Fed Cyber Sleuths Stop 'Gameover Zeus' and 'Cryptolocker' Crime Sprees

June 2, 2014— -- The Justice Department has disrupted what it calls one of the most sophisticated cyber threats ever, and they are now trying to capture the man behind it all, federal prosecutors announced today.

Over the weekend, federal cyber cops essentially paralyzed a massive computer virus known as “Gameover Zeus,” which diverted millions of dollars from companies’ bank accounts, and blocked another virus known as “Cryptolocker,” which first took control of a user’s computer files and then demanded ransom in return for the user’s own files, according to federal prosecutors. Both viruses were the work of an overseas criminal gang allegedly run by Russian hacker Evgeniy Bogachev, who is now among the FBI’s most-wanted cyber criminals.

“Evgeniy Bogachev and the members of his criminal network devised and implemented the kind of cyber-crimes that you might not believe if you saw them in a science fiction movie,” the head of the Justice Department’s Criminal Division, Leslie Caldwell, told reporters in Washington. “By secretly implanting viruses on computers around the world, they built a network of infected machines – or ‘bots’ – that they could infiltrate, spy on, and even control, from anywhere they wished.”

Starting in 2011, Bogachev, 30, allegedly used “spear-fishing” – or fake – emails to infect computers with the “Gameover Zeus” virus. Once infected, Bogachev would “hijack computer sessions and steal confidential and personal financial information” that could then be used to funnel money overseas, the according to U.S. Attorney for the Western District of Pennsylvania David Hickton.

In October 2011, a Pennsylvania composite materials company was hit, and “within a matter of hours after banking credentials were compromised, hundreds of thousands of dollars were being siphoned from the company’s bank accounts,” Hickton said.

More than two years later, in November last year, the police department in Swansea, Mass., became a victim of the “Cryptolocker” virus when an employee opened an email that looked like it was from a “trusted source,” Hickton said. When “Cryptolocker” strikes, a timer often appears on victims’ computer screens, giving them 72 hours to pay hundreds of dollars if they want their files back – from family photos to business records, law enforcement officials said.

In the case of the Swansea police department, the department paid the ransom and contacted the FBI, according to law enforcement officials.

As of April 2014, “Cryptolocker” had attacked more than 200,000 computers, and more than half of those attacks occurred in the United States, Deputy Attorney General Jim Cole said. In addition, in its first two months of operation alone, the criminals behind “Cryptolocker” collected an estimated $27 million in ransom payments from victims, he said.

As for the “Gameover Zeus” virus, security researched estimate that between 500,000 and 1 million computers around the world have been infected with it, and a quarter of the victims are inside the United States, according to Cole. In total, federal authorities believe U.S. victims, often small and mid-size businesses, have lost more than $100 million to “Gameover Zeus.”

Federal authorities believe the man running the Eastern European criminal gang responsible for the two viruses is now in Russia, and they are hoping the Russian government will help bring him to justice.

The Justice Department unsealed criminal charges in Pittsburgh, Pa., and in Omaha, Neb., charging Bogachev with computer hacking, wire fraud, bank fraud, money laundering and other violations of U.S. law.

To keep “Gameover Zeus” from being reconstituted, federal authorities have obtained court approval to redirect communications from “malicious servers” to substitute servers, and both U.S. and foreign law enforcement officials seized computer servers integral to “Cryptolocker,” authorities said today.