A cybercrime mastermind who remotely instructed ATMs across Europe to dispense cash to waiting gang members has been arrested.
The criminal organisation hacked into over 100 financial institutions in 40 countries and caused cumulative losses of more than €1bn (£872m).
After infecting the financial institutions’ computer networks through spear phishing attacks against their employees, the group arranged for thousands of ATMs across Europe to dispense cash to waiting money mules.
It also used the e-payment network to directly transfer money out of the victim organisations and into criminal accounts.
In some cases, the criminals modified databases with account information to show certain bank accounts with inflated balances – with money mules again being used to collect this cash.
The leader of the organised crime group, whose has been identified as Ukrainian and is known only as Denis K, was arrested in Alicante by the Spanish national police after an international investigation coordinated by Europol.
Alongside the mastermind, the hackers who had written the two strains of malware in the attacks – known as Carbanak and Cobalt – as well as the mule networks and the money launderers, were also arrested.
The Ukrainian cyber police have released an image of a man whom they identify as being part of the international hacking group.
In a statement, the agency said that it believes it has identified all of the members of the group and they are believed to be in the territory of the Russian Federation.
Wim Mijs, chief executive of the European Banking Federation, said: “This is the first time that the EBF has actively cooperated with Europol on a specific investigation.
“It clearly goes beyond raising awareness on cybersecurity and demonstrates the value of our partnership with the cybercrime specialists at Europol.
“Public-private cooperation is essential when it comes to effectively fighting digital cross border crimes like the one that we are seeing here with the Carbanak gang.”
After taking the money, the cybercrime group converted the cash into cryptocurrencies, according to Europol.
The cryptocurrency was used to purchase assets including properties and vehicles in Spain.
Steven Wilson, the head of Europol’s European Cybercrime Centre (EC3), said: “This global operation is a significant success for international police cooperation against a top level cybercriminal organisation.
“The arrest of the key figure in this crime group illustrates that cybercriminals can no longer hide behind perceived international anonymity.
“This is another example where the close cooperation between law enforcement agencies on a worldwide scale and trusted private sector partners is having a major impact on top level cybercriminality.”