Three Carbanak cyber heist gang members arrested

Four months after the arrest of the suspected mastermind of the Carbanak cyber heist gang in Spain, three more “high-ranking” members have been arrested, according to the US Department of Justice (DoJ).

Since 2013, the cyber crime gang – also known as Fin7 and JokerStash – has attempted to attack banks, e-payment systems and financial institutions using pieces of malware they designed, known as Carbanak and Cobalt, and is linked to the theft of up to $1bn from financial institutions worldwide.

The criminal operation has targeted banks in more than 40 countries and has resulted in cumulative losses of more than €1bn for the financial industry, according to Europol, with the Cobalt malware enabling criminals to steal up to €10m per heist.

The DoJ said the latest arrests involve three Ukrainian citizens linked to the theft of credit and debit card records from restaurants, casinos and other businesses across the US, as well as in the UK, France and Australia, with losses totalling tens of millions of dollars.

Dmytro Fedorov (44), Fedir Hladyr (33) and Andrii Kolpakov (30) face 26 charges that include wire fraud, computer hacking and identity theft.

Hladyr, who was arrested in Germany in January, is in custody in Seattle, while Fedorov is being held in Poland and Kolpakov is in Spain, both awaiting extradition to the US.

The group is believed to have hacked into thousands of computer systems and stolen millions of customer credit and debit card numbers, which the group used or sold for profit through criminal marketplaces on the dark web, the DoJ said in a statement.

In many cases, the gang is believed to have used cleverly crafted emails to trick employees into activating an adapted version of the Carbanak malware and other tools to access and steal payment card data.

According to the DoJ, the group – which is still believed to be active – stole more than 15 million payment card details from more than 6,500 payment check-out points in the US alone.

“Protecting consumers and companies who use the internet to conduct business – both large chains and small “mom and pop” stores – is a top priority for all of us in the Department of Justice,” said US Attorney Annette Hayes. 

“Cyber criminals who believe that they can hide in faraway countries and operate from behind keyboards without getting caught are just plain wrong. 

“We will continue our long-standing work with partners around the world to ensure cyber criminals are identified and held to account for the harm that they do – both to our pocketbooks and our ability to rely on the cyber networks we use,” she said.

The naming of the gang leaders marks a major step towards dismantling this sophisticated criminal enterprise, said FBI special agent in charge Jay Tabb.

 “As the lead federal agency for cyber attack investigations, the FBI will continue to work with its law enforcement partners worldwide to pursue the members of this devious group, and hold them accountable for stealing from American businesses and individuals,” he said.

Hladyr’s trial is currently scheduled for 22 October. No other trial dates have been set.