Feds indict 'fxmsp' in connection with million

Andrey Turchin, known for selling access to stolen data, was last known to be in Kazakhstan.

The U.S. Department of Justice has charged a man with hacking-related crimes as part of an investigation into a group of foreign scammers accused of targeting more than 300 organizations throughout the world.

Prosecutors in the Western District of Washington charged Andrey Turchin, who resides in Kazakhstan, with five felony counts in connection with a year-long fraud effort. Last known to be in Kazakhstan, Turchin allegedly sold remote access hacking tools on cybercriminal forums, typically charging tens of thousands of dollars for access to data that would cost victims tens of millions of dollars.

Turchin went by a series of aliases, including “fxmsp,” according to the Justice Department. He was initially charged in December 2018, though the indictment was kept under seal until Tuesday, one month after security vendor Group-IB released its own research documenting the work of a hacker known by the “fxmsp” alias.

“U.S. authorities have reason to believe that Turchin is aware of the existence of pending criminal charges in the United States,” the indictment states without elaboration.

Between October 2017 and December 2018, the indictment says, Turchin and his gang used hacking techniques — including phishing emails, malicious software, and brute-force password guessing— to access protected computers and steal data. Victims included a financial company in New York, a hotel chain with locations in Washington, an olive oil manufacturing company in California and dozens of others, according to court documents.

The group then would sell that stolen information on forums including Exploit.in, Omerta, Club2Card, Blackhacker and others.

“Following a sale, the conspirators typically provided the buyer with ongoing technical assistance with respect to purchased network access for a negotiated period of time,” the indictment says.

A separate Group-IB report detailing fxmsp’s known activities suggests the operation earned $1.5 million, though the company suggested the figures could be much higher. Fxsmp appeared on cybercriminal scene in September 2016, researchers noted, by asking other users about their experience with various strains of malware, and accidentally exposing his contact information.

By 2017, Group-IB went on, Fxmsp had advertised access to information stolen from a bank in Nigeria, and had publicly discussed launching attacks against IBM and Microsoft. The number of victims had reached 18 in early 2018, researchers found, and Fxmsp had begun working with other forum users with names like Lampeduza, who is named in the indictment, to sell access to dozens of companies.

“Fxmsp is one of the most prolific sellers of access to corporate networks in the history of [the] Russian-speaking cybercriminal underground who publicly advertised the access to 135 companies[,]” Group-IB chief technology officer Dmitry Volkv said in the report.

Often, when the U.S. Justice Department unseals an indictment against alleged hackers outside American jurisdiction, it’s an implicit acknowledgment that the suspect will be apprehended soon. John Demers, assistant attorney general for national security, told CyberScoop in February that, if prosecutors believe an arrest is likely to occur “within a reasonable time frame,” the government will keep charges sealed.

Seamus Hughes, the deputy director of the Program on Extremism at George Washington University and a specialist on court filings, first noticed the court documents had been made public.

The indictment is available in full below.

[documentcloud url=”http://www.documentcloud.org/documents/6982480-Andrey-Turchin.html” responsive=true]

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure