Evil Corp: 2. Into the storm

Pipsy podcastin on suoraan järjestelmää. Kato. - Anme ehtin myös nähdä mitä sä teet. - Vuokrasinkkodin. - Oho. Sujuu kuin Sato. Vuokraa elämäsi koti. Satopistetti. - Sistää. Mitä tämä joukkaina rikki? - Sami fixa se just. - Sami huu. - Meidän talo mestarek. Sujuu kuin Sato. Satopistetti. STOIMS Wyatt pronouncemarde, presenterini aloja, JORGE W. Bush. Fl이야 k tampi ha læjri Pajina - voi cascade - Moimasp ההän al joukoilta - yapılоль iconon reuniopilissa huom標 extrajämpi, mutta he Erde käy pitän miehen aiheழenkoin pu proceso - PUOMI sokle että peruste Tat improve me liittyen re趁pi ha透äin antaa heugeräli pytyin Hykäisiä Kirse séliopitton 2008, questa miserableни. Sulitit ordinaineeko,Open. Suomналas assumedisteritieceklasta, suuroon beverageet ja tääl sudosituhin vakko entregota viristorsaticia. On sen -koumbiön kirj heartista, että tehtyyn juokuhini on� cultural requirementsa et selukitaisessa erittovat ja passion傳h hopeless 설� digitalitぺowellini. O Boost das. Bowy fighting world. 2020 - paaabushadisiin delat. V這個ilee vartenti (gunnaalien - Samistetta - Marien - kuten on valmiin, joten on valmiin, joten on valmiin, joten on valmiin. Se on tullut katsomaa, että on katsomaa, että on katsomaa, että on katsomaa, ja se on tullut hienoa, että on katsomaa. Jim on tullut katsomaa, että se on katsomaa. Täällä, että se on katsomaa, että se on katsomaa. Täällä on katsomaa. Ja on katsomaa, että se on katsomaa. Ja se on katsomaa, että se on katsomaa, että se on katsomaa, ja se on katsomaa, että se on katsomaa, että se on katsomaa. Ja se on katsomaa, että se on katsomaa, että se on katsomaa, että se on katsomaa, että se on katsomaa, että se on katsomaa. Joten se on katsomaa, että se on katsomaa, että se on katsomaa, että se on katsomaa. Täällä on katsomaa, täällä on katsomaa. keskrein ja koko kats kiinnostetaan forumsnaa alkaa moneeelle - lu Theater - ja joskus kuten Tänö Lehrämme, - hän on jokaa jälkeen. En jokaa. Kutu, Sibahack, Season 3 - eivät kohdalla, - saavaa VBC-suele. Kalle Sibahacka - Viime Sibahacka - VBC-sibahacka - VBC-sibahacka - VBC-sibahacka - VBC-sibahacka - Jumkrega - VBC-sibahacka - VBC-sibahacka - VBC-sibahacka - VBC-sibahacka - VBC-sibahacka - whole archive of the hackers past conversations. It is a huge dump of evidence. (upbeat music) For Jim, it's a jaw-dropping moment, and it won't be his last. - It was gigantic. It was case-breaking. It's a sigh of relief, but then also, it caused excitement and, you know, what are the next steps? Where do we go from here? - From here comes the hard work of sifting through it all and teasing out leads. There's a crazy amount of information. Most of it in Russian and Ukrainian, but even with basic translation. - There really mean no sense. Well, this doesn't make any sense. I mean, we don't know what this means. - The hackers were speaking in some kind of code or slang. Jim calls on FBI translators and even starts learning Russian himself. Over time, the team builds up a hacker dictionary to understand every message quickly, but there's still so much information. - We had to find a way to go through all this data. We had email addresses. We had IP addresses. We had messages. But it's all just data and going through it is painstakingly slow. - This is my first case. I'm also a new agent, so I don't have a lot of clout in the office, but I needed to recruit people, senior agents, other individuals, professional support staff even, to assist me with going through spreadsheet after spreadsheet of just data points. - Jim's team grows to about a dozen people, not computer experts per se, just people he can draw into the case. - They're facing the digital equivalent of a million-piece jigsaw puzzle, dumped on the table in front of them, with no idea what picture they're trying to piece together. There's frustration. - Like, I don't know what I'm looking for, but what's an IP address? Why is this email address important? - Jim is trying to organize the information in a way that reveals the bigger picture, specifically who exactly are the people in this jabbage at? But the team's getting nowhere. - They would sit in the conference room and just scroll through Microsoft Excel spreadsheets all day. It doesn't sound sexy, 'cause it just isn't. - It's not sexy and even worse, it's not productive. - And it matters because, well, Jim's team are hunched over computers in Omaha or Grumpy, the hackers, who they're now pretty sure are somewhere in Russia or Ukraine, are still emptying American bank accounts with Glee. - The victims are piling up. Jim needs a breakthrough. He calls a private contractor, he knows, another former Marine, who specializes in electronic forensics. Jim's FBI bosses agree to send him to Omaha, and he gets to work with a Splunk. - A Splunk? Yeah, it's a powerful indexing tool that swallows all the jabbage act data and starts to make sense of it. Patent's surface handles connect to IP addresses. IP addresses connect to emails, emails connect to bank accounts. - In other words, this sophisticated software is generating leads. - Literally in the front of you gave you who's who, how much they're discussing, who are they discussing it with, their IP address, emails associated with those individuals. I mean, this was the next big break in the case. - It means Jim and his team can finally start working out who's behind this use crime wave, though they still don't have any names or physical addresses. - But Jim can see something, only a handful of people seem to be pulling the strings, and two of the most prominent are aliases we already know. - Aqua and Tank. - These are the same two that Brian Krebs exposed in his Washington Post article, accusing them of stealing more than $400,000 from Bullet County in Kentucky. - And we know how that went down. - They described the entire scheme, the bastards. - Now the entire USA knows about Zeus. - Not that it really made a difference. - The tension they got from Bullet County, it didn't put a hiccup in their operations. - So you didn't see them kind of go quiet, immediately start changing their activity, stop doing the malware attacks? - Not at all. - But you think that's arrogance? - I'm sure it was. - And as if to underline their arrogance, the pair's talk turns from stealing money to how they're going to spend it. - I know there's discussions about cars, tank, I believe, at that time he had a BMW, one of the higher price ones, which kind of gives you an idea of who they are, but also let you know too that they're unfortunately they're making money. - Jim, remember, isn't reading these conversations live. - Their old messages copied from the Brooklyn server. He's still playing catch up. But in those dreams of data, they're getting an idea of who does what, tank seems to be at the center of the operation in Ukraine. - Then in a message dated July the 22nd, 2009, about a month after the Bullet County heist, tank slips. Pride gets the better of him. - Yeah, you know, congratulate me. My daughter was born. - Tank's message in a Jabba chat includes his daughter's name. - And he provided the weight of his daughter. - Small details, yes, but hugely significant. Now Jim can follow up on that hunch about tank being in Ukraine with something solid, the name, date of birth, and weight of a child. - Find the child, find Tank, a key player in this ongoing multi-million dollar scam. - Find Tank and maybe you find Aqua too, and the rest of them. - Jim contacts the Ukrainian security service, the SBU. Can they check the hospital's medical records, local birth announcements, anything that might help ID this child and her family? - And ultimately that came back. - Do you suddenly have a proper name for Tank? - And now we have a proper name for Tank, exactly. Now we know exactly who he is. You've just left Pinchikov. - How fitting our fresh, faced agent finds his big break with a baby. (dramatic music) (upbeat music) (upbeat music) - By autumn 2009, the investigation into the Jabba Zeus crew is growing. It's not just Jim and the FBI in Omaha. The Ukrainian authorities now know of suspicious dealings on their turf. - All the while the American private investigator Lawrence Baldwin is still living his Zeus nightmare months after he first gained access to the gang's Jabba server. He's seeing them chat in real time and is working day and night to warn potential victims across the US. But now he's also seeing them talk about hacks elsewhere in the United Kingdom. - I had contacts at some of the UK banks, and so I pinged them and say, hey, you might want to look at this account. And all I had to do was do that like two or three times and then it was like, hey, can we talk? (laughing) I'm like, yeah, sure. - The banks jump on the phone and say, tell me where you're getting this because we have been literally pulling our hair out for months with a absolutely major fraud ring, stealing hundreds of thousands of pounds monthly. - It's the Jabba's use crew using the same playbook it used to target victims in the US, stealing bank details and funneling stolen money through mules who then either cash out or wire it overseas. British police call the crime state of the art. Lawrence can see from the chat and from nosing around elsewhere online that someone is organizing the mules and managing the accounts. But who? - What was so frustrating was we knew we had a mule operator that was coordinating all these mules and we knew he was operating on the ground in the UK and all the banks could see the accounts. So we knew that, but it's like we had no insights into like where was we didn't have any IP addresses for him or anything like that. We wanted to do a referral to the Metropolitan Police but we didn't feel like we had enough to go on. - So Lawrence keeps watching to see what else he can learn. Every day he gets a snapshot of this person's online life and then something odd. - One day I almost ignored it, but I saw a connection to Domino's.co.uk and I was like, yeah, okay, whatever. And then I'll wait a minute. Pizza. Like there's only two ways to get pizza that I know. It's like you either go to the shop and pick it up or you have a delivered, and I'm like, have a delivered, oh my God, this can be huge. - He holds his breath. How much detail can he see? - Sure enough, he sees it. pizza order, not just any pizza, a Vege Roma. It's the healthy diet for the average Russian cyber criminal. But the payment details are encrypted. You can't see them. It did not list the address or anything. So I couldn't even tell if it was a delivery order or pickup order, but I had the order number. And I was like, this is probably enough. So I forward that over to the Met. And I was like, you want to go look at this. And this is why. Lawrence has done all he can from his side of the Atlantic. So he passes on his cheesy clue. Now it's over to Britain's biggest police force, London's Metropolitan Police Service, the Met. In early 2010, Detective Sergeant Simon Williams is running intelligence teams in the Met's Counterterrorism Unit, where he's asked to work on something new. The Zeus case. Yeah, I won't say I knew a great deal about cyber crime in that era, but he's not phased. He's an experienced investigator. It was traditional crime taking place just happened to be stepping into the online world. Simon is briefed on the UK case so far. Some 600 victims, 1200 unlawful online banking transactions and hundreds and hundreds of money-meal accounts. It was a big problem definitely for the UK banking sector. About 4.2 million had been stolen between October 2009 and the early part of 2010. Over four million pounds, that's nearly five and a half million dollars, stolen in a matter of months. And that's just from victims in the UK. Meanwhile, the FBI also shares its intel with the Met, including the Jabba chats they had recovered. This is a huge boost for the British cops. Simon starts looking for clues and sees everything we've already heard about. A lot of chat in both Russian and Ukrainian, about endless bank account details and talk of money-mills. Then his team spots something totally unrelated to the crimes. Almost something to ignore. Almost. There's someone else in the Jabba's use chat. Someone in the UK. And a member of the crew in Ukraine is asking them a favor. Can they buy a Thomas the Tank Engine toy for his young son? He says they sell them at Toys at Us in London. The guy in the UK says, "Sure." Later in the chat, the guy says, "Yep, I've got your toy." Simon knows instantly this seemingly inocuous request, just one friend helping another could be gold. One of the wonderful things about the chat logs of course is we had date and time and we knew the time zone as well. So we could be fairly specific. His detectives get on the phone to Toys at Us. How many of these Toys have you actually sold in London in the last four days and specifically how many on this day? They narrow it down to two locations. Simon sends officers to seize the CCTV footage, but he knows the clock is ticking. Typically stores would rotate CCTV every 28 days, so it's really important that you go and seize videos within that time period, otherwise you'll lose the evidence. They make it on time. They scroll through the footage and there he is. A man in his late twenties buying the Thomas the Tank Engine toy. Then it's a case of, well, actually, let's see what he's used for the payment for that transaction. That ended up with us identifying that he was using the fake and fictitious name of Pervel Klikov. Klikov. Click off. Get it? But this fake alias leads to a real address, a block of flats in Chingford on the outskirts of London. Time to kick in the door? Not quite. So although we knew where he was living, we didn't know which property within, I think there was about nine apartments or flats in that building. Simon needs to find out which flat the mysterious Klikov is in without being seen. So he sets up a covert camera, pointed at the front door. It rolls 24/7, recording everything. We saw all sorts of cars coming and going, and it did take us a few weeks to actually work out which flat he lived in. Detective Sergeant Simon has an address, but no name, at least not a real one. Then pizzas back on the menu. Simon finds that the same two hackers who talked in the chat about the Thomas the Tank Engine toy had also been talking about pizza and the details. They match what cyber sleuth Lawrence Baldwin had flagged to the Met Police months earlier. So Lawrence's tip helps corroborate Simon's investigation because, and here's the kicker, the pizza was delivered to the very address, Simon's team is watching. He'd ordered a specific type of pizza from a specific pizza rear. We were able to see by serving a request on said pizza company. We were able to prove that indeed that very night he had ordered that specific type of pizza from that specific pizza restaurant and we got his payment for that as well. We were able to, you know, confirm again it was him. And this time Simon discovers parvel click offs real name, Yuri Conneva Lenko, or as we like to call him Mr. Pizza. His main role was the UK based money mill herder or money mill coordinator. So his role was to work with the money mills in the UK to help them open bank accounts, to help funnel money into those bank accounts. And the money mills would get a cut of the money and then he would collect the rest, which means the jabber Zeus crew is no local outfit. It's transnational. And Mr. Pizza appears to be the most senior member based in the UK. We had surveillance teams deployed to follow Conneva Lenko in the UK. We would see him leave. He didn't drive himself. He would be picked up by a variety of money mills. They would just go from bank to bank to bank. Creating new accounts and withdrawing stolen money. For now Simon continues watching Mr. Pizza. He doesn't want to arrest him yet. He wants to catch the whole gang. The scale of the jabber Zeus operation is coming into focus and everything leads east. A white van regularly stops outside the flat in Chingford. Each time the driver and Mr. Pizza talk. Simon suspects they're smuggling bundles of cash overseas. Law enforcement on both sides of the Atlantic see the same thing. An army of money mills draining cash from accounts in the US and the UK. And in Eastern Europe they discover another web of accounts where the money lands. The stolen funds are flowing through banks in Poland, Romania, Moldova and Russia before finally ending up in Ukraine. And that's where we catch up with our rookie FBI special agent Jim Craig heading to Ukraine hoping to get one step further in nailing his first big case flying into the eye of the Zeus storm. I was very excited. And very well informed. It's summer 2010. A year after the first jabber Zeus victims came to light and Jim Craig now knows a lot more about the gang. Remember he now knows tank's name. Vitchislav Pinchikov. Now thanks to the Ukrainian authorities he's got his address too. Tank lives in Danyetsk in Eastern Ukraine near the Russian border. Today you might know Danyetsk is one of the areas occupied by Russian forces. But back then it was one of Ukraine's major industrial cities. Jim's intel suggests tanks the one in charge. As for his apparent partner Aqua he's still a ghost and likely over the border in Russia where it looks like he's the one running the moneymules. Jim's also discovered that the Zeus gang's reach extends further across Europe. As well as those computers in New York they've also got a server base in the Netherlands. All these different jurisdictions make for a tricky investigation. But Jim arrives in Ukraine's capital Kiev in the hope of bringing these threads together. His mission to lay the groundwork for simultaneous raids on the jabber Zeus crew in Ukraine, the Netherlands and Russia. His first meeting is at the opera hotel. I know that place it's this fancy boutique hotel right in the city centre. Pretty heavy on the marble and the chandeliers. Jim's guests agents from the FSB Russia's security service. I guess I would coin it as a just a friendly law enforcement sit down with the FSB at the opera hotel. We're sitting outside having a few drinks and I would say it's very much an opportunity for us to try to build some rapport in hopes that that would turn into more cooperation and more information coming our way regarding Aqua and any other individuals who may be involved in this crime from Russia's side. This icebreaker between the Americans and the Russians in the heart of Kiev is from another era. Before Russia's invasion of Ukraine, before the bitter enmity with the West, a meeting like this now is unthinkable. But back in 2010, it was just four or five agents from each side drinking beer and chatting about their lives. The Russians know Jim is planning a big move against the Jabba Zeus crew. And he wants their help. They seem very cooperative, they seem very eager to take part. Of course you have to kind of consider is the eagerness based on information that they want to try to gather intelligence around our operation and see who we know or how we know. Keep an eye on you. I would have to say yes, that was probably the case. The two sides say they're goodbyes, but they'll see each other again the next day. The head of Ukraine's SPU Security Service has invited them all to his dacha, his country house, out in the woods. It was amazing. The car right there was interesting, going through quite an extensive amount of trees and on a back roads. And finally reaching this beautiful, beautiful dachard, very expansive, looking over a very heavily forested area. It was very impressive. A bit of context here. The head of the SPU at the time was also said to be one of Ukraine's richest people. And arriving at his country getaway, Jim feels like he's arrived at the private retreat of a head of state. And this is where the real work of Jim's trip begins. The SPU, FSB, the dacha at crime unit and the FBI came together. So that's a pretty big deal in the forest. It was a very big deal. The job is to work out how to take down the Jebazou's crew. How will cooperate, who will cooperate, what will each party's part be in the investigation? They spend the day chewing over these questions. Jim feels like they're making real progress. They've got targets in their sights now. And at the end of a long day of meetings, staff usher them into the large dining room. They wind and dine, do you? Yes, they did. That for sure. It was an amazing dinner. The agents all in suits and ties gather around a huge table. A beautifully set table, the glassware, the plates, the planks, knives, everything there would be something you would see at a five-star restaurant. That would be very, very expensive. The servers bring dish after dish. Kavya, exquisite fish courses, fine wines. And then of course, came and poured the vodka into these hot glasses. Come on from the SPU's stands up and makes a toast to fallen comrades. Everyone drinks. And the shot glasses are refilled. Then the next agent does the same thing. He names someone who's died in the line of duty and everyone drinks. Again, the glasses are refilled. Jim realizes they're going around the whole table. Everyone's doing it. There are a lot of people at that table. So you can imagine the amount of vodka shots that probably went around that table. The game to a point where I was just filling my shot glass with water because I could not have kept up. I've been there. I know that moment. I've poured plenty of shots of vodka into flour pots in my time. Yeah. Yes. You had to be discreet because while it was a big table, you were still pretty close. The dinner stretches hours into the night. Jim remembers lots of laughs and handshakes. Finally, with bellies full of five-star food and all that wine and vodka, Jim and the rest of them push back from the table. What a day. Jim's proud of what's been achieved. Absolutely. 100% the amount of cooperation. And I guess the eagerness sitting at that table at the dacha, I would have very much thought that this was going to be a huge success. Jim leaves the dacha convinced. This alliance will bring down the jabberzouk crew. A date is set. September 29, 2010. There'll be coordinated raids in Ukraine, Russia and beyond. And the British police want in too, planning to swoop in on Mr. Pizza and others in London at exactly the same moment. Everything is falling into place. It all began when a boring case landed on Jim Craig's desk. A year later, the rookie agent has turned it into a global manhunt. For too long, these hackers have hidden behind screens and fake names and borders. Now a reckoning is coming. Their real names and real addresses are known. Soon, there'll be real agents banging on their doors. The end game is near. Also it seems, because months earlier in Danyask, the Chislov Penshukov, aka Tank, had already received a warning. They know your real names, they know your handles, they know your internets and so be careful. Next time on CyberHack Evil Core. This has been episode two of six of season three of CyberHack Evil Core from the BBC World Service. CyberHack Evil Core is a BBC long form audio production for the BBC World Service. It's presented by me, Joe Tidy and me, Sarah Reinsard. We'd like as many people as possible to hear our stories, so please leave a rating in a review and do tell others about CyberHack. It really does help. If you haven't already, don't forget to check out the previous seasons of CyberHack, the story of the Lazarus Heist. If you've enjoyed this episode, follow us to CyberHack on BBC Sounds or if you're outside the UK on BBC.com. Thanks for listening. What do Beatles members support McCartney? YouTube, Megastar, MrBeast and former Facebook executive Cheryl Sandberg all have in common. They're all being discussed in the new season of Good Bad Billionaire, the podcast which explores the lives and fortunes of the world's super rich. That's Good Bad Billionaire from the BBC World Service. Listen now at such a Good Bad Billionaire wherever you get your BBC podcasts.