrested.

"Elvis Roman"

September 11, 2018 - Springfield, Massachusetts - Romanian Bogdan Viorel Rusu (38) living in Queens, New York, plead guilty to stealing $868,000 via cloned ATM cards from at least 530 individuals in three states via skimmers.  $364,419 stolen from Massachusetts, $75,715 from New York, and $428,581 from New Jersey residents.

August 22, 2018 - Louisiana - Alexandru-Nicusor Nita (27), Daniela-Stefani Ianev (31), both of Romania, planted skimmers around Baton Rouge, Louisiana at Neighbors Federal Credit Union ATMs.  Nita was arrested by the US Secret Service in a Memphis hotel room along with 5 other Romanians who were charged with possession of marijuana and manufacturing fake ids. He was sentenced in December 2018 to 24 months imprisonment and restitution of $149,802.44.



August 15, 2018 - Richmond, Virginia - 50 year old Antal Kancsal pleads guilty to stealing $1.2 Million via ATM skimming. He worked as the partner of Brazilian Roberto De Miranda-Martinez (43).  He entered the US on a tourist Visa which expired in March and never went home.  The pair planted skimmers in Virginia, Pennsylvania, Maryland, and elsewhere.

July 17, 2018 - Friendswood, Texas - 18 year old Romanian national Fabrizio Victor Slatineo was arrested after bank employees alerted the police to a vehicle associated with a series of suspicious ATM transactions.  Traveling with Fabricio was an eleven-year old girl who had $60,000 cash and dozens of blank debit cards that had skimmed stripes burned onto them hidden in her floor-length skirt.

<p>Recently, three Romanian men were sentenced to prison for using credit card skimmers to steal victims' personal information.</p>
A skimmer on a Texas Credit Union ATM - Source: LMTOnline.com
Jun 12, 2018 - Fond du Lac, Wisconsin - 26 year old Mihai-Alexandru Preda and 35 year old Catalin-Adrian Capanu were caught at a Marine Credit Union with 137 cloned debit cards and $7500 in cash.  The pair had been driving from California to Wisconsin, conducting crimes all along the way. See "Romanian nationals arrested in Fond du Lac for skimming, cash outs, organized crime ring"

Police release photos, info on skimming scam
Romanian suspect glues a PIN camera on a Kenosha, Wisconsin Educators Credit Union ATM 
Jun 6, 2018 - Richmond, Virginia - Romanians Florin Bersanu (31) and Viorel Naboiu (43) were charged with placing skimmers on ATMs in Virginia, West Virginia, and Florida.  Directly attributable losses are $42,756.80 stolen from BB&T Bank, Henrico Federal Credit Union, United Bank of West Virginia, and Pen Air and Eglin Federal Credit Unions in Florida.

Bersanu and Naboiu: Okaloosa County Sheriff's photo


May 14, 2018 - Boston, Massachusetts - The ring-leader of the gang, Constantin Denis Hornea (23) was sentenced to 65 months in prison and $242,141 restitution for ATM-skimming and racketeering.  The Hornea Crew did ATM-related crimes in at least seven states: Massachusetts, New Hampshire, Connecticut, New York, South Carolina, North Carolina, and Georgia.  At least 17 members of the Hornea Crew are now indicted, though some are still awaiting extradition from Germany and Hungary.  Their skimmers were found in Amherst, Bellingham, Billerica, Braintree, Chicopee, Quincy, Southwick, Waltham, Weymouth, and Whately, Mass.; Enfield, Conn.; Columbia, Greenville, Greenwood, Mauldin, and Saluda, S.C.; Savannah, Ga.; and Yadkinville, N.C.  They made ATM withdrawals in at least 44 different towns, 29 of them in Massachusetts.

Hornea crew with many aliases - often linked to their Facebook accounts


members of the Hornea crew used a "Fast and the Furious" frame on their Facebook profile pictures 

Denis Hornea's Porsche (from his Facebook page)

Ion Văduva - proud to be a gangster
May 11, 2018 - Henrico County, Virginia - Romanians Florin Bersanu and Viorel Naboiu were arrested for defrauding a huge number of accounts that they accessed after cloning ATM cards via skimming.  Their victims included 226 Pen Air Credit Union customers, 235 accounts in West Virginia, and 190 accounts from BB&T banks in Virginia.  The skimmers planted by the pair use Bluetooth technology to transmit the stolen card stripes.  


April 13, 2018 - North Carolina - Valeri Gornet sentenced to 48 months for ATM Skimming in Troy, North Carolina. He entered the US on an H1B non-immigrant visa and was supposed to leave October 10, 2016.  He originally told the police he was Geani Vales from Lithuania when he was caught installing a skimmer at a North Carolina State Credit Union ATM.  

Feb 21, 2018 - Pittsburgh, PA -  Nicu Sorin Pantelica (28) was indicted after being caught with a mag stripe writer (MSR606) and an Acer laptop and $6100 in cash.  Nicu was arrested while "loitering suspiciously" in a van near an ATM in South Strabane township Pennsvylvania. As in some of the other cases we looked into, he was traveling with an underaged female who claimed to be his sister who was concealing more than 40 Vanilla Visa cards, many bearing stickers with four digit numbers on them, believed to be the PINs for the cards.




Sunday, December 23, 2018

Alert Traffic Patrolman Unveils Romanian Skimming Ring



Clinton, Mississippi doesn't sound like the kind of place where an international skimming operation would be operating.  With a population of barely 25,000, the town in southwest Mississippi does have one thing that helped - an alert police dispatcher.

Cheatham County, Tennessee, on the west side of Nashville, also doesn't seem like a cyber crime Metropolis.  But they also had something critical to this type of police work.  An alert traffic cop, Cheatham County Deputy Paul Ivy.


Clinton is more than a six hour drive from where a Cheatham County Sheriff's deputy pulled over a suspicious vehicle on December 12th as they were about to pull on to Interstate 40 headed west.  The deputy had seen the 2005 Chevy Trailblazer parked at a Shell gas station and noticed a temporary license tag displayed in an unreadable manner behind a tinted windshield.   The driver, Forrest Beard, showed the officer a Mississippi drivers license which came back as suspended.  Beard's story of the two other occupants of the car, "Mike" who had met at a party four months ago, and another man who he had only known for a couple weeks seemed odd.  He consented to a vehicle search, which revealed "a large amount of money", a credit card terminal, two laptops, credit card skimmers, and a stack of 159 Walmart gift cards.  Most of the materials were hidden in Nike shoe boxes.

Vehicle search items discovered
Labels added to the photo by Security Researcher Silas Cutler

The other two men in the car had unusual forms of identification for Kingston Springs, Tennessee.  George Zica was from Romania, according to his passport.

George Zica (Cheatham County Sheriff's Office)
Madalin Palanga (Cheatham County Sheriff's Office)
Madalin "Mike" Palanga was also from Romania, but the id he was carrying was a counterfeit Czech Republic identity card in the name of Vaclav Kubisov.



The officer contacted the Secret Service, and they ended up keeping the vehicle, the money, the computers, and all three men's cell phones.  On Wednesday, December 19th, a judge posted a bail order for the men, and Madalin bonded out for $74,999, although he is wearing a GPS-tracking ankle bracelet, before a hold order was received from Mississippi, preventing the other two men from doing the same.

Further investigation revealed that the men had been tied to skimming cases across middle Tennessee, but also in North Carolina and South Carolina, but Mississippi added one critical piece of evidence, courtesy of ATM footage from Regions Bank.  On Tuesday, Regions Bank employees contacted the Clinton, Mississippi police to let them know they had "trapped" some cards in the local Regions ATM.  When Regions receives fraud reports indicating one of their accounts has been compromised, their policy is to capture any ATM card put into one of their ATMs that uses that account information.

In this case, the captured cards were both Walmart gift cards.  In this case, the Skimmers were "Verifone" terminal overlays, commonly found in many gas stations and convenience stores at the counter.  After criminals modify the keypad by installing a skimmer, a device placed in front of the card slot makes a copy of the magnetic stripe, while the fake keypad overlay captures the PIN number when the customer puts in their four digit code.  The information can be retrieved wirelessly from a vehicle in the parking lot.



(Video from Andy Cordan, WKRN TV News)

In Clinton, Mississippi, over $13,000 in fraudulent ATM charges had been reported recently, with most of the stolen card data being tracked to customers in the Memphis, Tennessee area.

Regions Bank provided ATM Surveillance camera footage to the Clinton police.  An alert police dispatcher who was reviewing the material started comparing the image to other recent credit card crimes in the South East and determined that the man in the ATM footage was George Zica, who was arrested later that week in Tennessee as described above.  (The timestamp on the video is confusing.)



Saturday, January 25, 2014

Unprecedented International Cybercrime Cooperation Nabs Email Hackers

Email Hacking in China, India, Romania

Yesterday we tweeted asking for more information on a statement we found in India's press regarding an email hacker charged in Pune. The article I sited, Pune techie held after FBI alert on hacking racket, reported:
The CBI on Friday arrested a 32-year-old techie from Pune after a tip-off from the Federal Bureau of Investigation (FBI) about a racket involving hacking of 900 e-mail accounts belonging to people from across the world, including Americans and Indians. [...] Following the FBI tip-off, the CBI carried out raids in Ghaziabad, Mumbai and Pune during which several professional hackers were rounded up. Tiwari was arrested and taken on transit remand to Delhi by the CBI team. His computers and other gadgets were seized. According to the CBI, the e-mail accounts of 171 Indians and more than 700 foreign nationals, including Americans, had been hacked. [...] The agency said the raids were part of a coordinated action involving the agencies of China, Romania, the US and India. This was the first time the CBI had tied up with international investigation agencies to launch an operation against cyber crime in India.
We were so pleased to learn of the CBI's Cooperation with the FBI on it's first Cybercrime coordinated effort, but were left puzzling over the statement about coordinated raids in India, Romania, China, and the US.

The confusion was over the fact that the FBI had decided to not unseal the cases in the US related to these crimes until they received confirmation from their peers in India, Romania, and China that the others involved in the case had been successfully arrested. Once that was concluded, we were able to find the original announcement, January 24, 2014, from the US Attorney's Office in the Central District of California, International Law Enforcement Efforts Result in Charges Around the World Against Operators and Customers of E-Mail Hacking Websites.

  • Mark Anthony Townsend, 45, of Cedarville Arkansas and
  • Joshua Alan Tabor, 29, of Prairie Grove Arkansas were charged with a felony violation for running "needpassword.com". Customers of their service would provide an email account and make payment via PayPal once the email password was obtained. More than 6,000 email accounts were hacked during this scheme.
    Three additional US persons were charged, but these were charged with the lesser misdemeanor charges related to hiring a hacker (as opposed to the two above, who did the hacking themselves):
  • John Ross Jesensky, 30, of Northridge, California, paid $21,675 to a Chinese website to obtain email account passwords.
  • Laith Nona, 31, of Troy, Michigan, paid $1,081 to obtain email account passwords.
  • Arthur Drake, 55, of Bronx, New York, paid $1,011 to get email account passwords.

The Romanian DCCO (Direcţiei de Combatere a Criminalităţii Organizate or Directorate for Combating Organized Crime) part of the DIICOT, searched the residences and arrested four individuals associated with the hacker for hire websites:

  • zhackgroup.com
  • spyhackgroup.com
  • rajahackers.com
  • clickhack.com
  • ghostgroup.org (since at least September 2006!)
  • e-mail-hackers.com






Romanian Email hacker, Guccifer

The Romanians report that these individuals broke into at least 1600 email accounts between February 2011 and October 2012.

Based so far only on the coincidence of timing, this blogger believes that this was the notorious "Guccifer" or Marcel Lazar Lehel, who was previously charged with a suspended sentence of three years (February 8, 2012) for hacking into email accounts belonging to SRI director George Maior, former US state secretary Colin Powell, members of Bush and Rockefeller families and officials of the Obama administration. See for example the January 22, 2014 story in Romania's Nine O'Clock news, "Hacker 'Gucifer' caught in Arad" -- www.nineoclock.ro/hacker-“guccifer”-caught-in-arad/. In another story from digi24.ro (via Google Translation) it says:

[In addition to] SRI boss George Major, George Bush, and Colin Powell, Other victims of 'Guccifer' were actor Steve Martin, John Dean, former advisor to President Richard Nixon, actress Mariel Hemingway, three members of the House of Lords in the UK, Laura Manning Johnson, a former CIA analyst, George Roche was Secretary of the Air Force, and President MetLife (insurance company).
. In the earlier charges that resulted in the suspended sentence, Guccifer was charged with accessing and making public photos from the Facebook pages and email accounts of many public officials in Romania as well.


Indian Email hacker, Amit Tiwari

The Central Bureau of Investigation in India arrested Amit Tiwari (who had previously been arrested for Credit Card Fraud) for operating the websites www.hirehacker.net and www.anonymiti.com, who hacked at least 935 e-mail accounts between February 2011 and February 2013.

HireHacker's homepage
HireHacker.net was a prolific advertiser of their services since 2007, creating many "blogs" (such as freelancehackers.wordpress.com) and posting questions on places like Yahoo Answers like "Can the Famous Internet Detectives at HireHacker.net really recover my cheating spouses email password?"


Chinese Email hacker, Ying Liu

The Ministry of Public Safety in China arrested Ying Liu (劉颖), AKA Brent Liu, for operating the website HireToHack.net. Liu was shown to have broken into at least 300 email accounts between January 2012 and March 2013.

Liu's website had it's fifteen minutes of fame when it was featured in NYMag's story Hiring Hackers is Super Cheap. In that story from January 2012, two Kuwaiti brothers, Bassam Alghanim being the billionaire of the two, hired some Chinese hackers "for the price of a really good dinner" to break into his brother's email account. That story indicated that the hackers earned $200,000 in thirteen months by breaking into accounts. The story was also covered in the Wall Street Journal (which also has a video from Cassell Bryan-Low about the case), where the actual hacking may have been via Invisible Hacking Group instead.

Ying Liu hosted his website, hiretohack.net, on the notorious Malaysian hosting platform, Piradius.net. Here are some screen shots of HireToHack.net that show how their system worked:

Homepage
Menu of Services
Order Placement
This is such an amazing demonstration of international cooperation! I know I already said so, but for India's CBI, China's MPS, Romania's DCCO, and the FBI to cooperate together on a single case is without precedence! A great sign towards a bad future for cyber criminals!