Cyber Crooks Involved in Multiple Cybercriminal Attacks Identified by Trend Micro

Security firm 'Trend Micro' has published a new study on the actions of a cybercriminal gang that was involved in multiple crimes that included 419 scams, phishing scandals and attacks that relied on banking trojans like Ice IX and Zbot.

Experts claim to have identified some of the members of the group. The identified members are located in Nigeria but the security firm supposes that they are part of a bigger organization that works in other countries as well.

According to them, the cyber crooks are employing Ice IX malware, that's like Zeus Trojan, to gather email addresses, financial information and credentials of webmail account from infected computers.

Interestingly, the cybercrooks are using infected computers located in Nigeria to connect Ice IX command and control (C&C) servers.

The crew has also been using a PHP mailer spamming tool to send 419 scam emails designed to trick in addition to assaults involving trojans like Ice IX and Zeus. The cyber thugs hold multiple records of email addresses of various countries with two lists of around 553,000 email addresses from Canada and 490,000 from the US have been seen.

Some members of the gang appeared to be involved with various phishing scams besides using the Ice IX Trojan and phishing web pages assisted them in collecting PII (Personally identifiable information) of various victims.

The crooks appear to employ at least three different types of phishing pages. One type is impersonated Scottrade.com that's the website of a private firm of an American discount retail brokerage.

Second type is impersonates the popular Korean search engine site Daum.net and the third type is an online dating site Match.com.

The security firm has also managed to identify three men allegedly connected to the group.

One of them, Smith Samson or Ofeoritse Abalagbeyi (Ofe), looks after hosting, building domains for and configuring Ice IX and ZeuS C&C servers. Second one 'Peter Hollame' also uploads Zeus and Ice IX to C&C servers of the group and the third one "Peter Nzenwata" also known as Uzochukwu Nzenwata, is in charge for the Nigerian scams. All three are currently absconding.

» SPAMfighter News - 12/7/2013