Tag: operation ghost

TOP-SECRET-International Cyber Ring That Infected Millions of Computers Dismantled

DNS Malware graphic

Operation Ghost Click
International Cyber Ring That Infected Millions of Computers Dismantled

11/09/11

Six Estonian nationals have been arrested and charged with running a sophisticated Internet fraud ring that infected millions of computers worldwide with a virus and enabled the thieves to manipulate the multi-billion-dollar Internet advertising industry. Users of infected machines were unaware that their computers had been compromised—or that the malicious software rendered their machines vulnerable to a host of other viruses.

Details of the two-year FBI investigation called Operation Ghost Click were announced today in New York when a federal indictment was unsealed. Officials also described their efforts to make sure infected users’ Internet access would not be disrupted as a result of the operation.

 FBI Statement:
Janice Fedarcyk, New York
Assistant Director in Charge Janice Fedarcyk“Today, with the flip of a switch, the FBI and our partners dismantled the Rove criminal enterprise. Thanks to the collective effort across the U.S. and in Estonia, six leaders of the criminal enterprise have been arrested and numerous servers operated by the criminal organization have been disabled. Additionally, thanks to a coordinated effort of trusted industry partners, a mitigation plan commenced today, beginning with the replacement of rogue DNS servers with clean DNS servers to keep millions online, while providing ISPs the opportunity to coordinate user remediation efforts.”

The indictment, said Janice Fedarcyk, assistant director in charge of our New York office, “describes an intricate international conspiracy conceived and carried out by sophisticated criminals.” She added, “The harm inflicted by the defendants was not merely a matter of reaping illegitimate income.”

Beginning in 2007, the cyber ring used a class of malware called DNSChanger to infect approximately 4 million computers in more than 100 countries. There were about 500,000 infections in the U.S., including computers belonging to individuals, businesses, and government agencies such as NASA. The thieves were able to manipulate Internet advertising to generate at least $14 million in illicit fees. In some cases, the malware had the additional effect of preventing users’ anti-virus software and operating systems from updating, thereby exposing infected machines to even more malicious software.

“They were organized and operating as a traditional business but profiting illegally as the result of the malware,” said one of our cyber agents who worked the case. “There was a level of complexity here that we haven’t seen before.”

DNS—Domain Name System—is a critical Internet service that converts user-friendly domain names, such as http://www.fbi.gov, into numerical addresses that allow computers to talk to each other. Without DNS and the DNS servers operated by Internet service providers, computer users would not be able to browse websites or send e-mail.

Success Through Partnerships A complex international investigation such as Operation Ghost Click could only have been successful through the strong working relationships between law enforcement, private industry, and our international partners.

Announcing today’s arrests, Preet Bharara, (above left) U.S. Attorney for the Southern District of New York, praised the investigative work of the FBI, NASA’s Office of Inspector General (OIG), the Estonian Police and Border Guard Board, and he specially thanked the National High Tech Crime Unit of the Dutch National Police Agency. In addition, the FBI and NASA-OIG received assistance from multiple domestic and international private sector partners, including Georgia Tech University, Internet Systems Consortium, Mandiant, National Cyber-Forensics and Training Alliance, Neustar, Spamhaus, Team Cymru, Trend Micro, University of Alabama at Birmingham, and members of an ad hoc group of subject matter experts known as the DNS Changer Working Group (DCWG).

DNSChanger was used to redirect unsuspecting users to rogue servers controlled by the cyber thieves, allowing them to manipulate users’ web activity. When users of infected computers clicked on the link for the official website of iTunes, for example, they were instead taken to a website for a business unaffiliated with Apple Inc. that purported to sell Apple software. Not only did the cyber thieves make money from these schemes, they deprived legitimate website operators and advertisers of substantial revenue.

The six cyber criminals were taken into custody yesterday in Estonia by local authorities, and the U.S. will seek to extradite them. In conjunction with the arrests, U.S. authorities seized computers and rogue DNS servers at various locations. As part of a federal court order, the rogue DNS servers have been replaced with legitimate servers in the hopes that users who were infected will not have their Internet access disrupted.

It is important to note that the replacement servers will not remove the DNSChanger malware—or other viruses it may have facilitated—from infected computers. Users who believe their computers may be infected should contact a computer professional. They can also find additional information in the links on this page, including how to register as a victim of the DNSChanger malware.

FBI Counterintelligence National Strategy – Orginal Statement by the FBI

Surveillance video from Ghost Stories
Surveillance photo of two subjects of Operation Ghost Stories, an investigation into a Russian spy ring operating in the U.S. | More on Ghost Stories: Videos | Photographs | Documents

FBI Counterintelligence National Strategy
A Blueprint for Protecting U.S. Secrets

11/04/11

Espionage may seem like a throwback to earlier days of world wars and cold wars, but the threat is real and as serious as ever.

We see it—and work hard to counter it—all the time. It’s not just the more traditional spies passing U.S. secrets to foreign governments, either to fatten their own wallets or to advance their ideological agendas. It’s also students and scientists and plenty of others stealing the valuable trade secrets of American universities and businesses—the ingenuity that drives our economy—and providing them to other countries. It’s nefarious actors sending controlled technologies overseas that help build bombs and weapons of mass destruction designed to hurt and kill Americans and others.

In late October, in fact, we took part in a multi-agency and multi-national operation that led to the indictment of five citizens of Singapore and four of their companies for illegally exporting thousands of radio frequency modules from the U.S. Allegedly, at least 16 of these modules were later found in unexploded improvised explosive devices in Iraq.

As the lead agency for exposing, preventing, and investigating intelligence activities on U.S. soil, the FBI continues to work to combat these threats using our full suite of investigative and intelligence capabilities. We’ve mapped out our blueprint in what we call our Counterintelligence National Strategy, which is regularly updated to focus resources on the most serious current and emerging threats.

The strategy itself is classified, but we can tell you what its overall goals are:

  • Keep weapons of mass destruction, advanced conventional weapons, and related technology from falling into the wrong hands—using intelligence to drive our investigative efforts to keep threats from becoming reality. Our new Counterproliferation Center will play a major role here.
  • Protect the secrets of the U.S. intelligence community—again, using intelligence to focus our investigative efforts and collaborating with our government partners to reduce the risk of espionage and insider threats.
  • Protect the nation’s critical assets—like our advanced technologies and sensitive information in the defense, intelligence, economic, financial, public health, and science and technology sectors. We work to identify the source and significance of the threats against these assets, and to help their “owners” to minimize vulnerabilities.
  • Counter the activities of foreign spies—whether they are representatives of foreign intelligence agencies or governments or are acting on their behalf, they all want the same thing: to steal U.S. secrets. Through proactive investigations, we identify who they are and stop what they’re doing.

One important aspect of our counterintelligence strategy involves strategic partnerships. And on that front, we focus on three specific areas:

  • The sharing of expertise and resources of the FBI, the U.S. intelligence community, other U.S. government agencies, and global partners to combat foreign intelligence activities;
  • Coordination of U.S. intelligence community efforts to combat insider threats among its own ranks; and
  • Partnerships with businesses and colleges and universities to strengthen information sharing and counterintelligence awareness.

Focus on cyber activities. Another key element of our counterintelligence strategy, according to FBI Counterintelligence Assistant Director Frank Figliuzzi, is its emphasis on detecting and deterring foreign-sponsored cyber intelligence threats to government and private sector information systems. “Sometimes,” he said, “the bad guys don’t have to physically be in the U.S. to steal targeted information…sometimes they can be halfway around the world, sitting at a keyboard.”

The FBI’s Counterintelligence National Strategy supports both the President’s National Security Strategy and the National Counterintelligence Strategy of the United States.