International Investigations Target Financial Cybercrime – Source: securityboulevard.com

International authorities took two big swipes at cybercriminals this week, with Interpol and others rounding up almost 3,500 suspects in a 34-country operation to crack down on cyber-scams one day while German police the next day said they shut down a dark web marketplace called Kingdom Market.

Combined with the move by the U.S. Justice Department (DOJ) and FBI – along with Australian authorities – to seize the online operations of the BlackCat ransomware-as-a-service (RaaS), the operations overseas were the latest examples of law enforcement taking a more proactive approach to dealing with cybercriminals.

The Interpol operation was run by authorities in South Korea but touched on other countries in Asia as well some in Europe and Africa. The United States also was included.

Expanding HAECHI Investigations

It was the fourth in an ongoing investigation named HAECHI, which Interpol launched in 2020 to address financial cybercrimes emanating from South Korea but – given the borderless nature of the internet – stretch across the globe. The HAECHI operations focus on a range of crimes, such as investment fraud, romance scams, money laundering associated with illegal online gambling, and online sextortion.

Other crimes investigated are voice phishing – or “vishing” – business email compromise (BEC) and e-commerce fraud. According to authorities, BEC, investment fraud, and e-commerce fraud accounted for 75% of the cases investigated during the six-month HAECHI IV operation.

The numbers coming out of the investigation were big. Along with the arrests, the authorities seized $300 million in in assets – $199 million in hard currency and $101 million in virtual assets – blocked 82,112 suspicious bank accounts, and identified 367 virtual asset accounts linked to transnational organized crime operations.

Police in countries where the accounts were found froze the assets and are continuing to investigate, according to Interpol.

A Growing Operation

Late last year, the HAECHI III operation netted almost 975 suspects, almost $130 million in virtual assets, and 2,800 bank and virtual-asset accounts. Stephen Kavanagh, Interpol’s executive director of police services, said in a statement that the “staggering sum” of money seized “clearly illustrates the incentive behind today’s explosive growth of transnational organized crime.”

“This represents the savings and hard-earned cash of victims,” Kavanagh said. “This vast accumulation of unlawful wealth is a serious threat to global security and weakens the economic stability of nations worldwide.”

The operation also led to the arrest by Filipino and South Korean police in Manila of a well-known online gambling figure after a two-year manhunt.

Along with the arrests and seizures, Interpol also alerted countries – via what the agencies call Purple Flags – about two emerging digital investment fraud scams. Authorities detected what they’re calling a “rug pull” scam in the crypto industry involving non-fungible tokens (NFTs), where victims are promised huge returns on investments but the operators behind the scam suddenly abandon the project after collecting the money.

The second addresses the growing problem of scammers using generative AI and deepfake technology to hide their identities by pretending to be family members, friends, or love interests, which gives their schemes more credibility.

Germany Takes on the Kingdom Marketplace

In Germany, federal authorities seized the infrastructure of the Kingdom Market, a darknet marketplace place that launched in March 2021 and sold not only illegal narcotics but also malware, criminal services, and fake documents, which were advertised on the marketplace.

The operation, which shut down Kingdom Market, also involved agencies in the United States, Switzerland, Ukraine, and Moldova.

According to German authorities, the English-language platform was accessible through Tor and the Invisible Internet Project (I2P), networks that allow for anonymous communications. The marketplace offered more than 42,000 products to tens of thousands of customers through several hundred seller accounts registered on it.

Customers paid for the illegal products through such cryptocurrencies as Bitcoin, Litecoin, Monero, and Zcash, while the marketplace’s operators got a 3% commission for processing the sales through the platform.

There’s Money to Be Made

How long the effects of such investigations will last is unclear. The DOJ and FBI in August led a multinational operation took down the infrastructure of the operators behind the QakBot phishing operation. However, various threat groups are still using the QakBot malware to serve up phishing emails.

In addition, soon after the DOJ and FBI seized various websites belonging to BlackCat – also known as ALPHV – the RaaS group retook control of the main Tor site, said the agencies had only captured a portion of its operations, and promised more attacks, expanding the list of approved targets to include hospitals and nuclear power plants.

Bad actors will continue to quit the huge paydays that cyberattacks can generate, as the growing numbers of people, operations, and money rolled up in Interpol’s HAECHI indicate.

“HAECHI IV’s 200% surge in arrests [over last year’s investigation] shows the persistent challenge of cyber-enabled crime, reminding us to stay alert and keep refining our tactics against online fraud,” Interpol’s Kavanagh said.