Four cybercriminals that used a sophisticated Trojan horse program to siphon money out of online bank accounts and send it to Eastern European countries and Russia have been handed prision sentances.
Azamat Rahmonov and Shohruh Fayziev both from Uzbekistan, along with Joao Dos Santos Cruz of Angola and Paolo Jorgi from Portugal, were givenm sentences ranging from 21 months to four and a half years for their parts in the crimes. A fifth person, Edgar Orlando Henriques of Venezuela, is still at large.
The case marks the first collaboration between the financial industry and the Police Central e-Crime Unit (PCeU), which was established earlier this year after accusations the government wasn't doing enough about cybercrime.
The men used a Trojan horse program called PSP2-BBB that executed a so-called man-in-the-browser attack when potential victims logged into online bank accounts.
The Trojan would insert a special page within the customer's browsing session asking for more personal information, according to police. The Trojan would then set up a transfer to another account, according to police.
The security company RSA cited an increasingly number of attacks in the UK using PSP2-BBB in a report released last month about online fraud.
In such attacks, the money would be transferred later in the day to a 'dump' account, or one belonging to a money mule. A mule is someone who has either been deceived into receiving illegal funds or knowingly agrees to accept the money in their own account.
Typically, the mule withdraws the money, takes a small cut as a fee and transfers the rest using a service such as Western Union. In this case, most of the money went to Russia or other places in Eastern Europe, according to the PCeU.
Multiple financial institutions were attacked and "hundreds of thousands" of pounds were stolen, said Richard Jones, spokesman for the Specialist Crime Directorate of the Metropolitan Police Service, under which the PCeU falls. The exact cost of the fraud hasn't been released.
For the first time, the PCeU worked closely with financial institutions and other entities such as ISPs, Jones said. Without their co-operation, "you can only get so far", Jones said.
In April, more than 50 officers raided several addresses in southeast London to pursue the gang, which originated in Eastern Europe, police said.
The convictions come as the efforts to fight online crime and fraud are being stepped up. The PCeU will receive about £7m in funding over the next three years from the Home Office and Metropolitan Police, a figure police officials have said isn't enough. The National Fraud Reporting Center that will comprehensively track all forms of e-crime and fraud is also in development.
The police have their work cut out for them. According to figures released last month, online banking fraud increased 55 percent to £39m for the first half of this year compared to the same period a year ago, according to Financial Fraud Action UK (FFA), which collects data reported by financial institutions. FFA blamed an increase in sophisticated malicious software programs.