Not that they knew him personally, but Taylor Huddleston, a 27-year-old from Hot Springs, Arkansas, was for a time very popular among the world’s cyber criminals, thanks to a malicious piece of software he created called NanoCore RAT.

That malware allowed hackers to steal sensitive information from victims’ computers, including account numbers and passwords, and even allowed them to secretly activate the webcams of infected computers to spy on unsuspecting victims.

“Basically, the malicious software compromises victim computers and steals information,” said a special agent from the FBI’s Washington Field Office who investigated the case. “The NanoCore RAT has the ability to control a victim’s computer.”

This type of malware—a Remote Access Trojan (RAT)—is all the more insidious because in most cases victims have no idea their computers have been compromised. According to court documents, NanoCore RAT was used to infect and attempt to infect more than 100,000 computers.

RATs are not only a threat to individual users but to commercial enterprises as well. And if hackers decide to target U.S. infrastructure using this malware, the agent said, “there is a potential for national security implications.”

Huddleston had the skills to develop malicious software. “There are many cyber criminals out in the world,” the agent said. “Many are not sophisticated in terms of developing a new malware. Instead, they would rather purchase malware to carry out their crimes.”

Huddleston didn’t stop with NanoCore RAT. He also developed and profited from Net Seal, a fee-based licensing software that he and his customers used to distribute NanoCore RAT and other malware.

Net Seal enabled other malware developers to license their illicit products for a fee and then use the Net Seal platform to widely distribute them. After malware buyers paid the seller, buyers received a licensing code allowing them to download the software. Like legitimate software, it could not be shared with anyone else. Such transactions are part of a huge underground economy on the Internet—known as the dark web—where criminals buy and sell illegal goods and services.

For example, court records detailed that Huddleston used Net Seal to assist one cyber criminal in the distribution of malware to approximately 3,000 people that was in turn used to infect approximately 16,000 computers.

Huddleston’s illegal activities surrounding the Net Seal platform became known to authorities, and the FBI opened an investigation in September 2015. The investigation eventually led to NanoCore RAT and ultimately to Huddleston.

Huddleston was arrested in February 2017 and charged with aiding and abetting computer intrusions. He pleaded guilty, admitting that he intended his products to be used maliciously. In February 2018, a federal judge sentenced him to 33 months in prison.

A recently closed California hacking and identity theft case sadly illustrates the misery that can be visited on unsuspecting victims when their personal information is compromised.

Between 2011 and 2014, four U.S. citizens who resided in San Diego—but carried out their crimes from across the Mexican border in Tijuana—hacked the computer servers of major U.S. mortgage brokers, stealing detailed loan application information from thousands of customers and then using the victims’ Social Security numbers, addresses, dates of birth, and driver’s license numbers to open unauthorized lines of credit and take over and drain victims’ retirement accounts.

“The damage crimes like these have on victims, the economy, and society in general are significant,” said Special Agent Chris Christopherson, who investigated the case from the FBI’s San Diego Division. “Individuals had their finances wrecked and their credit destroyed, through no fault of their own. For many of them,” he added, “the impacts are still being felt.”

One of the fraudsters in the conspiracy, John Baden, was the chief hacker. He infiltrated mortgage companies using a common hacking technique known as “fuzzing,” which works by overloading a web server with massive amounts of data that can lead to the server revealing security loopholes.

Once Baden had access to victims’ information, he and his conspirators, Victor Fernandez, Jason Bailey, and Joel Nava, went to work. Fernandez—the group’s ringleader—identified multiple victims’ brokerage accounts and took control of them by calling the companies and providing the victims’ personal information to change passwords and contact information. Then it was simple for him and his conspirators to wire funds—sometimes up to $30,000 at a time—from the victims’ accounts to accounts they controlled.

Victims stretched from California to Florida, and one individual lost nearly $1 million in the scheme, Christopherson said. A second part of the scheme involved extensive credit fraud. The criminals used victims’ detailed personal information to set up bogus lines of credit and retail credit card accounts to which they charged thousands of dollars for goods and services. Most of the proceeds from the sale of items in these crimes were used to buy drugs.

In all, Christopherson estimated there were more than 25,000 victims, and although charging documents listed victim losses at approximately $2.5 million, “in reality the amount was much higher than that,” he said. “There was so much retail fraud over such a long period of time, it was impossible to calculate an accurate and provable loss amount.”

The FBI was alerted to the fraud by a financial institution that noticed irregularities, and about the same time, FBI cyber investigators detected that many victims had a “common point of compromise,” Christopherson said. “They had all recently applied to the same mortgage company.”

Armed with that information, investigators worked backward from the mortgage company, eventually identifying the hack—and the hackers. By that time, Baden was hiding in Mexico. In 2014, he was named to the San Diego FBI’s Most Wanted Cyber Fugitives list, and the reward offered in the case eventually led to his capture in Mexico, Christopherson said.

All four subjects pleaded guilty to their roles in the fraud scheme. In 2015, Baden was sentenced federally to nine years in prison. In January 2018, Fernandez was sentenced to more than 10 years in prison. Bailey received a sentence of more than five years, and in February 2018, Nava was the last subject to be sentenced, to 44 months in prison.

But even years after the crimes were committed, Christopherson said, “the court was still receiving victim impact statements.” Many victims were unable to get jobs or be approved for mortgages or car loans because their credit had been ruined by the fraudsters.

“We are pleased that these criminals are now behind bars and will not be able to victimize anyone else,” said Christopherson, who encouraged the public to regularly check their credit information to make sure their personal information has not been compromised.

As hacks, data breaches, and other cyber-enabled crime become increasingly commonplace, this year’s National Cyber Security Awareness Month is an important reminder of the need to take steps to protect yourself and your family when using the Internet. Launched in 2004 by the Department of Homeland Security and the National Cyber Security Alliance, the annual campaign held every October is designed to help the public stay safe online and to increase national resiliency in the event of a cyber incident.

“Cyber risks can seem overwhelming in today’s hyper-connected world, but there are steps you can take to protect yourself and reduce your risk,” said Assistant Director Scott Smith of the FBI’s Cyber Division. “The FBI and our partners are working hard to stop these threats at the source, but everyone has to play a role. Use common sense; for example, don't click on a link from an unsolicited e-mail, and remember that if an online deal seems too good to be true, it probably is. And overall, remain vigilant to keep yourself and your family safe in the online world, just as you do in the physical world.”

How can you protect yourself?

Today, federal authorities—including the Department of Justice and the FBI—announced a major coordinated law enforcement effort to disrupt international business e-mail compromise (BEC) schemes that are designed to intercept and hijack wire transfers from businesses and individuals. 

Operation WireWire—which also included the Department of Homeland Security, the Department of the Treasury, and the U.S. Postal Inspection Service—involved a six-month sweep that culminated in over two weeks of intensified law enforcement activity resulting in 74 arrests in the U.S. and overseas, including 42 in the U.S., 29 in Nigeria, and three in Canada, Mauritius, and Poland. The operation also resulted in the seizure of nearly $2.4 million and the disruption and recovery of approximately $14 million in fraudulent wire transfers.

A number of cases charged in this operation involved international criminal organizations that defrauded small- to large-sized businesses, while others involved individual victims who transferred high-dollar amounts or sensitive records in the course of business. The devastating impacts these cases have on victims and victim companies affect not only the individual business but also the global economy. Since the Internet Crime Complaint Center (IC3) began formally keeping track of BEC and its variant, e-mail account compromise (EAC), there has been a loss of over $3.7 billion reported to the IC3.

BEC, also known as cyber-enabled financial fraud, is a sophisticated scam that often targets employees with access to company finances and trick them—using a variety of methods like social engineering and computer intrusions—into making wire transfers to bank accounts thought to belong to trusted partners but instead belong to accounts controlled by the criminals themselves. And these same criminal organizations that perpetrate BEC schemes also exploit individual victims—often real estate purchasers, the elderly, and others—by convincing them to make wire transfers to bank accounts controlled by the criminals.

Foreign citizens perpetrate many of these schemes, which originated in Nigeria but have spread throughout the world.

During Operation WireWire, U.S. law enforcement agents executed more than 51 domestic actions, including search warrants, asset seizure warrants, and money mule warning letters. And local and state law enforcement partners on FBI task forces across the country, with the assistance of multiple district attorney's offices, charged 15 alleged money mules for their roles in defrauding victims. 

The role of money mules, witting or unwitting, in BEC schemes is very important—they are used to receive the stolen money and then transfer the funds as directed by the fraudsters. The mules usually keep a fraction of the money for their trouble.

Today’s announcement highlighting this recent surge in law enforcement resources targeting BEC schemes “demonstrates the FBI's commitment to disrupt and dismantle criminal enterprises that target American citizens and their businesses,” according to FBI Director Christopher Wray.

And he added, “We will continue to work together with our law enforcement partners around the world to end these fraud schemes and protect the hard-earned assets of our citizens. The public we serve deserves nothing less.”

As the threats from hackers and other cyber criminals grow, the FBI is committed to developing its workforce’s cyber expertise, building partnerships, and punishing cyber criminals who target the United States, FBI Director Christopher Wray said at a major cyber security conference this week.

“Today, we live much of our lives online, and we're in a situation where just about everything that is important to us lives on the Internet. And that’s a pretty scary thought for a lot of people,” Director Wray said. “What was once a minor threat—people hacking for fun or bragging rights—has now turned into full-blown nation-state economic espionage and very, very lucrative cyber criminal activity. The threat is now coming at us from all sides.”

Sponsored by the FBI and Fordham University, the International Conference on Cyber Security featured expert speakers—including several FBI officials—on a wide variety of cyber-related topics, ranging from botnets and malware to disinformation campaigns and attacks on critical infrastructure. Wray was joined in the conference’s opening ceremony the Rev. Joseph McShane, president of Fordham University; William Baker, of Fordham’s Bernard L. Schwartz Center for Media, Public Policy, and Education; and FBI New York Assistant Director in Charge William F. Sweeney, Jr.

Wray said there are numerous different types of cyber threats facing the country—nation-state intrusions, hacktivists, insider threats, and, more recently, the so-called “blended threat” of nation-states using criminal hackers to work for them.

But as hackers and criminals evolve, the FBI is changing, too, Wray said.

The Bureau is developing the cyber skills of its workforce and organizing its personnel to work the threat most effectively. For example, the FBI’s Cyber Action Teams can deploy at a moment’s notice, much the way counterterrorism teams respond to an attack or threat. Additionally, Cyber Task Forces in every FBI field office respond to breaches, conduct investigations, and collect actionable intelligence. The FBI is also strategically embedding cyber agents with international partners to build relationships and coordinate investigations.

Wray cited recent cyber successes, including the international effort to take down Darknet marketplaces AlphaBay and Hansa Market, as well as identifying and bringing indictments against four hackers who stole information on millions on Yahoo! users.

Partnerships are key to the FBI’s success in its cyber efforts, and the Bureau is always working to develop collaborative relationships with both law enforcement and the private sector. Wray encouraged the private sector to keep the lines of communication open, especially in the event of a breach of their systems.

“While we may not be able to stop all threats before they begin, we can do a lot more in the early stages, at the beginning, to stop threats before they get worse. We can share information. We can identify signatures. We can stop similar attacks from happening elsewhere,” Wray said. “But to do that, we need the private sector to work with us.”

Once hackers or other cyber adversaries are identified, the FBI and partner agencies work to impose some cost on them—even if they are not in the United States to be arrested and tried in the American justice system. Sometimes the best approach is “naming and shaming”—unsealing indictments and letting cyber criminals know that they are fugitives wanted by the FBI—or seeking sanctions from the Treasury Department.

Wray described the “urgency of the task we all face” and said all parties involved in cyber security need to “raise our game” as the threats grow. He specifically cited the “Going Dark” problem—in which the FBI and other law enforcement agencies cannot access devices lawfully allowed to be accessed with appropriate technical tools—as a critical issue that the private and public sectors must work collaboratively to solve to preserve public safety.

“Whether we're in law enforcement, the government, private sector, technology industry, the security field, and academia—we're going to need to figure out a way to work together and stay ahead of the threat and to adapt to changing technologies and their consequences, both the expected ones and the unexpected ones,” Wray said. “Because at the end of the day, we all want the same thing—which is to protect our systems, protect our innovation, and above all, to protect our people.”

In a subsequent session at the conference, FBI Cyber Division Assistant Director Scott Smith briefed attendees on the FBI’s global partnerships, particularly the success the FBI has had in working closely with Europol and its cyber crime center. Most recently, the partnership helped take down the Andromeda botnet.

“These aren't issues of the United States, and these aren't issues of any country alone,” Smith said. “They are global issues that require global solutions to the problems.”

The FBI’s Safe Online Surfing (SOS) Internet Challenge—a free, educational program for children that teaches cyber safety—has been redesigned for the 2017-2018 school year, with new graphics and updated content.

The new SOS program, created for students in third through eighth grades, covers age-appropriate topics, such as cyberbullying, passwords, malware, social media, and more. The program also provides teachers with a curriculum that meets state and federal Internet safety mandates.

While taking the course, participating students “surf” their way through a variety of Internet safety challenges at each grade level, with characters guiding them through the games. The latest version of SOS allows the program to work on more devices, including tablets. The content has also been refreshed to address current cyber safety challenges, and the island-theme graphics have been updated.

“Just as we teach our children to lock the front door for their physical safety, we have to teach them the online equivalents of those things in the digital age, like creating a strong password,” said Unit Chief Jonathan Cox of the FBI’s Office of Public Affairs. “SOS helps to make students better digital citizens in a fun and educational way.”

Last school year, more than 700,000 students across the country completed the program and took the test, a 41 percent increase from the previous school year. More than 1.5 million students have participated and taken the exam since the original program was launched in 2012.

The SOS activities are open to anyone, though to participate in the testing and challenge, teachers must register their classes. Teachers manage their students’ participation in the program; the FBI does not collect or store any student information. Each month from September through May, the classes with the top exam scores nationwide receive an FBI-SOS certificate and, when possible, they are visited by local FBI personnel to congratulate them.