Russian law enforcement with the assistance of Group-IB, an international company specializing in the prevention of cyberattacks and the development of information security products, detained two cybercriminals who were breaking into and stealing the accounts of loyalty program members from popular online stores, payment systems and bookmakers. In total, about 700,000 accounts were compromised, 2,000 of which the hackers put up for sale for $5 each. The detainees admitted on the spot that they had earned at least 500,000 rubles. However, the real amount of damage remains to be determined.
The investigation began in November 2015, after a large-scale cyberattack was made on the website of a large online store to gain access to the personal accounts of the store’s loyalty program members, who received bonuses for purchases. In a month, about 120,000 accounts were compromised.
It was discovered that the attackers had collected compromised account information from various Internet services on hacker forums and used special programs to automatically guess passwords of accounts on the website of the online store.
The cybercriminals took advantage of the fact that many users of the website use the same login/password pair on several resources. If the logins and passwords came up on the website of the store under attack, they hacked those personal accounts. The hackers checked the amount of the accumulated bonuses and sold the compromised accounts on hacker forums at a price of $5 per account or 20-30% of the nominal balance of the accounts. The buyers then used them to pay for products with the bonuses.
It was quickly revealed that the hackers were engaged in more than selling compromised accounts. They also offered services for «hijacking» accounts—changing the phone number and e-mail on the accounts of the online store. The cost of that «service» was 10% of the bonus balance on the account.
To cover their tracks and hamper the companies’ security services, the hackers launched their attacks from different IP-addresses, using anonymizers and changing the digital fingerprint of the browser (User-Agent). In all, requests for authorization came from more than 35,000 unique IP addresses.
After large retailers began to check all orders with payment bonuses carefully in early 2016, the hackers switched to other lesser-known online stores. In addition, the hackers began to work on tips—information about new online stores with bonus programs and coupon services where it was possible to access personal accounts, for which the attackers promised to pay up to 50% of the amount received from the further sale of the compromised accounts.
In the course of the investigation, Group-IB specialists established the identities of the intruders. The leader of the group was a resident of Ryazan Region, born in 1998, and his partner, who provided technical support for their joint online store, resided in Astrakhan Region and was born in 1997. In May 2018, both were detained by the local law enforcement. During a search, evidence of their unlawful activities was seized, along with narcotics. The detainees were charged under part 2 of article 272 («Illegal Accessing of Computer Information ») and article 228 («Illegal Acquisition, Storage, Transportation, … of Narcotic Drugs ») of the Criminal Code of the Russian Federation. The suspects have confessed. The investigation is continuing.
