The arrests follow a Tuesday U.K. sweep that led to 11 charges against Eastern European citizens thought to be involved in moving stolen funds out of the country.
Zeus has been a major problem for computer users and financial institutions over the past few years. Once installed on the victim’s PC, the malware can be used to log into a victim’s bank account and transfer funds to another account controlled by the criminals.
The malicious software is sold in black market forums and there are more than a dozen Zeus gangs in operation worldwide. Security experts say that the gangs have netted more than US$200 million since Zeus was discovered in 2006.
The U.S. arrests involve so-called money mules, people who are paid to set up accounts that receive stolen funds and then move the money out of the country, typically via a wire service such as Western Union.
The DOJ has scheduled a press conference in Manhattan on Thursday afternoon to further discuss the arrests.
One of the complaints describes in-depth the use of money “mules” in order to facilitate the transfer of funds into criminal accounts. Mules agree to allow funds to be transferred out of victims’ accounts into their own accounts. Those funds are typically quickly withdrawn and wired elsewhere before banks detect the fraud.
But that was a risky job, involving withdrawing cash from the banks either in person or visiting cash machines, both of which would be under video surveillance.
“The mule organization typically recruited mules from Eastern Europe who were either planning to travel to or were already present in the United States on J1 visas,” according to the complaint lodged against three individuals: Artem Semenov, Almira Rakhmatulina and Julia Shpirko.
“The mules kept a portion of the fraudulent proceeds for themselves — usually 8 to 10 percent — and transferred the rest to other participants in the fraudulent scheme,” the complaint said.
Semenov, Rakhmatulina and Shpirko were charged with conspiracy to commit bank fraud and conspiracy to possess false identification documents. Semenov and Rakhmatulina were also charged with false use of a passport.
Customs officers intercepted a United Parcel Service package shipped from Moldova addressed to Semenov at a residence in Brooklyn, New York. Inside the package were several passports, including some with Semenov’s photograph but different names such as “Petar Stojanovic” and “Victor Rajkov.”