Cybercriminal Group behind GozNym Arrested by Europol and Partners

On 16 May 2019, a press conference held by Europol confirmed the dismantling of a major cybercrime network behind the GozNym banking malware. The press release stated that the malware attempted to steal an estimated $100 Million from more than 41,000 victims, primarily businesses and their associated financial organizations. The operation conducted physical searches in Bulgaria, Georgia, Moldova and Ukraine, and prosecutions were issued in Georgia, Moldova, Ukraine and the US.

Recommendations

• Enable the Cyber Attack Chatter rule and configure it to listen for GozNym chatter, especially if operations have moved or new indicators emerge from the research community

Details

The GozNym malware has been in the news for a number of years. Google trends shows a large spike in searches for GozNym in March 2016. Victims were infected by the malware to capture banking login credentials, which were then used by the criminal network to pilfer accounts and launder the money through U.S. and foreign bank accounts. A number of specialized cybercrime tactics were involved in the operation, whether it was bulletproof hosts, mules, crypters, spammers, developers or even tech support, the scale of GozNym shows what a sophisticated group of cybercriminals can accomplish in just a few short years.