37 'Money Mules' Arrested

21 Separate Cases Tied to Global Fraud Schemes Linda McGlasson • September 30, 2010

A federal crackdown on automated clearing house and wire fraud has produced 37 arrests of a money mule operation, part of what law enforcement is calling a sophisticated bank fraud scheme that used malware to siphon off millions of dollars from U.S. bank accounts.

The 37 defendants are charged in 21 separate cases for their roles in the fraud schemes that reached around the world. Arrests were made in London earlier this week in a similar case related to bank account fraud using the same type of malware.

Manhattan U.S. Attorney Preet Bharara says that the cyber attacks that targeted businesses and other entities here in the U.S. began in Eastern Europe, and included the use of a malware known as the "Zeus Trojan," a type of keylogger malware that is designed to steal banking credentials.

Federal and local law enforcement officers arrested 10 of the defendants this morning. Another 10 were previously arrested. The defendants taken into custody in New York on Thursday were to appear in Manhattan federal court later this afternoon. The other 17 defendants not in custody are still being sought in the U.S. and overseas.

The Schemes

How the attacks began: The hackers, based in Eastern Europe, would send what looked like a benign email to computers at small businesses and municipalities in the United States. Once the email was opened, the malware embedded itself in the victims' computers and recorded keystrokes. The malware picked up account numbers, passwords and other vital security codes as the unsuspecting users logged into their bank accounts. The hackers responsible for the malware used the banking credentials to take over the victims' bank accounts and made fraudulent transfers of thousands of dollars at a time to receiving accounts controlled by the co-conspirators.

These receiving accounts were set up by a "money mule organization" responsible for retrieving the proceeds of the malware attacks and transporting or transferring the stolen money overseas. To carry out the scheme, Bharara says the money mule organization recruited individuals who had entered the United States on student visas, providing them with fake foreign passports, and instructed them to open false-name accounts at U.S. banks.

Once the false-name accounts were successfully opened and received the stolen funds from the accounts compromised by the malware attacks, the money mules were instructed to transfer the proceeds to other accounts overseas, or to withdraw the proceeds and transport them overseas as smuggled bulk cash. The defendants charged in Manhattan federal court include managers of and recruiters for the money mule organization, an individual who obtained the false foreign passports for the mules, as well as money mules.

The FBI released further information on the arrests and the international operation spanning two continents called "Operation Trident Breach" on Friday. The FBI says Ukranian authorities have arrested five suspects on Thursday who are thought to be "key subjects responsible for this overarching scheme."