Thread by @AmericnXX

This is a big one: 3 botnet networks, thousands of infected computers...

Two International Cybercriminal Rings Dismantled and Eight Defendants Indicted for Causing Tens of Millions of Dollars in Losses in Digital Advertising Fraud justice.gov/usao-edny/pr/t…

Seizure warrants authorized the FBI to take control of 31 internet domains, and search warrants authorized the FBI to take information from 89 computer servers, all part of the infrastructure for botnets engaged in digital advertising fraud activity.

The FBI, working with private sector partners, redirected the internet traffic going to the domains (an action known as “sinkholing”) in order to disrupt and dismantle these botnets. 

White Ops, Inc., Google LLC, Microsoft Corporation, ESET, Trend Micro Inc., Symantec Corp.,

CenturyLink, Inc, F-Secure Corporation, Malwarebytes, MediaMath, the National Cyber-Forensics and Training Alliance and The Shadowserver Foundation assisted in the investigation and/or the botnet takedown.   

The unravelling and dismantling of the cyber-infrastructure began with

the arrest of arrest of Sergey Ovsyannikov by Malaysian authorities.

Ad Network #1 falsified billions of ad views and caused businesses to pay more than $7 million for ads that were never actually viewed by real human internet users. 650,000 rented IP addresses were assigned

to 1,900 remote datacenter servers that spoofed more than 5,000 domains to create the illusion of individual users.

“Ad Network # 2” infected and accessed more than 1.7 million computers, belonging to ordinary individuals and businesses in the United States and elsewhere.

Using malware that ran on the background, Ad Network 2 falsified billions of ad views and caused businesses to pay more than $29 million for ads that were never actually viewed by real human internet users.

An additional digital ad cybercrime infrastructure was run through

data center servers located in Germany that ran a Boaxxe malware botnet of infected US-based computers.

And then the monay... seizure warrants were executed for multiple international bank accounts in Switzerland and "elsewhere."

Huge cast of characters and agencies in Malaysia, Bulgaria, Estonia, Germany, The Netherlands, France, the UK, Switzerland, and good ol' USA.

The Defendants:

ALEKSANDR ZHUKOV
Age:  38
Russian Federation

BORIS TIMOKHIN
Age:  39
Russian Federation

MIKHAIL ANDREEV
Age:  34
Russian Federation and Ukraine

DENIS AVDEEV
Age:  40
Russian Federation

DMITRY NOVIKOV
Age:  Unknown
Russian Federation

SERGEY OVSYANNIKOV
Age:  30
Republic of Kazakhstan

ALEKSANDR ISAEV
Age:  31
Russian Federation

YEVGENIY TIMCHENKO
Age:  30
Republic of Kazakhstan

The charges include wire fraud, computer intrusion, aggravated identity theft and money laundering.

Ovsyannikov was arrested last month in Malaysia; Zhukov Timchenko were arrested and awaiting extradition. The rest are still at large.

FBI Cyber Division led a multi-year investigation and did some fancy footwork. An extraordinary multi-national, multi-agency investigation. ##

So,

Malaysia -- 1MDB?

And noticeably absent -- Facebook.

@threadreaderapp Unroll please.