Feds charge 'Fruitfly' creator with hacking thousands of computers

An Ohio man faces a 16-count indictment for allegedly creating a piece of malware that spied on victims in order to commit a litany of crimes.

An Ohio man faces a 16-count indictment for allegedly creating a piece of malware that spied on victims in order to commit a litany of crimes, including the production of child pornography, according to federal prosecutors.

The government claims, Phillip R. Durachinsky, 28, ran a 13-year scheme from 2003 to Jan. 20, 2017 that infected thousands of computers with malware dubbed “Fruitfly.”

Victims include unknowing individuals, police departments, schools, companies and the federal government.

Fruitfly, which targeted Mac computers, allowed Durachinsky to take complete control of a computer including secretly turning on cameras and microphones to record video and audio. Durachinsky also allegedly used Fruitfly to steal personal data including their login credentials, tax records, medical records, photographs, banking records, Internet searches, and potentially embarrassing communications, according to federal prosecutors.

“This defendant is alleged to have spent more than a decade spying on people across the country and accessing their personal information,” First Assistant U.S. Attorney David Sierleja said in a statement.

Fruitfly was first discovered last year by MalwareBytes and then by Patrick Wardle, an ex-NSA analyst who saw around 400 infections. As Wardle predicted, that was just a fraction of the total number.

Most victims were American.

“For more than 13 years, Phillip Durachinsky allegedly infected with malware the computers of thousands of Americans and stole their most personal data and communications,” said Acting Assistant Attorney General John Cronan. “This case is an example of the Justice Department’s continued efforts to hold accountable cybercriminals who invade the privacy of others and exploit technology for their own ends.”

In an interview with CyberScoop, Wardle said he provided the FBI with technical information about FruitFly in late May 2017. The FBI was already on the case at that time. Until today, Wardle has been limited in what he could talk about regarding his findings.

Though Wardle only found roughly 400 victims through his analysis of FruitFly, the actual number of computers where the malware had been installed is in the thousands, based on court documents. The deliver mechanism for FruitFly remains unclear. Wardle said the primary purpose of FruitFly appeared to involve recording video content through compromised web cameras.

Fruitfly was predominately used to spy on children, said Wardle. The malware was specially programmed to alert the hacker whenever a victim logged into their computer or had typed a pornographic term. It’s likely such activity would prompt a recording session.

“The fact that FruitFly was able to remain undetected for 13 years, while the attacker infected 1000s of Macs to spy on children is both disheartening and sickening,” Wardle said. “I’m appreciative that the FBI made this case a priority and were able to track down and arrest the hacker.”

You can read the full indictment against Durachinsky below:

[documentcloud url=”http://www.documentcloud.org/documents/4346397-Durachinsky-Indictment-0.html” width=675 height=500]

Chris Bing contributed to this report.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure