Trickbot on the Ropes Part 2: The QQAAZZ Money Laundering Ring

While shutting down the technical aspects of malware is critical (see Trickbot on the Ropes Part 1), the real disincentive to the criminals is when you hit them hard in the money.  That was the objective of Europol's Operation 2BaGoldMule case against QQAAZZ.   Working with partners in 16 countries, including Latvia, Bulgaria, the United Kingdom, Spain, and Italy, Europol helped to coordinate search warrants being executed at 40 different residences in support of criminal proceedings in the United States, Portugal, and the UK, and Spain.

Europol put out a two-part InfoGraphic as part of their story on the arrests, "20 Arrests in QQAAZZ Multi-Million Money Laundering Case":

 

Infographic: https://www.europol.europa.eu/publications-documents/operation-2bagoldmule

The criminals behind the QQAAZZ money laundering ring received funds from botnet operators, and "tumbled" the funds through a variety of shell companies and crypto-currencies to produce "clean money" keeping a 40% to 50% cut of the funds for themselves.

The U.S. Department of Justice says that QQAAZZ-controlled bank accounts received funds stolen via banking trojans including Dridex, Trickbot, and GozNym malware.  The DOJ action came in two rounds, with the first indictment being unsealed back in October 2019 naming these individuals: 

Aleksejs Trofimovics

a/k/a Aleksejs Trofimovich, Alexey Trofimovich, Aleko Stoyanov Angelov 

Ruslans Nikitenko 

a/k/a Krzysztof Wojciech Lewko, Milen Nikolchev Nikolov, Rafal Zimnoch 

Arturs Zaharevics

a/k/a Piotr Ginelli, Arkadiusz Szuberski 

Deniss Ruseckis

a/k/a Denis Rusetsky, Sevdelin Sevdalinov Atanasov 

These individuals used a collection of shell companies to open a large number of bank accounts in Portugal.  In 2018, I sat in a meeting in London with a handful of the largest banks in the UK and heard for the first time as they shared information with one another that it was a "common" thing that when someone had their bank account hit by Trickbot, a wire transfer would be sent to Portugal!

According to the indictment, Ruslans Nikitenko used his shell company Selbevulte LDA to open accounts at eleven banks in Portugal.  He used the company Colossal Devotion LDA to open accounts at nine additional banks.  Arturs Zaharevics created the shell company Cardinal Gradual Real Estate Unipessoal LDA and used it to open accounts at ten banks in Portugal.  Dennis Ruseckis created Flamingocloud LDA and used it to open accounts at thirteen banks in Portugal!

According to the October 2019 Indictment, more than $1.1 Million USD in wire attempts were made just for the transactions shown below, although in more than half of the cases, the funds were able to be blocked or recovered.

Date	Victim Bank	Wire Attempt	Beneficiary
07MAR2017	Schwab	$75000	Aktrofi Services
20SEP2017	BOA	$84900	Aktrofi Services
26OCT2017	JPMorgan Chase	$98780	Privelegioasis
29NOV2017	American Express	$121360	Selbevulte
30NOV2017	BB&T	$72000	Privelegioasis
08MAR2018	USAA	$29500	Flamingocloud
08MAR2018	USAA	$29500	Colossal Devotion
21MAR2018	BOA	$49000	Colossal Devotion
10APR2018	JPMorgan Chase	$59426	Cardinal Gradual
10APR2018	JPMorgan Chase	$59426	Cardinal Gradual
10APR2018	JPMorgan Chase	$59426	Cardinal Gradual
30AUG2018	PNC	$99693	Selbevulte
14NOV2018	BOA	$56202	Aktrofi Services
14NOV2018	BOA	$112921	Deinis Gorenko
14NOV2018	BOA	$45830	Deinis Gorenko
06DEC2018	JPMorgan Chase	$114652	Flamingocloud

In between that indictment and the current one, there was a bit more publicity back in May 2020 when "Plinofficial", a Russian scam-rapper, whose real name was Maksim Boiko, was arrested by the FBI when he landed at the Miami airport, as was covered by the BBC and others at the time. 

https://www.bbc.com/news/world-us-canada-52671381

In the more recent action, the indictment of the US Western District of Pennsylvania was just unsealed, having been filed on 29SEP2020.  This indictment names an additional group of money launderers:

• Nika Nazarovi - of Georgia - aka Nika Utiashvili, Mihail Atanasov, Stefan Trifonov Zhelyazkov
• Martins Ignatjevs - of Latvia - aka Yodan Angelov Stoyanov, Aleksander Tihomirov Yanev, Svetlin Iliyanov Asenov 
• Aleksandre Kobiashvili - of Georgia - aka Antonios Nastas, Ognyan Krasimirov Trifonov
• Dmitrijs Kuzminovs - of Latvia - aka Parush Gospodinov
• Valentins Sevecs - of Latvia - aka Marek Jaswilko, Rafal Szczytko
• Dmitrijs Slapins - of Latvia 
• Armens Vecels - of Latvia 
• Artiom Capacli - of Bulgaria
• Ion Cebanu  - of Romania
• TOmass Trescinkas - of Latvia 
• Ruslans Sarapovs - of Latvia 
• Silvestrs Tamenieks - of Latvia 
• Abdelhak Hamdaoui  - of Latvia 
• Petar Iliev - of Belgium 

it says that "in total, cybercriminals attempted to transfer tens of millions of dollars to QQAAZZ-controlled accounts, and QQAAZZ successfully laundered millions of dollars stolen from victims around the world."

The indictment breaks the criminals into three tiers: 

Leaders 

Mid-level Managers 

and Money Mules 

In the September 2020 indictment, some of the victim companies, whose bank accounts were used to wire money to European shell companies created by those named above, included: 

1. a technology company in Windsor, CT 
2. an Orthodox Jewish Synagogue in Brooklyn, NY 
3. a medical device manufacturer in York, Pennsylvania
4. an individual in Montclair, NJ 
5. an architecture firm in Miami, FL 
6. an individual in Acworth, GA
7. an automative parts manufacturer in Livonia, MI 
8. a homebuilder in Skokie, IL 
9. an individual in Carollton, TX 
10. an individual in Villa Park, CA.  

Dozens of additional US victims are identified, but it is unknown the total number of victims whose funds were stolen, or attempted to be stolen through these schemes. 

Those named in the two indictments received funds to shell company bank accounts including at least 147 accounts opened at banks in Portugal, as well as Germany, Spain, and the United Kingdom. 

The indictment provides a partial list of the funds transfers which occurred between US-based victims and accounts controlled by these criminals. 

In order to accomplish this, members of the QQAAZZ cash-out system advertised their services on "exclusive, underground, Russian-speaking, online cybercriminal forums."   Some of these advertisements on a single forum cost as much as $10,000 per year!  

Some of the online monikers used by QQAAZZ members in these forums included: 

qqaazz            globalqqaazz            markdevido 

richrich          donaldtrump55         manuel           krakadil                     

kalilinux         ritchie                      totala              totala22 

These forum exchanges helped to establish relationships between the malware gangs and the money launderers.  For example, QQAAZZ members using the name "richrich" chatted with members of the GozNym malware crime group about being a "drop handler" in the UK and Europe and having many accounts that could be used for money laundering, including an account in the name "Yaromu Gida" at a bank in Turkey.  That account received $176,500 in funds stolen from the medical device manufactuer in the Western District of Pennsylvania. 

"DonaldTrump55" provided bank account information for a drop belonging to Ruslans Nikitentko at a bank in Portugal opened using a counterfeit Polish identity card in the name Krzysztof Wojciech Lewko.  The account later received $121,360 from a US victim. 

Trickbot On The Ropes: Microsoft's Case Against Trickbot

 Trickbot is having a truly bad time this month!  While as of today, Trickbot binaries are being delivered by Emotet, there is every sign that they are struggling.   Emotet's daily activities are best documented by a team of researchers using the collective identity "Cryptolaemus" and sharing news of IOCs and URLs on their website: https://paste.cryptolaemus.com/.  With no activity from October 6th to 12th, there was every indication a "change" was coming, and beginning on 14OCT2020, researchers such as our friends at @CofenseLabs and @Malware_Traffic are both reporting that Trickbot is now being delivered by the Emotet spam-sending botnet.  

This post examines Microsoft's case against Trickbot. However, there are also reports of U.S. Cyber Command taking a role in disrupting Trickbot, as reported by the Washington Post and security journalist Brian Krebs. In the "take-down" attempt, as described by Krebs, the bot began propagating to other bots that its new controller IP address should be "127.0.0.1:1" - which would result in the bot-infected computer stopping communication with the criminals.  There was also an attempt to flood the criminals with millions of fake "stolen credentials" hoping to confuse their ability to sort out "true victims."  As Krebs also reported, the fabulous Trickbot C&C tracker at FEODOTracker is reporting many live C&C addresses for Trickbot.  (Also see Trickbot On the Ropes Part 2: the QQAAZZ Money Laundering Ring.) 

The Microsoft Trickbot Case

On October 12, 2020, Microsoft announced "New action to combat ransomware ahead of U.S. election" describing Trickbot as malware that "has infected over a million computing devices around the world since late 2016." By filing a lawsuit in the U.S. District Court for the Eastern District of Virginia, Microsoft received permission for a Temporary Restraining Order (TRO).  The Digital Crimes Unit (much love, guys!) worked with the FS-ISAC, ESET, Symantec, the Microsoft Defender team, NTT, and Lumen's Black Lotus Lab and others to lay out their case. 

The legal documents surrounding the case are on the Microsoft website: NoticeOfPleadings.com/trickbot/

Microsoft and the FS-ISAC bring the case with a 60 page complaint, demonstrating harm to their respective customers in the Eastern District of Virginia, and demanding that "John Doe 1" and "John Doe 2" appear in court for a Jury Trial.

They charge them with violations of: 

• The Copyright Act - 17 USC § § 101 
• The Computer Fraud and Abuse Act 18 USC § 1030
• The Electronic Communications Privacy Act 18 USC § 2701
• Trademark Infringement under the Lanham Act 15 USC § 1114
• False Designation of Origin under the Lanham Act 15 USC § 1125(a)
• Trademark Dilution under the Lanham Act 15 USC § 1125(c) 
• Common Law Trespasses to Chattels 
• Unjust Enrichment 
• and Conversion 

To do so, Microsoft asked the court to force hosting providers to suspend services and block and monitor traffic for the customers who were using particular IP addresses within their organizations.  The list included: 

• Input Output Flood, LLC of Las Vegas, for IP addresses: 
• 104.161.32[.]103, .105, .106, .109, and .118.
• Hosting Solution Ltd (Hurricane Electric of Fremont, California) for IP address:
•  104.193.252[.]221.
• Nodes Direct Holdings of Jacksonville Florida for IP addresses: 
• 107.155.137[.]7, .19, and .28,
• 162.216.0[.]163, 
• 23.239.84[.]132, .136
• Virtual Machine Solutions, LLC of Los Angeles, California for IP addresses: 
• 107.174.192[.]162 and 
• 107.175.184[.]201
• Hostkey USA of New York for IP address: 
• 139.60.163[.]45 
• Fastlink Network Inc, of Los Angelese for IP address: 
• 156.96.46[.]27
• Green Floid LLC for IP addresses: 
• 195.123.241[.]13 and .55 
• Twinservers Hosting of Nashua, New Hampshire for IP address: 
• 162.247.155[.]165  

Each team made significant contributions to the effort, and most have published their own Trickbot blogs, which I link below, with regards to the case, their most important function was to provide professional analysis in the form of a Declaration in Support of Motion for TRO: 

• Lyons is Jason Lyons, a Senior Manager of Investigations at the DCU Malware & Cloud Crimes Team.  Lyons, who served in the Cyber CounterIntelligence unit of the U.S. Army, provides 25 pages of testimony and ten "Exhibits." Part of his testimony included the proof of 25 million Gmail, 19 million Yahoo, 11 million Hotmail, 7 million AOL, 3.5 million MSN, and 2 million Yahoo.co.uk addresses known to have been targeted by Trickbot (based on reporting from Deep Instinct)
• Finones is Rodelio Finones, a Senior Security Software Engineer and Malware Researcher at the Microsoft DCU. He provides a 21 page testimony of his own investigation into Trickbot, 
• Thakur is Vikram Thakur, the Technical Director of Symantec Enterprise, where he has been a major rockstar for more than a dozen years!  He provides a 20 page testimony.
• Garlow is Kevin Garlow, Lead Information Security Engineer at LUMEN (formerly CenturyLink). His testimony includes the fact that he has identified 502 distinct IP addresses that had acted as Trickbot controllers, but that 40 of them have remained online despite more than 30 abuse notifications and that 9 of them have been sent more than 100 such notifications.  He states that "We confirmed 55 new Trickbot controller IPs in September 2020 and 99 new Trickbot controller IPs in August."  It is these long-lived "bullet-proof" controllers that Microsoft is targeting.  It is also likely that revealing whoever is paying the bills for those long-lived services may be a path to identifying John Doe 1 and John Doe 2.  Garlow's testimony that he has sent so many notices for take-down which have been ignored is a powerful part of this package!
• Silberstein is Steven Silberstein, the CEO of the FS-ISAC.  He provides testimony to more than 500 fraud attempts against FS-ISAC member institutions over an 18 month period, with $7 Million in attempted fraud.  One FS-ISAC member had dozens of attempts in a two week period with an average fraud attempt of $268,000!  
  
  
  
• Ghaffari is Kayvan M. Ghaffari, an attorney with Crowell & Moring LLP for Microsoft and the FS-ISAC.  His testimony calls out the particular web hosting companies that were hosting the machines targeted by the TRO, including Colocrossing, IOFlood, HostKey, VDI-Network, ENET-2, and King Servers, pointing out that all of these organizations have Terms of Service which are clearly violated by the Trickbot controllers.  He then attaches as exhibits more than 650 pages of similar cases and the related court documents from them.
• Boutin is Jean-Ian Boutin, the Head of Threat Research, calls Trickbot "one of the most prolific and frequently encountered types of malware on the Internet."

Related TrickBot Blogs

ESET analyzed 125,000 malware samples and downloaded and decrypted 40,000 configuration files used by Trickbot modules, helping to map out the C&C servers by the botnet. While Trickbot can drop many "modules" these are not one-size-fits-all.  Trickbot modules were sometimes dropped in phases after an initial assessment of the network on which the bot found itself, and other times varies by the "gtag" -- the unique label used to sign the infection, thought to be related to affiliates who paid the Trickbot operators.

gtag timeline by ESET

Lumen's Black Lotus provided C2 timelines, demonstrating which IP addresses in which countries were active in which timeframes.  Indonesia, for example, hosted active C2 servers on 1,362 days!  Colombia and Ecuador, which by their count were #2 and #3 had only 652 and 637 C2 days by comparison.  They shared 95 C2 addresses in their recent Look Inside the Trickbot Botnet blog post. Many of these IP addresses are also called out in Lyons testimony as Exhibit 2.

5.152.210[.]188	45.89.127[.]27	96.9.77[.]56	129.232.133[.]39	185.172.129[.]100	194.87.236[.]171
5.182.210[.]224	51.77.112[.]252	103.111.83[.]246	131.161.253[.]190	185.234.72[.]114	195.123.238[.]83
5.182.211[.]124	51.83.196[.]234	103.12.161[.]194	139.60.163[.]45	185.234.72[.]35	195.123.239[.]193
5.182.211[.]138	51.89.215[.]186	103.196.211[.]120	156.96.46[.]27	185.236.202[.]249	195.123.240[.]18
27.147.173[.]227	62.108[.]35.9	103.221.254[.]102	158.181.155[.]153	185.25.51[.]139	195.123.240[.]93
36.66.218[.]117	80.210.32[.]67	103.36.48[.]103	176.31.28[.]85	185.99.2[.]106	195.123.241[.]224
36.89.182[.]225	83.220.171[.]175	103.76.169[.]213	177.190.69[.]162	185.99.2[.]115	195.123.241[.]229
36.89.243[.]241	85.204.116[.]117	104.161.32[.]108	179.127.88[.]41	186.159.8[.]218	195.161.62[.]25
36.91.45[.]10	89.249.65[.]53	104.161.32[.]118	180.211.170[.]214	190.136.178[.]52	200.116.159[.]183
36.91.87[.]227	91.200.100[.]71	107.155.137[.]15	181.112.157[.]42	190.145.83[.]98	200.116.232[.]186
36.94.33[.]102	91.200.103[.]236	110.93.15[.]98	181.129.104[.]139	190.152.182[.]150	200.171.101[.]169
45.127[.]222.8	92.38.135[.]61	112.109.19[.]178	181.129.134[.]18	190.214.28[.]74	200.29.119[.]71
45.138.158[.]33	92.62.65[.]163	117.252.214[.]138	181.143.186[.]42	190.99.97[.]42	201.231.85[.]50
45.148.10[.]174	93.189.42[.]225	121.100.19[.]18	182.253.113[.]67	192.3.246[.]216	212.22.70[.]59
45.66.10[.]22	96.9.73[.]73	121.101.185[.]130	185.14.30[.]247	194.5.249[.]214	220.247.174[.]12
45.89.125[.]148	96.9.77[.]142	122.50.6[.]122	185.142.99[.]94	194.5.249[.]215

Symantec's blog post "Trickbot: U.S. Court Order Hits Botnet's Infrastructure" has a great infographic about "How Trickbot Works": 

Microsoft on Trickbot's use of Covid-19 Lures

Microsoft is in a unique position to take action against malware, having visibility to so much malware-related traffic from browser telemetry, Microsoft Defender reports, and Office365 scans.  In the past year, they have evaluated 6 Trillion messages and blocked 13 Billion malicious emails that used 1.6 Billion URLs to try to infect the email recipients!

Microsoft's Digital Defense Report 2020 points out that Trickbot began using COVID-19 spam lures on March 3, 2020, and went on to become the most prominent spam botnet using COVID-19 themes.

From MS Digital Defense Report 2020 

We've long argued that if the lure is timely and controversial, people will click on it.  That seems to be the case even today as ProofPoint's @ThreatInsight has pointed out, documenting that a recent malware campaign, first seen October 6, 2020, is using President Trump's diagnosis as a lure to infect people with additional malware, using the subject line "Recent material about the president's situation" and the promise of additional details in a password-protected email attachment.

RoboCallers Hit with Permanent Injunction by Courts

The Eastern District of New York has ruled in the case "United States v. Nicholas Palumbo, et al" effectively putting TollFreeDeals.com and SIPRetail.com out of business.  These are the "Voice Over IP" companies that have allowed millions of overseas calls per day to be routed to Americans, often for the purposes of facilitating fraud, often by imitating either the Social Security Administration or the IRS.  The case, originally filed 28JAN2020 ( 1:2020cv00473) announced their final "permanent injunction" ruling on 26AUG2020, as conveyed by the Office of the Inspector General of the Social Security Administration.  

In the 62-page criminal complaint against the two companies, the government explains that the major fraud types facilitated by the Palumbos were: 

a. Social Security Administration ("SSA") Imposters

b. Internal Revenue Service ("IRS") Imposters 

c. United States Citizenship and Immigration Services ("USCIS") Imposters 

d. Tech Support Imposters -- often claiming to be Apple or Microsoft 

e. Loan Approval Scams

Through the use of the Palumbos' companies, the callers were able to spoof their caller ID to seem to originate from a U.S. Federal government agency, local police department, or technical support organization. 

From October 1, 2018 to September 30, 2019, the SSA received more than 465,000 complaint related to these types of calls and documented losses of more than $14 million.  The Federal Trade Commission's Consumer Sentinel Database documented 166,000 such calls with losses of $37 million just in calendar 2019.  When all types of government impersonation calls were included, the FTC Consumer Sentinel reported 255,223 complaints causing $128 Million in fraud losses in 2018 and 389,563 complaints resulting in $152 Million in fraud losses in 2019!

The Social Security Calls

According to the government's complaint one such robocall, sent to millions of American telephone numbers in early 2019 used this text: 

"Hello this call is from Department of Social Security Administration the reason you have received this phone call from our department is to inform you that there is a legal enforcement actions filed on your social security number for fraudulent activities so when you get this message kindly call back at the earliest possible on our number before we begin the legal proceedings that is 619-XXX-XXXX. I repeat 619-XXX-XXXX.  Thank you."

The Technology 

How does the technology work?  The foreign call center uses Voice Over IP (VoIP) to connect via broadband Internet to a U.S. based telecommunications company called a "gateway carrier."  The gateway carrier then routes the call to a "common carrier" such as AT&T or Verizon.  Because of the need to bill for these services, both the gateway carrier and the common carrier keep logs of these calls. Part of the service provided by the Gateway Carrier is to perform "least-cost routing" - basically real-time auctioning the call so that the call is routed to the cheapest bidder. 

These logs provide: 

timestamp => destination consumer # => gateway carrier => caller-id presented (often spoofed) => downstream customer (usually the foreign call center) .   

In just 23 days in May and June of 2019, TollFreeDeals transmitted more than SEVEN HUNDRED TWENTY MILLION calls!  (720,000,000 calls!!!!)  425 million of these calls lasted less than one second.  More than 24 million of these calls were placed to residents of the Eastern District of New York.

182 Million of these TollFreeDeals calls were originated from a single India-based VoIP carrier co-conspirator in the United States.  One thousand different source numbers accounted for 90% of these calls.  79% of these 1,000 numbers were listed as fraudulent robocall numbers by a robocall blocking company (YouMail).  Of these 143 million calls, 20% were Social Security imposter calls, 35% were loan approval scams, and 14% were Microsoft refund calls. Other calls imitated the IRS, the U.S. Treasury, and additional tech support scams.

In May 2017, Nicholas Palumbo was notified by AT&T and others that his company was routing fraud government imposter calls.  Palumbo promised to block two particular telephone numbers, but continued to allow the others.  

In February 2019, AT&T notified Palumbo that calls spoofing the USCIS and attempting to extort money had been traced to his company.  Again, Palumbo blamed his India-based VoIP carrier customer, even though this was the same company for which he had already received many warnings.  

A telecommunications industry trade association, USTelecom, provided an additional 144 notifications of fraudulent call origination to the Palumbos' companies from May 2019 to January 2020, including 83 SSA Imposter fraud call cases, 24 Tech Support imposter fraud cases, 10 IRS imposter fraud cases, and 1 USCIS impersonation fraud calls.  USTelecom's notices estimated that TollFreeDeals was placing "more than 1 million fraudulent calls per day."  Palumbo logged in to the USTelecom portal and repeatedly indicated the calls had been placed by the same India-based customers of TollFreeDeals.

USTelecom also formally notified SIP Retail of similar traffic, including 35 traceback investigations from August 2019 to January 2020, including 19 SSA Impersonation cases, 3 Tech Support impersonation cases, and 1 USCIS Impersonation case.

Elder Fraud Task Force Reports

To put a human face on the crimes, a Postal Inspector working for the Elder Fraud Task Force in the Consumer Protection Branch of the Department of Justice investigated many example calls facilitated via the Palumbos' companies.

Palumbo received at least nineteen large cash deposits into Wells Fargo Bank accounts that he controlled from May 28, 2019 to September 11, 2019, totalling $130,250.  The deposits were made in Minnesota, South Carolina, Florida, Alabama, and New Jersey.  After each cash deposit, Palumbo would move the funds to his Ecommerce National LLC accounts at JP Morgan Chase. These activities are characterized by the Postal Inspector as "Interstate Funnel Account" transactions, a form of laundering money.

Some of the victims interviewed by the Postal Inspector included: 

J.K - an 84 year old veteran of the US Marine Corps from Belle Harbor, NY.  He received a call claiming to be from the U.S. Marshals Service with a wrarant for his arrest.  He then was told by a "SSA Employee" that someone had used his SSN to rent a car in Texas and that the car was used in drug trafficking and money laundering.  The "SSA Employee" then forced J.K to wire all of the money in his bank accounts to him - $9,800. 

C.E. - a 36 year old man who was a brand-new U.S. citizen.  He was told be "George" from SSA that he was being investigated for money laundering.  He was told to drive to a Best Buy in Queens, NY and buy $700 worth of Hotels.com gift cards. 

L.U. - a man in his 40s from Roosevelt, NY lost $2,200 in an SSA Imposter scam 

More on Call Routing

Another Affidavit related to this case was the Declaration of a Special Agent of the Social Security Administration's Office of the Inspector General, who provided the diagram above to explain the complication of Least-Call Routing Tracebacks. 

From 2016 to 2020, TollFreeDeals.com was offering VoIP termination services specializing in servicing foreign call center call originators.  Their website specifically stated: 

"TollFreeDeals.com is your premier connection for call center and dialer termination.  We are always looking for the best call center routes in the telecom industry.  We specialize in short call duration traffic or call center traffic.  We understand there is a need for it and we want to help you find all the channels you need!" 

They were proud of the number of call minutes they had "terminated" (which means, facilitated the call from VoIP to a Common Carrier call completion.)  As of January 23, 2020, they boasted that they had helped to completed 10,491,500,323 minutes of calls!  That's TEN BILLION MINUTES of mostly fraud calls! 

One of the calls documented by the SSA OIG Special Agent stated: 

"We have been forced to suspend your social security number with immediate effect.  Due to this, all your social benefits will be cancelled until further clearance. In case you feel this is due to an error you may connect with legal [unintelligible] Social Security Administration. In order to connect with a Social Security Administration office, press One now.  In case we do not hear from you, your social will be blocked permanently. To connect with an officer now, press One and you will automatically be connected with the concern departments. We did not receive any input. Dear citizen, in order to speak with Social Security personnel regarding your social security, press One and this automated system will connect you with the officials." 

This affiant establishes that those 1,000 top phone numbers identified by YouMail and confirmed as fraud based on complaints in the FTC Consumer Sentinel database came from 29 unique TollFreeDeals customers.

Many Additional Details 

There were many rounds of filings by the Palumbos' lawyers, all soundly rebutted by the Department of Justice and their investigators, often with the help of industry experts.  One in particular addresses the behavior of "Yodel" ... in a single day, January 20, 2020, Yodel sent more than 6.5 million robocalls through the Palumbos' services.  5.2 million of these calls use "Neighbor Spoofing" which is the practice of assigning a caller id to the call which seems to originate from someone in the same area code and with the same prefix.  

Chinese "COVID-19" Hackers indicted after 11 year hacking spree

On July 7, 2020, a Grand Jury in Seattle was presented with evidence about the eleven year campaign of Computer Network Intrusion being conducted by two former classmates who hacked for personal profit and the benefit of the Chinese Ministry of State Security. Li Xiaoyu 李啸宇 and Dong Jiazhi 董家志.  The pair met when they were studying Computer Application Technologies at the University of Electronic Science and Technology ("UEST") in Chengdu, China.  UEST has as its motto:  求实求真 大气大为  -- "To Seek Facts and Truth, To Be Noble and Ambitious."  This pair certainly "sought facts" and were "ambitious," though not in a way that many would consider "Noble."  The University was admitted into Project 985 in 2001, a project that supported 34 top universities encouraging each to become a global leader in their chosen specialty, and incidentally kicking off a new ambitious era of global cyber espionage to help them gain competitive advantage.

Or maybe it was exactly the plan.  In 2007, likely the year that Dong would have started his college experience at UEST, the School of Software boasted that as part of the 11th Five Year Plan, their textbook, 计算机病毒技术 (Computer Virus Technology), received national acclaim.  The following year, they announced the completion of their Information Technology textbook series of 8 books, adding "Network and System Attack Technology" and "Network and System Defense Technology" to the series.  In the United States, "Network and System Attack Technology" ( 网络与系统攻击技术)  is mostly taught in the military and intelligence communities, not in undergrad computer science courses.  In 2017 the course was taught by Li Hongwei (李洪伟), whose slides are online.  In 2019 the instructors were 李洪伟 and 吴立军.

Network and System Attack Technology - Cao Yue and Yu Shengji 

An example slide from a previous version of the course which bother of our hackers would have taken:  (Lecture 2, "Information Retrieval")

The text explains one of the tools from the "experimental" portion of the class, "MS06040Scanner": 

The working principle of MS06040Scanner is to first obtain the operating system type and open ports through port scanning and operating system scanning. If it is a windows2000 system, TCP 139 or TCP 445 port is opened, and the returned data packet matches the definition in the vulnerability library. It means that the host may have MS06040 vulnerabilities, we can use MS06040 exploit programs to carry out remote overflow attacks on it

The second slide demonstrates the "X-Scan" tool which would be used to find vulnerabilities allowing data exfiltration.

The Attacks 

According to the Department of Justice Indictment, Dong was the one who researched victims and means of exploiting them while Li primarily did the hacking. 

美国司法部对34岁的李晓宇(音译)和31岁的董佳芝(音译)提出11项指控称，称他们侵入了数百家公司、政府机构以及持不同政见者和神职人员的电脑系统。

Here's how the indictment describes the "Manner and Means of the Conspiracy" -- 

"The defendants research and identified victims possessing information of interest, including trade secrets, confidential business information, information concerning defense products and programs, and personal identifying information ("PII") of victim employees, customers, and others, using various sources of information including business news websites, consulting firm websites, and a variety of search websites.

The defendants then gained unauthorized access to victims possessing the information sought by the conspiracy.  They stole source code from software companies, information about drugs under development, including chemical designs, from pharmaceutical firms; students' PII from an education company; and weapon designs and testing data from defense contractors.

The defendants usually gained initial access to victim networks using publicly known software vulnerabilities in popular products.  Those vulnerabilities were sometimes newly announced, meaning that many users would not have installed patches to correct the vulnerability. ... They also targeted insecure default configurations in common applications."

The defendants used their initial access to place a "web shell" on the victim network, allowing remote execution of commands on a computer.  The most frequently deployed was the "China Chopper" web shell.  They most frequently did so by hiding the file with the name "p.jsp" in an obscure directory on a public-facing website.  (They also sometimes named their webshell's "tst.jsp", "i.jsp", or "/SQLTrace/i.jsp".) The indictment includes a screenshot of China Chopper which is lifted from the FireEye blog post "Breaking down the China Chopper" ... if you are interested, you should also read the Talos Blog post: "China Chopper still active 9 years later" 

(FireEye explains China Chopper)

They would then plant software for stealing passwords, identifying computer users with Administrator access, and then studying the network for useful data.  The data was compressed as a .RAR file, but then often renamed as a ".jpg" file and placed in the victim's recycle bin until it could be retrieved.

The Victims 

The indictment makes clear that there were "hundreds" of victims between September of 2009 and early 2020, not only the ones listed in this indictment. To characterize the range of victims, they list types of companies, date ranges, amount of data stolen, and type of data gathered. 

Victim 1: California-based technology and defense firm

Dec 2014-Jan 2015

200GB "Radio, laser, and antennae technology; circuit board and related algorithms designs for advanced antennae; testing mechanisms and results."

Victim 2: Maryland-based technology and manufacturing firm - 64GB 

Victim 3: Hanford Site, Department of Energy, Washington State - information about network and personnel, including lists of authorized users and administrator accounts

Victim 4: Texas: 27GB of space and satellite application data 

Victim 5: Virginia Federal Defense contractor - 140GB of project files, drawings and documents related to Air Force and FBI investigations.  PII on 300+ employees

There were many more victims detailed, including:

 a US Educational Software company with "millions of students and teachers' PII." breached from Nov 2018 to Feb 2019, 

 a California pharmaceutical company - 105GB of data in Feb and March 2019 

 a Massachusetts medical device company - 83 GB of source code just as the victim was engaging in a contract with a Chinese firm to produce some of their components.

Other victims were listed in other places, including a large electronics firm in the Netherlands, a Swedish online gaming company (169GB of files including source code and player usernames and passwords), a Lithuanian gaming company, and other companies in Germany, Belgium, the Netherlands, an Australian defense contractor (320GB of data!), a South Korean shipbuilding company, an Australian solar energy company, a Spanish defense firm, and a UK AI firm focused on cancer research.

The Hackers' MSS Connection

The DOJ indictment mentions the Ministry of State Security 19 times, specifically referring to an unnamed "MSS Officer 1." 

"After stealing data and information from their victims and bringing that data and information back to China, Defendants then sold it for profit, or provided it to the MSS, including MSS Officer 1." 

"Li and Dong did not just hack for themselves. While in some instances they were stealing business and other information for their own profit, in others they were stealing information of obvious interest to the PRC Government's Ministry of STate Security ("MSS"). LI and DONG worked with, were assisted by, and operated with the acquiescence of the MSS, including MSS Officer 1, who was assigned to the Guangdong regional division of the MSS (the Guangdong State Security Department, "GSSD"). 

"When stealing information of interest to the MSS, LI and DONG in most instances obtained that data through computer fraud against corporations and research institutions. For example, from victims including defense contractors in the US and abroad, they stole information regarding: military satellite programs; military wireless networks and communications systems; high powered microwave and laser systems; a counter-chemical weapons system; and ship-to-helicopter integration systems. 

In other instances, the Defendants provide the MSS with personal data, such as the passwords for personal email accounts belonging to individual Chinese dissidents including: 

• a Hong Kong community organizer
• the pastor of a Christian church in Xi'an
• a dissident and former Tiananmen Square protestor
• emails to and from the office of the Dalai Lama
• emails belonging to Chinese Christian "house" church pastor in Chengdu (who was later arrested)
• emails form a US professor and organizer
• two Canadian residents who advocate for freedom and democracy in Hong Kong

MSS Officer 1 assisted LI and other hackers.  When LI had difficulty compromising the mail server of a Burmese human rights group, MSS Officer 1 provided him with 0day malware for a popular browser which exploited a bug not known to the software vendor or security researchers.

MSS Officer 1 claimed to be a researcher at the "Guangdong Province International Affairs Research Center" but in fact was an intelligence officer working for the GSSD at Number 5, 6th Crossroad, Upper Nonglin Road, Yuexiu Distring, Guangzhou.

Example Tools and Techniques 

In several attacks, the attackers (in 2018) targeted ColdFusion vulnerabilities published in 2018 (CVE-2018-15961) attempting to gain access to CKEditor and the associated FileManager, using a ColdFusion web shell program named "cfm backdoor by ufo."  (This tool was actually used in a cool Canadian Government Training on APT groups, although in their training it was an Iranian hacker group using the tool.) 

In some cases, the hackers were clearly operating for personal profit.  Sometimes sending emails with subjects like "Source Code To Be Leaked!" and demanding a ransom payment to prevent publication of their software.

COVID-19 Targeting

On January 25 and 27, 2020, Li searched for vulnerabilities at a Maryland biotech firm who had publicly announced their role in researching a potential COVID-19 vaccine.

On February 1, 2020, Li searched for vulnerabilities in the network of a California biotech firm that had announced the previous day they were researching antiviral drugs to treat COVID-19. 

On May 12, 2020, Li searched for vulnerabilities in the network of a California diagnostics company publicly known to be developing COVID-19 testing kits. 

On June 13, 2020, Li conducted reconnaisance related to a Virginia defense and cybersecurity contractor, Hong Kong protestors, a UK Messaging app used by HK protestors, a Webmail provider used by HK protestors, a Massachusetts biotech firm, and a California space flight firm.

Hushpuppi and Mr.Woodbery, BEC scammers: Welcome to Chicago!

There are quite a few West African scammers who try to explain away their wealth by claiming they are a "bitcoin entrepreneur" or "real estate investor" when in fact they conduct Business Email Compromise scams against American companies, and Romance Scams against vulnerable women, and steal their money.  Back in October, one such criminal, Ismaila Mustapha, who went by the Instagram nickname Mompha, was arrested and I mentioned it in a tweet:

https://twitter.com/GarWarner/status/1186816176019648513

Replying to my own tweet, I said "Maybe they'll get his friend #Hushpuppi next ??" and linked to his Instagram account, tagging @officialEFCC in the post.  My posts received the most attention of anything I had ever shared on Twitter, which I learned was because of some headlines in Nigerian media such as these:

Mompha is a Top 10 BEC Scammer

With all of the attention of 4,000+ new Nigerian Twitter followers, I have to admit it felt a bit prophetic when we learned of Hushpuppi's arrest on June 10th.  I shared these images from their respective Instagram accounts that day.

Ever since their arrest by Dubai Police on June 10, 2020 in the UAE, Nigerian media has been going crazy with theories on what was going to happen to Hushpuppi and Mr.Woodbery.  The original posts said that Hushpuppi was arrested in the UAE "by Interpol" (who has no arresting authority) for his role in a $35 Million ventilator scam.  Other versions say he was involved in "fraud and money laundering of over $100million which was supposed to be given to Native Americans during the Coronavirus Pandemic.  More recently, Nigerian media claimed that the pair were already in the United States in Moshannon prison and that Woodbery had fallen sick there.

The EFCC, Nigeria's government anti-corruption agency, put out a thread of Tweets on June 18th confirming that they were cooperating with the FBI to try to identify additional victims and to investigate parts of his money laundering empire that are still in Nigeria.  In the thread they called him "Nigerian most-wanted hacker, Ramoni Igbalode, alias Ray Hushpuppy."

The Dubai police called their case against Hushpuppi "Operation Fox Hunt 2"-- in the video they mention seizing 21 laptops, 47 phones, 15 USB drives, 5 hard drives, 119,580 files, and 13 cars!

An English version of the Fox Hunt 2 video is available on Vimeo here (click to play):

The video also makes clear that while only two "celebrity-level" hackers were arrested, there were actually at least twelve other people arrested in Dubai that night during six raids.  The video claims that they had information on 1,926,400 victims!

Who knows their names?  Please answer in the comments below ...

Hushpuppi and MrWoodbery Charged in the United States

In the United States when charges are brought, the charges are made for victims within the jurisdiction where the charges are brought.  Rather than listing every possible crime, the staff of the top prosecutor in that district, known as Assistant United States Attorneys, brings charges for crimes where the victims or the activities occurred within their jurisdiction.  Because of the prominence of these case, a cybercrime special prosecutor from the Cyber and Intellectual Property Crimes Section of the Department of Justice is assisting in prosecuting these cases.  In these cases, Hushpuppi is being charged in Los Angeles, California, and Mr. Woodberry (Jacob Olalekan Ponle) is being charged in Chicago, Illinois.  Both men arrived in Chicago, on 02JUL2020 after being expelled from the United Arab Emirates.

Click to read Northern District of Illinois Press Release

Click to read Central District of California Press Release

Chicago Case vs. Mr.Woodbery 

In the Chicago case, there are two primary victims that establish venue there.  Victim Company A lost $2,300,000 USD.  Victim Company K lost $15,268,000 USD.  Jacob Olalekan, who the FBI refers to as "PONLE" says that in the latter operation Ponle received at least 1494 Bitcoins from that case, which at the time would have had a value of $6,599,499 USD!

In their investigation, they found that Ponle used US-based "money mules" -- criminals who are paid to open bank accounts on behalf of a scammer.  One of these mules said that he received his instructions from someone that he knew as "Mark Kain."  Mark Kain used a voice over IP telephone number that was issued from the company Dingtone.  Since Dingtone fully cooperates with law enforcement, they were able to quickly learn that this number was paid for by someone using the South African telephone number +27 793 837 890.

The Money Mule also indicated that he made transfers to a Bitpay bitcoin account with the wallet id 16AtGJbaxL2kmzx4mW5ocpT2ysTWxmacWn.  Bitpay, who also cooperated with law enforcement, was able to show this account was created in September 2015 and that the account owner used the email address "hustleandbustle@gmail.com."

The next step in the investigation was to ask Apple about those telephone numbers and email addresses.  Apple, who can provide law enforcement with all information about any iPhone, shared with the FBI that the telephone number +27 793 837 890 belonged to Jacob Olalekan, who used the hustleandbustle email while logged in from that telephone.  Apple was also able to provide a photo of a Nigerian passport in the name "Olalekan Jacob Ponle" born May 1991 in Lagos, Nigeria, and also a photo of a UAE Visa and a UAE Resident Identity Card in the same name.

Ponle Nigerian Passport

Ponle UAE Resident Card

Ponle USA Visa

The FBI has contents of many WhatsApp chats that Ponle had with various scammers and money mules he worked with. 

In addition to Ponle's Chicago crimes, he also committed many others that are documented in his case:

- 16JAN2019 - $188,000 fraud against a company in Des Moines, Iowa.

 - 04MAR2019 - $415,000 fraud against a company in Great Bend, Kansas.

- June 2019 - attempted $19,292,690.30 wire for a company - stopped by JP Morgan Chase!

- September 2019 - the FBI took over the accounts of one of the former money mules and received instructions from Ponle to open a new bank account.  The FBI opened the account, but stopped a $1.2 million fraudulent transaction from occurring.  

These details and more can be found in the Criminal Complaint against Olalekan Jacob Ponle.

MoneyLaundering via LocalBitcoins

The big Chicago case happened on 11FEB2019 - $2,300,000 fraud against a Chicago company. In that case, the money was sent to a six-month old Personal Checking Account opened by the money mule.  He then moved $2.1 million into a SilverGate bank account belonging to Gemini Trust, a cryptocurrency exchange.  The mule then tells Ponle that the funds will be moved to him $500,000 USD at a time, and asks him for his bitcoin account.  The mule says we are sending you 340 bitcoins and the rest is coming.

All of this is easy to confirm by looking at the blockchain.  I use CipherTrace for Bitcoin analysis.  This shows that over the lifetime of this Bitcoin address, 3,798.20832689 BTC were received by the account Ponle claims as his own, in 434 different transactions.  (At current Bitcoin values, that would be $34,315,216 USD!)  You can clearly see the 340 Bitcoin transaction being received from Gemini.com on 15FEB2019:

MrWoodbery/Ponle Bitcoin account receiving stolen funds

Right after this transaction, you can see that MrWoodbery sent 611 Bitcoin (currently worth $5,522,495 USD!) to Bitcoin wallet 15go6kCncrhkt6z2ziQr6W39SVpyZ52tpM, from which the funds were sold off bit by bit in LocalBitcoins.com transactions.

40 BTC on 16FEB via LocalBitcoins.com 

15.7 BTC on 16FEB via LocalBitcoins.com 

5 BTC on 17FEB2019 via Luno.com 

56 BTC on 17FEB2019 via LocalBitcoins.com 

23 BTC on 18FEB2019 via LocalBitcoins.com 

30 BTC on 18FEB2019 via LocalBitcoins.com 

15 BTC on 18FEB2019 via LocalBitcoins.com 

30 BTC on 19FEB2019 via LocalBitcoins.com 

29 BTC on 19FEB2019 via LocalBitcoins.com 

22 BTC on 19FEB2019 via LocalBitcoins.com 

etc. 

Along the way some smaller transactions were made, such as spending 0.03 BTC at UniCC, a stolen credit card shop.

the BTC transactions to Local Bitcoins stay small 1-3 BTC per transaction, until 09MAR2019 when he sells 35.9884 BTC on LocalBitcoins.com 

By June of 2019, the funds which had not been converted to cash via LocalBitcoins were primarily deposited at HuboiGlobal, a cryptocurrency exchange originally founded in China, but now with offices in Singapore, Hong Kong, Korea, Japan, and oh yes, the United States!  

The Los Angeles Case Against HushPuppi

At first it may not be obvious why the HushPuppi case is in Los Angeles, as one of the largest victims is a New York based company, from which Raymon Abbas (aka Hushpuppi) is accused of stealing $922,857 USD from in a Business Email Compromise scam.  The Los Angeles FBI came to have possession of an iPhone which contained many communications between the owner of that phone and Abbas.  During the laundering of the funds from the New York based company, at least $396,050 were laundered by a second money mule, who opened bank accounts in Los Angeles, giving the Los Angeles FBI venue on the case.  

The iPhone showed many communications to the Dubai-based number +971 543 777 711.  This phone was listed in the iPhone contacts under the name "Hush" ... there was also a Snapchat contact with this number under the name "hushpuppi5" whose account called himself "the Billionaire Gucci Master!!!"   The FBI's review of Hushpuppi's Instagram account found a post where he listed his own Snapchat account as "Hushpuppi5."  

Instagram, who fully cooperates with law enforcement, provided to the FBI that the Instagram account used the email "rayhushpuppi@gmail.com" and the phone number +971 502 818 689.  The account was created October 10, 2012 and had many logins from the UAE.

Snapchat, also a US based company who fully cooperates with law enforcement, provided that the Hushpuppi5 account used the same email as the Instagram account, rayhushpuppi@gmail.com and a different UAE telephone number +971 565 505 984.  

The Gmail account, (Google is a US based company who fully cooperates with law enforcement) revealed that an Apple Account was created on 29MAR2014 in the name Ray Hushpuppi, and used both the gmail account and the account "rayhushpuppi@icloud.com" and another gmail account.

The other Apple account found used the name Godisgood Godson and the gmail account "godisgoodallthetime0007@gmail.com" but often used the name "Ramon Abbas" in account records, giving the mailing address "1706 Palazzo Versace, Dubai, UAE."  The rayhushpuppi@gmail.com account was used to lease that property from 04APR2020 through 03MAY2021.  

Through a combination of IP address login records and telephone login records, all of the above accounts could be clearly shown to belong to the same individual.

The emails also contained things such as copies of Abbas's Nigerian passport and UAE Resident card which further confirm these accounts were under his personal control.  Receipts for wire transfers of large volumes, including $250,000 and $2,397,000 were found in the emails, linking Abbas in the latter case to the Chicago Mr.Woodbery case above.

Other indicators included proof that Abbas picked up wire transfers from Western Union in the UAE in 2018 and MoneyGram transactions in the UAE, all using his UAE Resident card. 

Malta Bank Job

In addition to the New York law firm case, Abbas also discussed a foreign financial institution case where €13 million was stolen ($14.7 Million USD) and the co-Conspirator in Los Angeles asked for accounts which could receive "5m euro" which Abbas provided by sending information for a Romanian bank account.  Abbas communicates with the group who is trying to laudner the money, and confirms receipt of  €500,000

Although it is not stated in the FBI paperwork, this was the Bank of Valetta, mentioned in the headlines of the Times of Malta.  The hackers boast that the bank had not yet noticed their activity and that they were going to hit it more the following day. 

ToshiTimes

The Prime Minister of Malta issued a statement to the public that although "Hackers sought to make international transfers to banks in the UK, US, Czech Republic and Hong Kong. The transfers were blocked within 30 minutes and the banks alerted." A follow-up report a week later in the Times of Malta detailed how a bank employee believed he was responding to an email from a French government stock market regulator, but the attached Word document actually planted malware on the banking system, allowing the hack to move forward.  The Times of Malta said the attack was thought to be part of a hacking group called "EmpireMonkey" which has been linked by other cybercrime researchers to CobaltGoblin and even the Carbanak group.  (See for example this Kaspersky article:  FIN7.5: the infamous cybercrime rig continues its activities.

https://timesofmalta.com/articles/view/how-bov-hackers-got-away-with-13-million.702800

This last example illustrates that once someone begins to operate on the level as Hushpuppi, they are often most useful as someone who has the network to establish bank accounts to receive stolen funds.  It is extremely unlikely that Hushpuppi has the hacking skills to pull off a Bank of Malta attack -- however he had the reputation as being someone who could provide accounts capable of receiving 5 million Euro transactions, so criminals reach out to him to fulfill that need.