Authorities in the United Kingdom on Tuesday arrested 19 individuals alleged to be connected to a massive fraud ring that has stolen tens of millions of dollars from hundreds of consumers and small to mid-sized businesses in the U.K. and the United States.
Members of the group — described as 15 men and 4 women between the ages of 23 and 47 — are thought to be part of a sophisticated, multinational computer crime operation that stole almost $10 million over a three month period and may have netted more than $30 million, according to an article in today’s Daily Mail.
Investigators say the gang plundered bank accounts with the help of the ZeuS Trojan, which steals online banking credentials, and allows the thieves to connect back through the victim’s PC and Internet connection to initiate unauthorized transfers.
The Daily Mail story has some nice photos of those arrested, but the piece is otherwise light on details. According to several of my sources who have helped with or participated in the investigation that led to this week’s arrests, the group used ZeuS to steal online banking credentials from tens of thousands of victims, but it focused on extracting money from high-dollar accounts belonging to businesses.
Sources say the UK gang is part of a larger organization that is directly responsible for most of the e-banking heists that I have been writing about for the past 14 months. These attacks targeted bank accounts belonging to schools, libraries, towns, cities, law firms, and a broad range of small to mid-sized companies and nonprofit organizations.
In nearly every case, the gang initiated large batches of bogus payroll payments from victim businesses, sending the money in sub-$10,000 chunks to money mules, unwitting or willing individuals recruited through job search sites. The mules would then withdraw the funds in cash from their banks, and wire the loot – minus a small “commission” — to additional Eastern European mules recruited by the gang.
More to come. Stay tuned.