Pierluigi Paganini
February 09, 2021
Last week, an international operation conducted by Ukraine’s police, along with the US and Australian authorities, lead to the shut down of the world’s phishing framework U-Admin.
The National Police and its Main Investigation Department identified a man (39) from the Ternopil region who developed a phishing package and an admin panel that could be used by the customers of the service.
“As a result of an international special operation, the Office of the Attorney General, together with employees of the Cyberpolice Department of the National Police of Ukraine and the Main Investigation Department of the National Police, as well as law enforcement officers of the United States and Australia, closed one of the world’s largest phishing services.” reads the press release published by published by Ukraine police.
The phishing service was involved in attacks aimed at financial institutions in 11 countries (Australia, Spain, the U.S., Italy, Chile, the Netherlands, Mexico, France, Switzerland, Germany, and the U.K.) and caused tens of millions of dollars in losses.
According to the authorities, more than 50% of all phishing attacks in 2019 in Australia were carried using the U-Admin phishing service.
“Cyber cops in Ukraine carried out an arrest and several raids last week in connection with the author of a U-Admin, a software package used to administer what’s being called “one of the world’s largest phishing services.” The operation was carried out in coordination with the FBI and authorities in Australia, which was particularly hard hit by phishing scams perpetrated by U-Admin customers.” wrote the popular investigator Brian Krebs.
The police conducted five searches in the Ternopil region, during which the agents seized computer equipment, mobile phones, and hard drives. The analysis of the seized equipment allowed the identification of more than 200 active buyers of the phishing framework.
The cybercriminal created his own online store on DarkNet to sell his products to customers, he is also accused to have provided technical support for phishing attacks to its users.
Accordind to Krebs, one of the biggest selling points for U-Admin is a module that allows attackers to intercept multi-factor authentication codes through web injection. Phishers can dynamically interact with victims in real-time by injecting content into the phishing page that prompts the victim to enter additional information, such as OTP codes.
The Ukrainian hacker has been arrested and faces up to six years of jail if will be found guilty.
If you want to receive the weekly Security Affairs Newsletter for free subscribe here.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Intel)
[adrotate banner=”5″]
[adrotate banner=”13″]
