U.S. Announces Charges Against 2 Russian and 2 Iranian Hackers

Immediately after revealing criminal charges against 5 Chinese and 2
Malaysian hackers^[1], the United States
government yesterday also made two separate announcements charging
two Iranian and two Russian hackers and added them to the FBI’s
most-wanted list.

The two Russian nationals—Danil Potekhin and Dmitrii
Karasavidi—are accused of stealing $16.8 million worth of
cryptocurrencies in a series of phishing attacks throughout 2017
and 2018.

“This tactic used a combination of phishing and spoofing to
exploit Internet users’ trust in known companies and organizations
to fraudulently obtain their login credentials, including email
addresses, password information, and other personal information,”
the DoJ said^[2].

In addition to the criminal charges, the U.S. Department of the
Treasury has also sanctioned both Russian hackers^[3], freezing all their
assets under U.S. jurisdiction and banning them from doing business
with Americans.

“Karasavidi laundered the proceeds of the attacks into an
account in his name. He attempted to conceal the nature and source
of the funds by transferring them in a layered and sophisticated
manner through multiple accounts and multiple virtual currency
blockchains. Ultimately, the stolen virtual currency was traced to
Karasavidi’s account, and millions of dollars in virtual currency
and U.S. dollars was seized in a forfeiture action by the United
States Secret Service,” the U.S. Department of the Treasury
explained.

Whereas, both two Iranian nationals—Mehdi Farhadi and Hooman
Heidarian—are allegedly involved in government-linked hacking
operations and have stolen hundreds of terabytes of sensitive data
from several targeted organizations.

According to an indictment unsealed^[4]
by the Justice Department, since 2013, Iranian hackers have
targeted several American and foreign universities, think tanks,
defense contractors, aerospace companies, foreign policy
organizations, NGOs, and foreign governments.

“In some instances, the defendants’ [Iranian] hacks were
politically motivated or at the behest of Iran, including instances
where they obtained information regarding dissidents, human rights
activists, and opposition leaders,” the indictment^[5]
says.

“In other instances, the defendants sold the hacked data and
information on the black market for private financial gain.”

After selecting their victims using online reconnaissance and
publicly available data, the hackers run vulnerability scanning
tools and other means to assess computer networks remotely.

“The defendants gained and maintained unauthorized access to
victim networks using various tools, including session hijacking,
SQL injection, and malicious programs.”

“The defendants then used key-loggers and “remote access
Trojans” to maintain access and monitor the actions of users of the
victim networks.”

All four hackers remain at large, likely in their respective
countries, and have been charged with several counts of conspiracy
to commit fraud, unauthorized access, wire fraud, identity theft,
and related activity in connection with computers