Kaspersky Lab experts and Sberbank, one of Russia’s largest banks, worked closely with Russian law enforcement agencies to investigate the Lurk gang, culminating in the arrest of 50 people.
Those detained are suspected of involvement in the creation of infected computers networks that resulted in the theft of more than $45-million (3-billion rubles) from banks, other financial institutions and businesses since 2011.
This is the largest-ever arrest of hackers to have taken place in Russia.
In 2011, Kaspersky Lab detected the activity of an organised cybercriminal gang using the Lurk Trojan – a sophisticated, universal and multi-modular malware with wide functionality – to gain access to victims’ computers.
In particular, the gang was looking for a way into remote banking services so that it could steal money from customer accounts.
“From the very start, Kaspersky Lab experts were involved in the law enforcement investigation into Lurk. We realised early on that Lurk was a group of Russian hackers that presented a serious threat to organisations and users. Lurk started attacking banks one-and-a-half years ago; before then its malicious programme targeted various enterprise and consumer systems.
“Our company’s experts analysed the malicious software and identified the hacker’s network of computers and servers. Armed with that knowledge the Russian Police could identify suspects and gather evidence of the crimes that had been committed. We look forward to helping to bring more cybercriminals to justice,” says Ruslan Stoyanov, head of computer incidents investigation at Kaspersky Lab.
During the arrest the Russian police managed to prevent the transmission of fake money transactions worth more than $30-million (2,273-billion rubles).
In order to propagate the malware, the Lurk group infected a range of legitimate websites with exploits, including leading media and news sites. A victim simply had to visit a compromised webpage to become infected with the Lurk Trojan.
Once inside the victim’s PC, the malware would start to download additional malicious modules that enabled it to steal the victim’s money.
Media websites were not the only non-financial target of the group. In order to hide their traces behind VPN-connection, the criminals also hacked into various IT and telecom companies, using their servers to remain anonymous.
The Lurk Trojan is distinctive in that its malicious code is not stored on the victims’ computer but in the random access memory (RAM). Also, its developers tried to make it as difficult as possible for anti-virus solutions to detect the Trojan. So they made use of different VPN-services, the anonymous Tor network, compromised WiFi connection points and servers belonging to the attacked IT organisations.
Russian Lurk gang behind bars
