This article is from the source 'guardian' and was first published or seen on . It last changed over 40 days ago and won't be checked again for changes.

You can find the current article at its original source at http://www.guardian.co.uk/technology/2013/feb/13/malware-cybergang-broken-spanish-police

The article has changed 2 times. There is an RSS feed of changes available.

Version 0 Version 1
Russian-led cybergang broken by police Russian-led cybergang broken by police
(7 months later)
Spanish police have broken up a gang of cybercriminals whose "ransomware" virus demanded money from thousands of users in 30 countries by pretending to be a message from the police.Spanish police have broken up a gang of cybercriminals whose "ransomware" virus demanded money from thousands of users in 30 countries by pretending to be a message from the police.
The 11-strong gang laundered more than a million euros per year since mid-2011, sending money back to Russia. The leader, a 27-year-old Russian, was arrested while on holiday in Dubai in the United Arab Emirates in December on an international arrest warrant. Spain is seeking his extradition. On Wednesday the rest of the group – six Russians, two Ukrainians and two Georgians – were rounded up by Spanish police in the Costa del Sol.The 11-strong gang laundered more than a million euros per year since mid-2011, sending money back to Russia. The leader, a 27-year-old Russian, was arrested while on holiday in Dubai in the United Arab Emirates in December on an international arrest warrant. Spain is seeking his extradition. On Wednesday the rest of the group – six Russians, two Ukrainians and two Georgians – were rounded up by Spanish police in the Costa del Sol.
The arrests point to the growing cooperation between private organisations with hi-tech expertise in identifying the source of some of the commercial "malware" used to infect computers and steal data or persuade people to hand over money, and police organisations in multiple countries which have insufficient time or resources to perform that analysis themselves. The latest arrests were helped by the security company Trend Micro, but in other cases Microsoft and the security companies Symantec and F-Secure have played major roles in pointing to the locations of criminal gangs.The arrests point to the growing cooperation between private organisations with hi-tech expertise in identifying the source of some of the commercial "malware" used to infect computers and steal data or persuade people to hand over money, and police organisations in multiple countries which have insufficient time or resources to perform that analysis themselves. The latest arrests were helped by the security company Trend Micro, but in other cases Microsoft and the security companies Symantec and F-Secure have played major roles in pointing to the locations of criminal gangs.
The "Ransomware" virus would freeze Windows PCs and then display messages on the screen claiming to be from police authorities, including Europol, which said that the user had been fined €100 for accessing file sharing, child pornography or terrorist sites. Researchers from security company Trend Micro, who were pivotal in tracking down the origin of the software, said there were 48 different variations of the virus in use.The "Ransomware" virus would freeze Windows PCs and then display messages on the screen claiming to be from police authorities, including Europol, which said that the user had been fined €100 for accessing file sharing, child pornography or terrorist sites. Researchers from security company Trend Micro, who were pivotal in tracking down the origin of the software, said there were 48 different variations of the virus in use.
Early versions of the software were first seen in Russia in 2005, but the gang refined it so that it would display appropriate logos for the police in which country the user's PC was being used.Early versions of the software were first seen in Russia in 2005, but the gang refined it so that it would display appropriate logos for the police in which country the user's PC was being used.
Europol director Rob Wainwright – whose name was used in the scam – estimated that "hundreds of thousands" of European had been affected by the scam. "If we take into account that the average fine was €100 ($130) and 3% … paid it, then the estimated damage is millions of euros," he said.Europol director Rob Wainwright – whose name was used in the scam – estimated that "hundreds of thousands" of European had been affected by the scam. "If we take into account that the average fine was €100 ($130) and 3% … paid it, then the estimated damage is millions of euros," he said.
Spanish police said in a statement that since first discovering the virus in May 2011 they had received 1,200 complaints – but that the number affected was "certainly much higher".Spanish police said in a statement that since first discovering the virus in May 2011 they had received 1,200 complaints – but that the number affected was "certainly much higher".
The 10 men arrested on Wednesday were used for the money laundering, while the 27-year-old was behind the virus's design. The money laundering system involved a system known as PaySafeCard/UKash vouchers, to which the "ransom" was paid, and which was then sent from the US to the gang in Spain, where they converted it into ready cash and wired the money to Russia.The 10 men arrested on Wednesday were used for the money laundering, while the 27-year-old was behind the virus's design. The money laundering system involved a system known as PaySafeCard/UKash vouchers, to which the "ransom" was paid, and which was then sent from the US to the gang in Spain, where they converted it into ready cash and wired the money to Russia.
Trend Micro said: "This coordinated activity – in much the same way as the Trend Micro/FBI action against the DNS Changer gang in 2011 – leading directly to the arrest of individuals believed to be actively engaged in cybercrime, rather than simply taking down associated infrastructure, should serve as a model for how the security industry and law enforcement can effectively cooperate int he fight against online crime."Trend Micro said: "This coordinated activity – in much the same way as the Trend Micro/FBI action against the DNS Changer gang in 2011 – leading directly to the arrest of individuals believed to be actively engaged in cybercrime, rather than simply taking down associated infrastructure, should serve as a model for how the security industry and law enforcement can effectively cooperate int he fight against online crime."
Our editors' picks for the day's top news and commentary delivered to your inbox each morning.