How A Pair Of Cybercriminals Scales Its Carder Business

A relatively small cybercrime operation specializing in the sale of stolen credit and debit cards is the latest example of the growing professionalism exhibited by many operators in the cyber underground.

Security vendor FireEye this week published a report describing the activities of two cybercriminals it has dubbed "Vendetta Brothers," who are operating a business modeled very much along the lines of legitimate organizations.

As of early this year, the duo had amassed and was selling payment cards from a total of 639 banks in 41 countries using a combination of legitimate business tactics like outsourcing and lead generation via phishing attacks.

Most of the payment card data available for sale from the Vendetta Bothers belong to users in the US and in Norway, Sweden, and Finland. FireEye’s analysis shows the two criminals are likely operating out of Spain and Eastern Europe.

What makes the Vendetta Brothers interesting is how they have managed to scale their criminal operation, says Will Glass, threat intelligence analyst at FireEye. Though just two people, the pair have shown an ability to grow and diversify their business using tactics like outsourcing and partnerships with other cybercriminals, Glass says.

“We wrote this report... because we collected enough information to raise awareness of how even small operations can adopt business-like practices to scale their operation while insulating themselves from the crimes,” he says.

The criminal duo currently operate an underground website for selling stolen credit and debit card data. It offers roughly 10,000 cards for sale, which according to FireEye, makes it relatively small compared to other carder operations.

The site offers drop-down menus for buyers of stolen card information to choose cards issued by specific banks or from specific geographic locations.

The two brothers use a couple of methods to diversify the sources for their stolen card data, FireEye says. One tactic involves partnering with cyber crooks that have already gained remote access to point-of-sale terminals at merchant locations. In these cases, the two cybercrooks supply malware for stealing card data from the already compromised POS systems.

"They place ads on underground forums looking for hackers who might already have access to point-of-sale systems but lack malware to harvest payment card data," Glass says. Another tactic they use is to look for people who might work in locations, which give them physical access to POS terminals.

Such outsourcing of the upfront legwork has offered the criminal pair an effective way to expand their reach, Glass notes. "Using recruits or cut-outs to do their dirty work for them allows them to focus on higher-level planning of their campaign while also placing distance between themselves and the actual POS compromises," he says.

On occasion, the Vendetta Brothers compromise systems on their own, sometimes using leads obtained from criminal partners. The typical strategy is to send malicious emails disguised as employment queries to targets. The emails contain attachments which when opened are designed to look for and infect POS systems.

In some cases, the duo also has used physical skimmers to capture card data and video devices to record PIN numbers.

"It is likely that other groups also use similar business-like models," Glass says. "The Vendetta Brothers have shown an enterprising nature in figuring out ways to scale their criminal schemes," in a manner that indicates thoughtful planning, he says.

Related stories: