Journalists take photographs of a display referring to ‘Blackshades’ malware during a news conference yesterday by the US Attorney for the Southern District of New York to announce law enforcement action to target creators and purveyors of malicious computer software, in Lower Manhattan, New York.
Reuters/AFP
Police in 16 countries across the United States, western Europe and in Chile have seized cash, firearms and drugs and arrested 80 people suspected of peddling virus software believed to have infected hundreds of thousands of computers, according to European legal authorities.
Two days of raids targeted creators, users and sellers of the “BlackShades” (also spelled Blackshades) malware, which the US Federal Bureau of Investigation (FBI) says has been sold to thousands of users in more than 100 countries, infecting more than 500,000 computers.
The software allowed users to control other people’s computers.
The raids involved searches of 359 homes in 16 countries, said Eurojust, the EU’s judicial co-operation agency.
Five defendants charged in the United States include Alex Yucel, who owned and operated the BlackShades organisation under the online name “marjinz”, according to court documents unsealed in New York yesterday.
Yucel ran the organisation as a business, employing a director of marketing, a website developer, a customer service manager and a team of customer service representatives who answered complaints submitted online, US authorities said.
BlackShades generated more than $350,000 in sales between September 2010 and April 2014, according to the court documents.
In a recent case in the Netherlands, an 18-year-old male was detained for infecting at least 2,000 computers with the malware, using the victim’s webcams to take pictures of women and girls.
A statement said the operation was co-ordinated by Eurojust and the cyber-crime unit of the European police organisation, Europol.
“During the course of a worldwide investigation, creators, sellers and users of BlackShades malware were targeted by judicial and law enforcement authorities in 16 different countries,” Europe-wide police and justice bodies Europol and Eurojust, which are based in The Hague, said in a statement.
The malware was sold to thousands of individuals worldwide.
The most widely used version was BlackShades RAT, a sophisticated piece of malware that enabled users to take over other people’s computers, Eurojust said.
The malware could also be used to carry out distributed denial-of-service cyber-attacks to bring down websites.
BlackShades comes complete with model “ransom notes” for extorting cash after notifying a user that they have lost control of their computer.
“Warning! Your computer has been hacked and your private files encrypted and can only be decrypted by us,” reads one such note along with blank spaces for bank account details where the “ransom” should be paid.
Over two days, police and the FBI raided 359 houses, arrested 97 people and seized “substantial quantities” of cash, illegal guns and drugs, as well as over 1,000 data storage devices, the statement said.
The FBI’s investigation was aided by one of the co-creators of BlackShades RAT (remote access tools), who agreed to co-operate with authorities after he sold a copy of the malware to an undercover FBI agent.
The investigation has included the seizure of more than 1,900 Internet domain names used to control victims’ computers and a search warrant executed on a BlackShades computer server.
Among the countries raided were the Netherlands, Belgium, France, Germany, the UK, Italy, the US, Canada, Chile and Switzerland.
The FBI passed on a list of nationals suspected of having bought or used BlackShades to their respective countries after arresting two people who wrote the software, a judicial source in Paris told AFP.
French police last week raided 50 properties as part of the investigation, detaining 26 people.
Seven of those detained admitted possessing BlackShades for nefarious purposes, including hacking webcams or Facebook accounts, the public prosecutor said in a statement.
Eight suspects said they used the malware to pirate online video games.
“The investigation is continuing,” a French judicial source told AFP.
Hacker websites began reporting three days ago that police were raiding people suspected of buying or using BlackShades, which is reportedly available on the so-called “darknet” network of trusted peers for under $100 (70 euros).
Chatrooms suggested police were using records from the PayPal payment site to identify those who bought the malware.