They worked as Web designers, supermarket workers, day laborers, some were unemployed. But U.K. police say that the group of Eastern Europeans,picked up in early morning raids Tuesday also made millions by operating a network of bank-robbing Trojan horse programs.
London’s Metropolitan Police charged 11 alleged members of the gang on Wednesday. Most of them were charged with conspiracy to defraud and money laundering crimes. They are due to appear in Westminster Magistrates’ Court court early Thursday morning.
According to police, the gang made £6 million (US$9.5 million) in one three-month period by infecting PCs with a variant of the Zeus Trojan. Using the malware’s ability gain unauthorized access to bank accounts, they then allegedly transferred money to accounts under their control.
“We believe we have disrupted a highly organised criminal network, which has used sophisticated methods to siphon large amounts of cash from many innocent peoples’ accounts,” the Metropolitan Police said in a statement.
Zeus has emerged as a major headache for banks in recent years, but the U.K. crew are not the masterminds of the operation, according to security experts.
Because the Zeus software is sold on the black market to cyber criminals, there are easily a dozen Zeus gangs in operation, and more than 160 command-and-control servers for the malware are still active.
“There are between 5 and 10 top-tier groups” said Don Jackson, a researcher with security vendor SecureWorks, who has studied Zeus. “This group in the UK was not one of those top groups, but wanted to be one.”
Police arrested 20 people in the Tuesday raid, but nine were bailed Wednesday. They may face charges at a later date.
Those who were charged were:
Yuriy Korovalenko, 28 a Ukrainian Web designer
Yevhen Kulibaba, 32, a Ukrainian property developer
Karina Kostromina, 33, unemployed, from Latvia
Aleksander Kusner, 27, unemployed, from Estonia
Roman Zenyk, 29, a laborer from Ukraine
Eduard Babaryka, 26, a driver from Belarus
Milka Valerij, 29, a laborer from Ukraine
Iryna Prakochyk, 23, unemployed, from Ukraine
Ivars Poikans, 29, a Latvian supermarket worker
Kaspars Cliematnieks, 24, a Latvian supermarket worker
Another man, Zurab Revazishvili, 34, of Georgia was charged with violating the UK’s Identity Cards Act.
Robert McMillan covers computer security and general technology breaking news for The IDG News Service. Follow Robert on Twitter at @bobmcmillan. Robert’s e-mail address is robert_mcmillan@idg.com