A member of an international cybercrime organization responsible for a cyberattack that inflicted millions of dollars in losses on the global financial system over the course of two days in 2011, pleaded guilty to bank fraud.
Qendrim Dobruna, 27, who officials were able to extradite from Germany, and his co-conspirators hacked into the systems of a U.S.-based credit and debit card payment processor that processed debit card transactions for the American Red Cross in connection with disaster relief victims, according to court records. The stolen card data then ended up disseminated worldwide and used in an “unlimited operation” that made $14 million in fraudulent withdrawals from ATMs across the globe.
Loretta E. Lynch, United States Attorney for the Eastern District of New York, and Robert J. Sica, Special Agent in Charge, United States Secret Service, New York Field Office, released the guilty plea.
“The defendant and his associates hacked into the global financial system and helped themselves to funds using prepaid debit cards meant for the needy and vulnerable,” Lynch said. “We will continue to work with our private sector partners to solve these 21st century heists and bring the perpetrators, no matter where in the world they may hide, to justice.”
“Our success in this case and other similar investigations is a result of our close work with our law enforcement partners,” Sica said. “The Secret Service worked closely with the Department of Justice and INTERPOL to share information and resources that ultimately brought Qendrim Dobruna to justice. This case demonstrates there is no such thing as anonymity for those engaging in data theft and fraudulent schemes.”
As described in the indictment, court filings in related cases, and public court proceedings, the cyberattack employed by the defendant and his co-conspirators was an “Unlimited Operation” – through its hacking “operation,” the cybercrime organization can access virtually “unlimited” criminal proceeds.
The “Unlimited Operation” begins when the cybercrime organization hacks into the computer systems of a payment card processor, compromises prepaid debit card accounts, essentially eliminates the withdrawal limits of those accounts, and manipulates the security protocols that would alert the victim to the attack. The compromised card data then goes out to cells worldwide that use the data to encode magnetic stripe cards to use at ATMs. These sophisticated techniques enable the participants to withdraw literally unlimited amounts of cash until officials finally detect the operation and shut it down. “Unlimited Operations” use three key characteristics:
• The surgical precision of the hackers carrying out the cyberattack
• The global nature of the cybercrime organization
• The speed and coordination with which the organization executes its operations on the ground
These attacks rely upon highly sophisticated hackers and organized criminal cells whose role is to withdraw the cash as quickly as possible.
In February 2011 the defendant and his co-conspirators targeted a publicly traded credit and debit card processing company based in the United States that processed transactions for prepaid debit cards issued by the American Red Cross for disaster relief victims. After the hackers penetrated the payment card processor’s computer network, compromised the American Red Cross prepaid card accounts, and manipulated the balances and withdrawal limits, casher cells across the globe operated a coordinated ATM withdrawal campaign. In total, more than 15,000 ATM transactions occurred in approximately 18 countries using the compromised disaster relief prepaid cards, resulting in $14 million in financial loss worldwide.
The defendant, also known by the aliases “cl0sEd” and “cL0z,” participated in the cyber-attack from overseas by obtaining account information from co-conspirators who directly hacked into the payment card processor’s database and selling that account information to other co-conspirators over the Internet, including to an individual in Brooklyn, New York. The defendant ended up arrested in an apartment in Stuttgart, Germany in March 2012 by the German federal criminal police and subsequently extradited to the United States.
The plea took place before Senior United States District Judge I. Leo Glasser. When sentenced on October 24, 2014, the defendant faces up to 30 years in prison, a fine of up to $1 million, and forfeiture of the proceeds of his crimes.