Shields Up!: Russians and botnets and money mules oh my!

Researchers have discovered that a Russian gang is conducting a check counterfeiting operation using money mules and the Zeus botnet. The botnet was used to pump out spam advertising lucrative sounding ads advertising “payment processor” jobs, harvest email addresses from job search sites like Monster and Careerbuilder, steal check images from sites that store them digitally using SQL injection attacks, crack CAPTCHAs and even conduct a little spear phishing campaign on the side. It’s raked in over $9 million so far.

If you’re looking for work you’ve probably seen one of their ads. They describe a job as a “payment processor” and the story usually goes that they are a company wanting to do business overseas but needing help processing payments from customers who pay via check. Their usual excuse is something like it’s too expensive for them to do it in their country or there are tax issues. They promise a big salary for 1-3hrs of work a day and all you have to do is agree to receive checks from their “customers” , take them to your bank, cash them, keep your percentage and send the rest of the cash to them via Western Union. Needless to say it’s all a scam. The checks they send you are fake, made from the images they stole, and when they eventually bounce, they criminals will be long gone and the “payment processor” will be left holding the bag.

The researchers haven’t yet been able to pinpoint the individuals responsible for the operation but they are working on it.

Read [CNet]