In episode 1 of the Know Your Adversary™ Podcast, we are joined by Mark Ray, former FBI Special Agent, Kamal Ghali  former Assistant US Attorney and current partner at Bondurant, Mixon & Elmore, and former FBI Forensics Expert and current Technical Principal at Nisos Willis McDonald. We discuss  one of the most famous cyber criminal cases of the 21st century, the attribution and takedown of Spyeye malware developer Alexander Panin and his primary facilitator Hamza Bendallaj. Spyeye was commodity malware that was sold on dark web marketplaces beginning in 2009. The malware was a program that ran on numerous browsers and operating systems allowing hackers to steal money from online bank accounts and initiate transactions even while valid users were logged into the bank account. Over seven years, the losses to consumers and enterprises exceeded $500 million worldwide. The investigation and takedown of  Panin and Bendallaj culminated in 2016 when they were sentenced to a combined 24 years and 6 months in prison.  

Here are some of the key takeaways from the episode.  

• The Real and Fake Lives of Personas Used By Cyber Criminals Online Often Intersect. Just like an enterprise, cyber criminals consider their return on investment when engaging in malicious activity. Just like Alexander Panin and Hamza Bendellaj did when they were establishing their complex web of bots and proxy servers, current criminals want to monetize crime as quickly as possible.  They want to scale their activities so it can be replicated between numerous victims and maximize their profits. When they do this, they often make operational security mistakes.   Identifying these mistakes are key to remediation.

 

• Criminals and Nation States Purchase Malicious Command and Control Servers Near Victim’s Locations to Reduce Malicious Signature. Attackers will not typically link their activity directly to their destination command and control servers in Russia or Eastern Europe. Typically, they establish C2 nodes near server farms, virtual physical locations, or individual machines physically located near their victims.  In this case, Bendallaj and Panin used servers in Atlanta. Gaining access to the local infrastructure can provide critical information about the commands and signatures the attackers used in their attacks.