Thread by @ninaandtito

LOOK AT THEIR NAMES. LOOK AT WHERE THEY WERE ARRESTED.
2 International Cybercriminal Rings Dismantled & 8 Defendants Indicted for Causing Tens of Millions of Dollars in Losses in Digital Advertising Fraud
Global Botnets Shut Down Following Arrests
1/
justice.gov/usao-edny/pr/t…

Aleksandr Zhukov, Boris Timokhin, Mikhail Andreev, Denis Avdeev, Dmitry Novikov, Sergey Ovsyannikov, Aleksandr Isaev and Yevgeniy Timchenko
"Ovsyannikov was arrested last month in Malaysia; Zhukov was arrested earlier this month in Bulgaria; and Timchenko was arrested...
2/

... earlier this month in Estonia, all pursuant to provisional arrest warrants issued at the request of the United States. They await extradition. The remaining defendants are at large."
3/

WE HAVE LOTS OF FRIENDS WHO HELPED US WITH THIS CASE.
4/

5/ Here's the indictment, my lovelies: justice.gov/usao-edny/pres…

Shall we read it together?
Let's!
ruh roy they used computers in Texas. that's bad. cuz..even if none of the humans doing the criming are in the US, their crimes now ARE.

They hacked other people's computers to use them, and some of those computers were in EDNY. That was dumb. because now they are being indicted by EDNY
Now look at where they all lived/are from: Russian Federation, Ukraine, Kazakhstan, Bulgaria. Oooh a corporate entity in Scotland

DoJ literally have the instructions the bosses gave to the employees to make the bots more "humanlike" to fool the computers into thinking the traffic was real.
#pwnedByDoJ.

Lol DoJ has everything on these idiots.
#FollowTheMoney.
#FollowTheMethbots.

Here's the paper mentioned in the second screenshot above:
go.whiteops.com/rs/179-SQE-823…

Note how the criminals responded to the publication of the paper: they tried to delete evidence of their crimes.
#ConsciousnessOfGuilt
#SpoliationOfEvidence?

We now turn to look at the other scheme:
#sillyrabbits thought they could get away with attacking >1M US computers?
nice try, eejits.

#Dummies.
"it's safe in the cloud" okay, sure Jan.

Read paragraph 41(a).
yikes. be glad you're not that idiot.

The sheer number of victims in this case is astounding.
you should seriously read the whole indictment, but I particularly love Count Eight, because of the "Overt Acts" description :)

Now we get to see some of the domains they were using 😊
kiss kiss, silly criminals. 😘
you're toast. 😛

Not certain this is them but... A Mikhail Andreev follows a Boris Timokkin on GitHub.
You're welcome.

🤷‍♀️

@briankrebs wrote about adw0rd and methbot in December 2016 krebsonsecurity.com/tag/adw0rd/