Connected devices are essential to our professional and personal lives, and criminals have gravitated to these platforms as well. Many common crimes—like theft, fraud, harassment, and abuse—are now carried out online, using new technologies and tactics. Others, like cyber intrusions and attacks on critical infrastructure, have emerged as our dependence on connected systems revealed new vulnerabilities.

Successfully mitigating these threats relies on a combination of information sharing, prevention efforts, and enforcement work. Government agencies, law enforcement, the private sector, and individuals all have a role to play.

National Cybersecurity Awareness Month was created in 2004 by the Department of Homeland Security and the National Cyber Security Alliance to provide a reminder that each of us has the power to make the Internet safer and more secure.

“While the speed at which technology and information move can expose us to new risks online, it also enables a level of sharing and cooperation that can make us more resilient to cyber threats,” says FBI Cyber Division Assistant Director Matt Gorham. “National Cybersecurity Awareness Month isn’t just about understanding the risks, but also emphasizing our collective power to combat them.” 

The FBI coordinates closely with the private sector as well as with state, local, and international partners to understand and anticipate cyber threats and pursue cyber criminals with every available resource.

Recently, the FBI’s work has resulted in the conviction of a cyber criminal who tried to access university databases to commit fraud and identity theft, charges against a North Korean regime-backed programmer, and 74 arrests in the United States and overseas of members of a transnational criminal network participating in business email compromise schemes.

“Realistically, we know we can’t prevent every attack, or punish every hacker,” FBI Director Christopher Wray told the Boston Conference on Cyber Security earlier this year. “But we can build on our capabilities. We can strengthen our partnerships and our defenses. We can get better at exchanging information to identify the telltale signs that may help us link cyber criminals to their crimes. And we can impose a variety of costs on criminals who think they can hide in the shadows of cyber space. We can do these things—and we are.”

During National Cybersecurity Awareness Month, make it a point to learn more about what you can do to understand current cyber threats and support efforts to combat them.

Not that they knew him personally, but Taylor Huddleston, a 27-year-old from Hot Springs, Arkansas, was for a time very popular among the world’s cyber criminals, thanks to a malicious piece of software he created called NanoCore RAT.

That malware allowed hackers to steal sensitive information from victims’ computers, including account numbers and passwords, and even allowed them to secretly activate the webcams of infected computers to spy on unsuspecting victims.

“Basically, the malicious software compromises victim computers and steals information,” said a special agent from the FBI’s Washington Field Office who investigated the case. “The NanoCore RAT has the ability to control a victim’s computer.”

This type of malware—a Remote Access Trojan (RAT)—is all the more insidious because in most cases victims have no idea their computers have been compromised. According to court documents, NanoCore RAT was used to infect and attempt to infect more than 100,000 computers.

RATs are not only a threat to individual users but to commercial enterprises as well. And if hackers decide to target U.S. infrastructure using this malware, the agent said, “there is a potential for national security implications.”

Huddleston had the skills to develop malicious software. “There are many cyber criminals out in the world,” the agent said. “Many are not sophisticated in terms of developing a new malware. Instead, they would rather purchase malware to carry out their crimes.”

Huddleston didn’t stop with NanoCore RAT. He also developed and profited from Net Seal, a fee-based licensing software that he and his customers used to distribute NanoCore RAT and other malware.

Net Seal enabled other malware developers to license their illicit products for a fee and then use the Net Seal platform to widely distribute them. After malware buyers paid the seller, buyers received a licensing code allowing them to download the software. Like legitimate software, it could not be shared with anyone else. Such transactions are part of a huge underground economy on the Internet—known as the dark web—where criminals buy and sell illegal goods and services.

For example, court records detailed that Huddleston used Net Seal to assist one cyber criminal in the distribution of malware to approximately 3,000 people that was in turn used to infect approximately 16,000 computers.

Huddleston’s illegal activities surrounding the Net Seal platform became known to authorities, and the FBI opened an investigation in September 2015. The investigation eventually led to NanoCore RAT and ultimately to Huddleston.

Huddleston was arrested in February 2017 and charged with aiding and abetting computer intrusions. He pleaded guilty, admitting that he intended his products to be used maliciously. In February 2018, a federal judge sentenced him to 33 months in prison.

A recently closed California hacking and identity theft case sadly illustrates the misery that can be visited on unsuspecting victims when their personal information is compromised.

Between 2011 and 2014, four U.S. citizens who resided in San Diego—but carried out their crimes from across the Mexican border in Tijuana—hacked the computer servers of major U.S. mortgage brokers, stealing detailed loan application information from thousands of customers and then using the victims’ Social Security numbers, addresses, dates of birth, and driver’s license numbers to open unauthorized lines of credit and take over and drain victims’ retirement accounts.

“The damage crimes like these have on victims, the economy, and society in general are significant,” said Special Agent Chris Christopherson, who investigated the case from the FBI’s San Diego Division. “Individuals had their finances wrecked and their credit destroyed, through no fault of their own. For many of them,” he added, “the impacts are still being felt.”

One of the fraudsters in the conspiracy, John Baden, was the chief hacker. He infiltrated mortgage companies using a common hacking technique known as “fuzzing,” which works by overloading a web server with massive amounts of data that can lead to the server revealing security loopholes.

Once Baden had access to victims’ information, he and his conspirators, Victor Fernandez, Jason Bailey, and Joel Nava, went to work. Fernandez—the group’s ringleader—identified multiple victims’ brokerage accounts and took control of them by calling the companies and providing the victims’ personal information to change passwords and contact information. Then it was simple for him and his conspirators to wire funds—sometimes up to $30,000 at a time—from the victims’ accounts to accounts they controlled.

Victims stretched from California to Florida, and one individual lost nearly $1 million in the scheme, Christopherson said. A second part of the scheme involved extensive credit fraud. The criminals used victims’ detailed personal information to set up bogus lines of credit and retail credit card accounts to which they charged thousands of dollars for goods and services. Most of the proceeds from the sale of items in these crimes were used to buy drugs.

In all, Christopherson estimated there were more than 25,000 victims, and although charging documents listed victim losses at approximately $2.5 million, “in reality the amount was much higher than that,” he said. “There was so much retail fraud over such a long period of time, it was impossible to calculate an accurate and provable loss amount.”

The FBI was alerted to the fraud by a financial institution that noticed irregularities, and about the same time, FBI cyber investigators detected that many victims had a “common point of compromise,” Christopherson said. “They had all recently applied to the same mortgage company.”

Armed with that information, investigators worked backward from the mortgage company, eventually identifying the hack—and the hackers. By that time, Baden was hiding in Mexico. In 2014, he was named to the San Diego FBI’s Most Wanted Cyber Fugitives list, and the reward offered in the case eventually led to his capture in Mexico, Christopherson said.

All four subjects pleaded guilty to their roles in the fraud scheme. In 2015, Baden was sentenced federally to nine years in prison. In January 2018, Fernandez was sentenced to more than 10 years in prison. Bailey received a sentence of more than five years, and in February 2018, Nava was the last subject to be sentenced, to 44 months in prison.

But even years after the crimes were committed, Christopherson said, “the court was still receiving victim impact statements.” Many victims were unable to get jobs or be approved for mortgages or car loans because their credit had been ruined by the fraudsters.

“We are pleased that these criminals are now behind bars and will not be able to victimize anyone else,” said Christopherson, who encouraged the public to regularly check their credit information to make sure their personal information has not been compromised.

With participation growing and a Spanish version now available, the FBI’s Safe Online Surfing (SOS) Internet Challenge is reopening for the new school year, offering a game-driven curriculum that teaches students about online risks.

The SOS program covers topics such as cyberbullying, protecting personal information, recognizing trustworthy and untrustworthy sites, and avoiding malware through age-appropriate activities. Students visit the island that aligns with their grade level and surf through activities that teach how to recognize hazards and respond appropriately. This year, for the first time, the entire curriculum is also available in Spanish.

The FBI-SOS Internet Challenge had a record level of participation during the 2017-2018 school year, with 906,104 students from schools in all 50 states, D.C., Puerto Rico, and the Virgin Islands completing the program.

“As young people spend more and more time online doing homework, gaming, and connecting to peers, it is critical that we teach them how to protect both their personal information and their well-being,” said Unit Chief Jonathan Cox of the FBI’s Office of Public Affairs. “SOS provides age-tailored guidance for young students who are just learning to navigate the web all the way up to social media-savvy teens.”

SOS activities are available to everyone, but teachers must register their classes to participate in the tests and competition. Any public, private, or home school in the United States and its territories with at least five students is eligible for the online challenge. Teachers manage their students’ participation in the program, and the FBI does not collect or store any student information.

Each month during the school year, the classes with the top exam scores nationwide receive an FBI-SOS certificate and may be congratulated in person by local FBI personnel.

Visit sos.fbi.gov to explore the Safe Online Surfing Internet Challenge activities and to register.

Today, federal authorities—including the Department of Justice and the FBI—announced a major coordinated law enforcement effort to disrupt international business e-mail compromise (BEC) schemes that are designed to intercept and hijack wire transfers from businesses and individuals. 

Operation WireWire—which also included the Department of Homeland Security, the Department of the Treasury, and the U.S. Postal Inspection Service—involved a six-month sweep that culminated in over two weeks of intensified law enforcement activity resulting in 74 arrests in the U.S. and overseas, including 42 in the U.S., 29 in Nigeria, and three in Canada, Mauritius, and Poland. The operation also resulted in the seizure of nearly $2.4 million and the disruption and recovery of approximately $14 million in fraudulent wire transfers.

A number of cases charged in this operation involved international criminal organizations that defrauded small- to large-sized businesses, while others involved individual victims who transferred high-dollar amounts or sensitive records in the course of business. The devastating impacts these cases have on victims and victim companies affect not only the individual business but also the global economy. Since the Internet Crime Complaint Center (IC3) began formally keeping track of BEC and its variant, e-mail account compromise (EAC), there has been a loss of over $3.7 billion reported to the IC3.

BEC, also known as cyber-enabled financial fraud, is a sophisticated scam that often targets employees with access to company finances and trick them—using a variety of methods like social engineering and computer intrusions—into making wire transfers to bank accounts thought to belong to trusted partners but instead belong to accounts controlled by the criminals themselves. And these same criminal organizations that perpetrate BEC schemes also exploit individual victims—often real estate purchasers, the elderly, and others—by convincing them to make wire transfers to bank accounts controlled by the criminals.

Foreign citizens perpetrate many of these schemes, which originated in Nigeria but have spread throughout the world.

During Operation WireWire, U.S. law enforcement agents executed more than 51 domestic actions, including search warrants, asset seizure warrants, and money mule warning letters. And local and state law enforcement partners on FBI task forces across the country, with the assistance of multiple district attorney's offices, charged 15 alleged money mules for their roles in defrauding victims. 

The role of money mules, witting or unwitting, in BEC schemes is very important—they are used to receive the stolen money and then transfer the funds as directed by the fraudsters. The mules usually keep a fraction of the money for their trouble.

Today’s announcement highlighting this recent surge in law enforcement resources targeting BEC schemes “demonstrates the FBI's commitment to disrupt and dismantle criminal enterprises that target American citizens and their businesses,” according to FBI Director Christopher Wray.

And he added, “We will continue to work together with our law enforcement partners around the world to end these fraud schemes and protect the hard-earned assets of our citizens. The public we serve deserves nothing less.”

As the threats from hackers and other cyber criminals grow, the FBI is committed to developing its workforce’s cyber expertise, building partnerships, and punishing cyber criminals who target the United States, FBI Director Christopher Wray said at a major cyber security conference this week.

“Today, we live much of our lives online, and we're in a situation where just about everything that is important to us lives on the Internet. And that’s a pretty scary thought for a lot of people,” Director Wray said. “What was once a minor threat—people hacking for fun or bragging rights—has now turned into full-blown nation-state economic espionage and very, very lucrative cyber criminal activity. The threat is now coming at us from all sides.”

Sponsored by the FBI and Fordham University, the International Conference on Cyber Security featured expert speakers—including several FBI officials—on a wide variety of cyber-related topics, ranging from botnets and malware to disinformation campaigns and attacks on critical infrastructure. Wray was joined in the conference’s opening ceremony the Rev. Joseph McShane, president of Fordham University; William Baker, of Fordham’s Bernard L. Schwartz Center for Media, Public Policy, and Education; and FBI New York Assistant Director in Charge William F. Sweeney, Jr.

Wray said there are numerous different types of cyber threats facing the country—nation-state intrusions, hacktivists, insider threats, and, more recently, the so-called “blended threat” of nation-states using criminal hackers to work for them.

But as hackers and criminals evolve, the FBI is changing, too, Wray said.

The Bureau is developing the cyber skills of its workforce and organizing its personnel to work the threat most effectively. For example, the FBI’s Cyber Action Teams can deploy at a moment’s notice, much the way counterterrorism teams respond to an attack or threat. Additionally, Cyber Task Forces in every FBI field office respond to breaches, conduct investigations, and collect actionable intelligence. The FBI is also strategically embedding cyber agents with international partners to build relationships and coordinate investigations.

Wray cited recent cyber successes, including the international effort to take down Darknet marketplaces AlphaBay and Hansa Market, as well as identifying and bringing indictments against four hackers who stole information on millions on Yahoo! users.

Partnerships are key to the FBI’s success in its cyber efforts, and the Bureau is always working to develop collaborative relationships with both law enforcement and the private sector. Wray encouraged the private sector to keep the lines of communication open, especially in the event of a breach of their systems.

“While we may not be able to stop all threats before they begin, we can do a lot more in the early stages, at the beginning, to stop threats before they get worse. We can share information. We can identify signatures. We can stop similar attacks from happening elsewhere,” Wray said. “But to do that, we need the private sector to work with us.”

Once hackers or other cyber adversaries are identified, the FBI and partner agencies work to impose some cost on them—even if they are not in the United States to be arrested and tried in the American justice system. Sometimes the best approach is “naming and shaming”—unsealing indictments and letting cyber criminals know that they are fugitives wanted by the FBI—or seeking sanctions from the Treasury Department.

Wray described the “urgency of the task we all face” and said all parties involved in cyber security need to “raise our game” as the threats grow. He specifically cited the “Going Dark” problem—in which the FBI and other law enforcement agencies cannot access devices lawfully allowed to be accessed with appropriate technical tools—as a critical issue that the private and public sectors must work collaboratively to solve to preserve public safety.

“Whether we're in law enforcement, the government, private sector, technology industry, the security field, and academia—we're going to need to figure out a way to work together and stay ahead of the threat and to adapt to changing technologies and their consequences, both the expected ones and the unexpected ones,” Wray said. “Because at the end of the day, we all want the same thing—which is to protect our systems, protect our innovation, and above all, to protect our people.”

In a subsequent session at the conference, FBI Cyber Division Assistant Director Scott Smith briefed attendees on the FBI’s global partnerships, particularly the success the FBI has had in working closely with Europol and its cyber crime center. Most recently, the partnership helped take down the Andromeda botnet.

“These aren't issues of the United States, and these aren't issues of any country alone,” Smith said. “They are global issues that require global solutions to the problems.”