Android banking malware suspects arrested by Russian police

Two accused of account fraud

Police in Russia have reportedly arrested two cybercriminals accused of being behind an Android malware campaign that lifted funds from bank accounts used to top up smartphones.

News of the arrests comes from a blog post by Russian security firm Group-IB, which said it had aided Russian bank Sberbank, which first detected the fraud against its customers in late 2013.

According to the firm, two men in their twenties were earlier this year arrested in the city of Archangel by officers from the Russian Ministry of Internal Affairs. One suspect was placed under house arrest while the other was detained for two months, it said.

The attack seems to have been a variant on a common Russian scam in which the criminals send spam SMS messages promising a 'romantic gift' to mobiles with an embedded link that downloads a Trojan.

Normally in this type of scam the malware would simply send multiple premium-rate texts but the campaign described by Group-IB seems to have "recharged" the mobile from the linked bank account before attempting to transfer the money to other accounts or payment systems.

"At a request by Sberbank, Group-IB provided support to the investigations in all the stages. Our security incident response center CERT-GIB closely monitored and promptly blocked new malicious resources," said Group-IB CEO Ilya Sachkov.

"Computer hardware seized from the criminals during the arrest was sent to Group-IB's forensic lab for investigation and additional evidence."

The ringleader - nickname 'ItBill' or 'tripfon' - had started developing mobile malware in 2010, eventually building a mobile botnet, he added.

Despite the perception that the Russian authorities turn a blind eye to cybercrime, arrests are relatively common in the country, especially for suspects accused of attacking fellow Russians.

Police recently arrested two people apparently accused of being connected to the 'Oleg Pliss' attack on Apple iCloud accounts earlier this year. In October last year the hacker behind the infamous Blackhole Exploit Kit was also picked up by police, fate still unknown.

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Follow our new CSO Australia LinkedIn
Follow our new social and we'll keep you in the loop for exclusive events and all things security!
Have an opinion on security? Want to have your articles published on CSO? Please contact CSO Content Manager for our guidelines.

Tags mobilePersonal TechGroup-IB

More about ApplemobilesNews

Show Comments

Featured Whitepapers

Editor's Recommendations

Brand Page

Stories by John E. Dunn

Latest Videos

More videos

Blog Posts