subscribe: Daily Newsletter

 

CoinVault suspects arrested

0 comments

Dutch police have arrested two men, aged 18 and 22, from Amersfoort, The Netherlands, on suspicion of involvement in CoinVault ransomware attacks.

The malware campaign started in May 2014 and continued this year, targeting users in more than 20 countries. Kaspersky Lab contributed important research to the investigation which assisted the National High Tech Crime Unit (NHTCU) of the Dutch Police in locating and identifying the alleged attackers. Panda Security also contributed to the investigation by pointing towards several samples of the malware.

CoinVault’s cybercriminals tried to infect tens of thousands of computers worldwide with the majority of victims in the Netherlands, Germany, the US, France and the UK. They succeeded in locking at least 1 500 Windows-based machines, demanding bitcoins from users to decrypt files.

The cybercriminals responsible for the ransomware campaign have been trying to modify their creations several times to keep on targeting new victims. Kaspersky Lab’s initial report on CoinVault was issued in November 2014, after the first sample of the malicious program appeared on the radar. The campaign then stopped until April 2015, when a new sample was detected. In the same month, Kaspersky Lab and the National High Tech Crime Unit (NHTCU) of the Dutch police launched noransom.kaspersky.com, a repository of decryption keys. In addition, a decryption application was made available online. This gave CoinVault victims a chance to retrieve their data without paying the criminals.

Kaspersky Lab was then contacted by Panda Security, which had found information about additional malware samples. Investigation of these samples by Kaspersky Lab revealed them to be related to CoinVault. A thorough analysis of all the associated malware samples was then completed and given to the Dutch Police.

“The Dutch police cooperates frequently with private parties. In this investigation Kaspersky Lab played an important role which helped us in identifying and locating the Coinvault attackers. It shows that by working together we can catch more criminals,” says Thomas Aling from the Dutch Police.

“In April 2015 a new sample was spotted in the wild,” explains Jornt van der Wiel, security researcher at Kaspersky Lab. ” Interestingly, the sample had flawless Dutch phrases throughout the binary. Dutch is a relatively difficult language to write without any mistakes, so we suspected from the beginning of our research that there was a Dutch connection to the alleged malware authors. This later turned out to be the case. Winning the battle against CoinVault has been a joint effort between law enforcement and private companies, and we have achieved a great result: the apprehension of two suspects.”