Group in New York Arrested in Alleged ATM Cybercrime

Updated May 9, 2013, 7:26 p.m. ET.

Group in New York Arrested in Alleged ATM Cybercrime .

By CHAD BRAY
Jose Familia Reyes allegedly withdrew so much money illegally from ATMs that he needed a backpack.

He carried it from automated-teller machines on Manhattan's Upper West Side to ATMs in the Chelsea neighborhood, and it grew heavier and heavier as he filled it with $20 bills, according to prosecutors. His alleged withdrawals were part of a theft that drained New York City ATMs of about $2.4 million in just 24 hours in February, making it the second-largest cash heist of any kind in the city's history.

Federal prosecutors in Brooklyn, N.Y., filed charges Thursday against Mr. Reyes and seven others, accusing them of taking part in a high-tech scheme to steal money from multiple ATMs simultaneously, using stolen prepaid debit-card numbers. The eight were part of a wider plot to steal tens of millions of dollars from locations across the globe, prosecutors allege.

The people charged mostly lived around Yonkers, N.Y., a city 2 miles north of Manhattan, but were members of a larger group that spanned five continents, prosecutors allege. Two cyberattacks in December and February involved ATM withdrawals in more than 20 countries, with one attack consisting of 36,000 ATM transactions over a 10-hour period, prosecutors said.

Lawyers for Mr. Reyes and the other people charged couldn't be located for comment Thursday.

No individual bank accounts were compromised as part of the alleged scheme. To carry out the theft, the cybercrime group allegedly hacked into computer networks for processors of prepaid debit cards provided by the National Bank of Ras Al-Khaimah PSC in the United Arab Emirates and the Bank of Muscat in Oman, prosecutors said. The cybercriminals sharply increased the available balances for those cards and eliminated withdrawal limits on the cards, prosecutors said.

When it came time to withdraw the money, they would text or email PINs for the stolen cards to confederates around the world, who would execute coordinated ATM transactions at the same time, prosecutors said. In one instance, they allegedly used 12 stolen prepaid debit account numbers to withdraw about $40 million.

The cybercriminals would monitor the withdrawals in real-time from within the credit-card processing firms' computer networks, prosecutors said.

In order to conceal the proceeds, the money often was used to purchase luxury goods, such as automobiles and expensive watches, said prosecutors, who have seized tens of thousands of dollars in cash, Rolex watches and a Mercedes G63 AMG and are in the process of seizing a Porsche Panamera.

"This was indeed the largest theft of this type that we have yet seen," said Loretta Lynch, the U.S. Attorney in Brooklyn, N.Y. "This was a 21st century bank heist that reached through the Internet to span the globe. But, instead of guns and masks, this cybercrime organization used laptops and malware."

Citing the continuing investigation, Ms. Lynch declined to say where the organizers of the world-wide scheme are believed to be. She said they were looking into individuals in Asia and Europe.

The money was split between the "cashing crews" who made the withdrawals and the organizers of the scheme, prosecutors said. The cashing crews kept about 20% of the stolen money, prosecutors said.

The New York City theft ranked behind the theft of $5 million from John F. Kennedy International Airport after the money had arrived on a Lufthansa flight in 1978.

Seven people living in the Yonkers area were arrested and allegedly were part of a New York cell of the organization, according to prosecutors.

An eighth person was charged but is believed to have been murdered in the Dominican Republic in April, according to prosecutors.

In addition to Mr. Reyes, 24 years old, the other people arrested are: Jael Mejia Collado, 23; Joan Luis Minier Lara, 22; Evan Jose Pena, 35; Elvis Rafael Rodriguez, 24; Emir Yasser Yeje, 24; and Chung Yu-Holguin, 22. Alberto Yusi Lajud-Pena, the alleged leader of the New York cell, is believed to be dead.

The charges include money laundering and conspiracy to commit access device fraud. Each person faces 10 years in prison on the money-laundering charges.

Write to Chad Bray at chad.bray@wsj.com

http://online.wsj.com/article/SB1000...453678074.html

I.C.E. News Release

May 9, 2013
New York, NY

8 members of New York cell of cybercrime organization indicted in $45 million cybercrime campaign

NEW YORK — A four-count federal indictment was unsealed in Brooklyn May 9 charging eight defendants with participating in two worldwide cyberattacks that inflicted $45 million in losses on the global financial system in a matter of hours. The indictment is the result of an extensive investigation led by the U.S. Secret Service (USSS) and U.S. Immigration and Customs Enforcement's (ICE) Homeland Security Investigations (HSI).

These defendants allegedly formed the New York-based cell of an international cybercrime organization that used sophisticated intrusion techniques to hack into the systems of global financial institutions, steal prepaid debit card data, and eliminate withdrawal limits. The stolen card data was then disseminated worldwide and used in making fraudulent ATM withdrawals on a massive scale across the globe. The eight indicted defendants and their co-conspirators targeted New York City and withdrew approximately $2.8 million in a matter of hours. The defendants are charged variously with conspiracy to commit access device fraud, money laundering conspiracy and money laundering.

Seven of the eight defendants have been arrested on the charges in the indictment. The arrested defendants are: Jael Mejia Collado, Joan Luis Minier Lara, Evan Jose Peña, Jose Familia Reyes, Elvis Rafael Rodriguez, Emir Yasser Yeje and Chung Yu-Holguin, all residents of Yonkers, N.Y.

Rodriguez was arrested on a criminal complaint March 27 when he attempted to flee the United States for the Dominican Republic. Peña was arrested on a criminal complaint in Yonkers April 3. Lara, Reyes, and Yeje surrendered to law enforcement authorities April 15. Collado and Yu-Holguin were arrested the afternoon of May 8.

The indictment also charges an eighth defendant, Alberto Yusi Lajud-Peña, aka Prime and Albertico. Lajud-Peña is reported to have been murdered April 27 in the Dominican Republic.

"The arrests today reflect the government's joint efforts to bring a global cybercrime enterprise to justice," said James T. Hayes Jr., special agent in charge of HSI New York. "HSI is proud to be part of a proactive federal law enforcement initiative that uses its collective resources to pull the plug on those who attempt to use the Internet to commit bank robbery."

"New technologies and the rapid growth of the Internet have eliminated the traditional borders of financial crimes and provided new opportunities for the criminal element to threaten the world's financial systems," said Steven Hughes, special agent in charge of the USSS New York Field Office. "However, as demonstrated by the charges and arrests announced today, the Secret Service and its law enforcement partners have adapted to these technological advancements and utilized cutting edge investigative techniques to thwart this cybercriminal activity. I want to take this opportunity to commend the dedicated men and women of the Secret Service and HSI for their extraordinary efforts in this investigation. This case is an excellent example of the impact that can be made when the law enforcement community works together."

"As charged in the indictment, the defendants and their co-conspirators participated in a massive 21st century bank heist that reached across the Internet and stretched around the globe," said U.S. Attorney Loretta E. Lynch, Eastern District of New York. "In the place of guns and masks, this cybercrime organization used laptops and the Internet. Moving as swiftly as data over the Internet, the organization worked its way from the computer systems of international corporations to the streets of New York City, with the defendants fanning out across Manhattan to steal millions of dollars from hundreds of ATMs in a matter of hours. Law enforcement is committed to moving just as swiftly to solve these cybercrimes and bring their perpetrators to justice."

The 'Unlimited Operation'

As alleged in the indictment and other court filings, the cyberattacks employed by the defendants and their co-conspirators in this case are known in the cyber underworld as Unlimited Operations – through its hacking 'operation,' the cybercrime organization can access virtually 'unlimited' criminal proceeds.

The Unlimited Operation begins when the cybercrime organization hacks into the computer systems of a credit card processor, compromises prepaid debit card accounts and essentially eliminates the withdrawal limits and account balances of those accounts.

The elimination of withdrawal limits enables the participants to withdraw literally unlimited amounts of cash until the operation is shut down. Unlimited Operations are marked by three key characteristics:
The surgical precision of the hackers carrying out the cyberattack;
The global nature of the cybercrime organization; and
The speed and coordination with which the organization executes its operations on the ground.

These attacks rely upon both highly sophisticated hackers and organized criminal cells whose role is to withdraw the cash as quickly as possible. As alleged in court filings, Unlimited Operations are executed in the following manner:
First, over the course of months, the hackers plan and execute sophisticated cyber intrusions to gain unauthorized access to the computer networks of credit card processors that are responsible for processing prepaid debit card transactions. They target databases of prepaid debit cards, which are typically loaded with finite funds – such cards are used by many employers in lieu of paychecks and by charitable organizations to distribute disaster assistance. The cybercriminals breach the debit card accounts' security protocols, then dramatically increase the balances and effectively eliminate the withdrawal limits on the accounts. The elimination of withdrawal limits enables the participants to withdraw unlimited amounts of cash until the operation is shut down.
Next, the cybercrime organization cashes in, by distributing the hacked prepaid debit card numbers to trusted associates around the world – the two cyberattacks charged in this case allegedly involved 26 countries. These associates operate cells or teams of cashers, who encode magnetic stripe cards – such as gift cards – with the compromised card data. When the cybercrime organization distributes the personal identification numbers (PINs) for the hacked accounts, the casher cells spring into action, immediately withdrawing cash from ATMs across the globe. Meanwhile, the cybercrime organization maintains access to the computer networks of the credit card processors they have hacked in order to monitor the withdrawals. At the end of an operation – when the cards are finally shut down – the casher cells launder the proceeds, often investing the operation's proceeds in luxury goods, and kick money back up to the cybercrime organization's leaders.

The charged 'Unlimited Operation' cyberattacks

According to the government's filings, between approximately October 2012 and April 2013, the defendants and their co-conspirators conducted two Unlimited Operations. The first operation Dec. 22, 2012, targeted a credit card processor that processed transactions for prepaid MasterCard debit cards issued by the National Bank of Ras Al-Khaimah PSC, also known as Rakbank, in the United Arab Emirates.

After the hackers penetrated the credit card processor's computer network, compromised the Rakbank prepaid card accounts, and manipulated the balances and withdrawal limits, casher cells across the globe operated a coordinated ATM withdrawal campaign.

In total, more than 4,500 ATM transactions were conducted in approximately 20 countries around the world using the compromised Rakbank account data, resulting in approximately $5 million in losses to the credit card processor and Rakbank. In the New York City area alone, over the course of just two hours and 25 minutes, the defendants and their co-conspirators conducted approximately 750 fraudulent transactions, totaling nearly $400,000 at over 140 different ATM locations throughout the city.

As alleged in the indictment and other court filings, the second of these Unlimited Operations occurred on the afternoon of Feb. 19 and lasted into the early morning of Feb. 20. This operation again breached the network of a credit card processor that serviced MasterCard prepaid debit cards, this time issued by the Bank of Muscat, located in Oman. Again, after the cybercrime organization's hackers compromised Bank of Muscat prepaid debit card accounts and distributed the data, the organization's casher cells engaged in a worldwide ATM withdrawal campaign. This attack was particularly devastating: Over the course of approximately 10 hours, casher cells in 24 countries executed approximately 36,000 transactions worldwide and withdrew about $40 million from ATMs. From 3 p.m. Feb. 19 through 1:26 a.m. Feb. 20, the defendants and their co-conspirators withdrew approximately $2.4 million in nearly 3,000 ATM withdrawals in the New York City area.

As charged in the indictment and other filings, Lajud-Peña was the leader of the New York cell of this organization. In the wake of the charged Unlimited Operations, he and defendants Rodriguez and Yeje laundered hundreds of thousands of dollars in illicit cash proceeds. In one transaction alone, nearly $150,000 – in the form of 7,491 $20 bills – was deposited at a bank branch in Miami into an account controlled by Lajud-Peña.

Cell members also invested the criminal proceeds in portable luxury goods, such as expensive watches and cars. To date, the U.S. government has seized hundreds of thousands of dollars in cash and bank accounts, two Rolex watches and a Mercedes SUV, and is in the process of forfeiting a Porsche Panamera. The Mercedes and Porsche were purchased with $250,000 in proceeds of this scheme.

In announcing the charges, U.S. Attorney Lynch praised the extraordinary efforts of the Secret Service in responding so rapidly to these attacks and investigating both the complex network intrusions that occurred overseas and the criminal activity occurring locally. Ms. Lynch also thanked HSI for its invaluable role in recent arrest and seizure operations, as well as MasterCard, Rakbank and the Bank of Muscat for their cooperation with this investigation.

U.S. Attorney Lynch expressed gratitude for the timely and extensive assistance of law enforcement authorities in Japan, Canada, Germany and Romania. She also thanked authorities in the United Arab Emirates, Dominican Republic, Mexico, Italy, Spain, Belgium, France, United Kingdom, Latvia, Estonia, Thailand and Malaysia for their cooperation in this investigation.

If convicted, the defendants face a maximum sentence of 120 months in federal prison on each of the money laundering charges. They also face up to 90 months on the conspiracy to commit access device fraud charge, restitution and up to $250,000 in fines.

In addition, all property involved in the money laundering offenses and all proceeds of the conspiracy to commit access device fraud are subject to forfeiture.

The government's case is being prosecuted by Assistant United States Attorneys Cristina M. Posa, Hilary Jager, Brian Morris and Kevin Trowel, all of the Eastern District of New York.

U.S. Immigration and Customs Enforcement (ICE) is the largest investigative arm of the Department of Homeland Security.

ICE is a 21st century law enforcement agency with broad responsibilities for a number of key homeland security priorities. For more information, visit www.ICE.gov. To report suspicious activity, call 1-866-347-2423 or complete our tip form.

http://www.ice.gov/news/releases/1305/130509newyork.htm

Germany arrests two Dutch suspected of cyber crime bank heist

ReutersReuters – 3 hrs ago...

FRANKFURT (Reuters) - German prosecutors said on Friday they had arrested two Dutch people suspected of involvement in a global cyber theft of $45 million from two Middle Eastern banks.

On Thursday U.S. prosecutors said a criminal gang had withdrawn the money from cash machines in 27 countries.

The Duesseldorf prosecutor's office said a 35-year-old male and a 56-year-old woman had been caught on February 19 withdrawing 170,000 euros in Duesseldorf using Bank of Muscat credit cards. In total, $2.4 million dollars had been withdrawn in seven German cities.

"We have arrested two Dutch people in Germany who apparently took part in this crime," a spokesman for the office said.

He added the two had come to Duesseldorf with the purpose of withdrawing the money in Germany. The two suspects are accused of computer fraud and faking credit cards.

Germany's BdB banking association said it was not aware of any banks in Germany suffering losses as a result of the scheme.

The hackers increased the available balance and withdrawal limits on prepaid MasterCard debit cards issued by Bank of Muscat of Oman, and National Bank of Ras Al Khaimah PSC (RAKBANK) of the United Arab Emirates, according to the complaint by U.S. prosecutors.

They then distributed counterfeit debit cards to "cashers" around the world, enabling them to siphon millions of dollars from cash machines in a matter of hours.

http://news.yahoo.com/germany-arrest...09mZg--;_ylv=3