“Group-IB”的意思、由来-开放百科全书

In 2015, Gartner agency included Group-IB in the top 7 global vendors of threat intelligence.^[1] In 2017, the company became the leader of Russia Threat Intelligence Security Services Market Analysis conducted by IDC^[2] and became one of Top-5 Threat Intelligence vendors in Forrester's Vendor Landscape: External Threat Intelligence, 2017 report.^[3]

History

Group-IB was founded in 2003 by a group of students of Bauman Moscow State Technical University, headed by Ilya Konstantinovich Sachkov. They were acting as an agency for investigating cyber-attacks. Since then, Group-IB has been involved in a range of incident response and investigations across the world,^[4] actively cooperating with international partners to detect perpetrators and bring them to justice.^[5]

Group-IB participated in the first successful cybercrime case in Russia where the organizers of the criminal groups were identified and arrested. These criminals were involved in financial theft from bank accounts using malware for PCs, mobile devices, phishing attacks, and targeted attacks on financial institutions in Russia. The company is generally involved in a series of international operations and leverages close cooperation with international law enforcement agencies to get the criminals wherever they hide. According to Group-IB, up to 80% of all high-profile investigation cases in the field of high-tech crime in Russia are supported by Group-IB experts.^[6]

In 2010 Group-IB established the largest computer forensics laboratory in Eastern Europe.^[7]

In 2011 the company established its Computer Emergency Response Team (CERT)—the first round-the-clock computer security incident response team in Eastern Europe, called CERT-GIB.^[8] With the status of a Competent Security Organization recognized by Coordination Center for TLD RU (administrator of the national top-level domains .ru and .рф)^[9] and collaboration with CERTs worldwide, the company has developed a series of effective intellectual property protection services.

Group-IB successfully protected the Sochi 2014 Olympic brand, products and ticket sales,^[10] blocked pirated links to TV series and movies owned by Sony Pictures, Paramount Pictures, Fox TV series', Discovery Channel, Amedia (which has exclusive rights to HBO TV series in Russia),^[11] as well as fraudulent websites abusing brands of popular banks and payment systems.^[12]

Since 2012, Group-IВ has been developing their Early Warning System to provide cyber defence to companies around the world. In 2015 Gartner included Group-IB's core product—Group-IB Intelligence—in the top 7 global threat intelligence solutions along with products developed by IBM, FireEye, RSA and Check Point.^[13]

Since 2007, Group-IB has been cooperating with Microsoft. In 2015, the two companies presented joint research on the economic impact of cyber-attacks.^[14]

Group-IB is a resident of the Moscow-based Skolkovo Foundation (dubbed "Russian Silicon Valley"). As part of Skolkovo innovative projects, Group-IB created the so-called "CyberCop", a global counter-cybercrime system.

The company has also established an additional office in Innopolis—a science park in Tatarstan, Russia.

Owners and leadership

In 2010, LETA Group, an investment and management company in information technology, acquired 50% of Group-IB's assets. In 2013, Group-IB management bought out LETA Group's share.^[15]

In mid-2016 Russian-founded Altera Capital and Run Capital each bought a 10 percent stake in Group-IB.

According to the company's announcement, Group-IB will leverage these investments to develop products and create R&D hubs in the Middle East, Southeast Asia and Latin America, as well as to hire local forensic specialists and improve sales performance at the American, European, and Asian markets.^[16]

International cooperation

Technology

According to Gartner, "being involved in the most high-profile investigations allows Group-IB to get more information about cybercriminals, their relationships and other intelligence".^[1] In addition to investigation materials and forensics expertise, GIB's threat data collection is based on the high-tech infrastructure that includes:

Early Warning System for Cyber Defence

GIB Intelligence service uses personalized information for security strategy planning, making time-sensitive decisions and tweaking protection tools. It gives time for incidents prevention allowing to urgently discover theft of clients and employees' identifiers, to track modifications of tactics and tools used by criminal groups potentially interested in a company and to prioritize threats based on expert forecasts.^[24]

TDS is a hardware and software unit preventing infection and vulnerabilities usage in corporate networks. The TDS sensors track suspicious activities in a corporate network while the CERT-GIB experts reveal critical threats and immediately inform the information security service and help to put a stop to an incident evolving. TDS Polygon allows to start in an isolated environ suspicious files downloaded by users or received in mail and to obtain an objective conclusion of the degree of their harmfulness based on a classification formed through computerized training pattern.^[25]

Secure Bank deletes "blind spots" in online-payments security through diagnosing signs of infection, remote controlling of client's machine or identifiers being compromised during authorization. Secure Portal prevents unauthorized access to personal accounts, personal data, web users' bonus accounts and various fraudulent scenarios from using bots to competitor's offers displays on a portal site.^[26]

Awards

Major threats detected by Group-IB

Lazarus: state-sponsored attack

In May 2017 Group-IB issued a report that proved there is a connection between Lazarus group who stole $18 mln from Bangladesh Central Bank, conducted a number of attacks on Polish banks, as well as attempted to infect hundreds of financial organizations in 30 countries around the globe, including European Central Bank, Central Banks of Russia, Brazil and Venezuela – with North Korea. Company experts made a research of the complex technological infrastructure, communications channels, and concealment techniques, presented new evidence of Lazarus attribution to North Korea and revealed details of the attack.^[30]

Cobalt: logical attacks

In July 2016, a group of masked cyber-criminals "jackpotted" 34 ATMs operated by First Bank, one of Taiwan's largest banks. The perpetrators stole T$83.27 (over $2m USD).^[31] According to CCTV footage, the thieves used cellphones to trigger the ATMs to automatically dispense money. Group-IB experts were the first to discover the "jackpotting" attack tactics used by the Cobalt gang to force ATMs to spit out cash using malware.^[32] Group-IB released a report "Cobalt: Logical attacks on ATMs" that provided a detailed analysis of the attack scheme.^[33] To get into the bank's internal network, hackers used spear phishing emails with a malicious attachment. The emails purported to come from the European Central Bank, the ATM maker Wincor Nixdorf, and local banks. After establishing control over the bank's internal network, the criminals searched for network segments, from which they could gain access to ATMs and workstations of bank employees who control ATMs. Once access to ATMs was obtained, they uploaded a specific software to them, allowing criminals to control cash dispensers.

Corkow

In February 2016, Group-IB published a report titled "Analysis of attacks against trading and bank card systems" about the first major successful attack on a trading system provoking major exchange volatility. In February 2015, the Corkow criminal group infected a trading system terminal of Kazan-based Energobank using a specialized Trojan software resulting in trades of more than $400 million. The hackers moved the ruble-dollar rate more than 15 percent in minutes on the Moscow Exchange. The bank claimed losses of 244 million rubles ($3.2 million) due to the trades.^[34]

Buhtrap

In March 2016 Group-IB published a report on activity of the Buhtrap criminal group that managed to conduct 13 successful attacks against Russian banks for a total amount of 1.8 billion rubles ($25.7 million) from August 2015 to February 2016.^[35] The high effectiveness of these attacks was achieved due to spear phishing mailouts, including those sent acting as the Central Bank of Russia, which were used by criminals to gain access to the corporate network. Criminals obtained access to computers running the Automated Working Station of the Central Bank Client (AWS CBC), a free software that delivers payment documents on behalf of the Central Bank, and performed fraudulent transactions acting as the bank. The attack scheme outlined in the report published by Group-IB was later used to perform thefts via SWIFT.^[36] Buhtrap was the first hacker group using a network worm to infect the overall bank infrastructure that significantly increased the difficulty of removing all malicious functions from the network. As a result, banks had to shut down the whole infrastructure, because the worm was able to gain full control over the network using a single infected machine.^[37]

Anunak/Carbanak

In late 2014 Fox-IT and Group-IB jointly released a report on the Anunak (aka Carbanak) hacker group that had stolen more than 1 billion rubles from over 50 Russian banks. In Europe Anunak attacked POS terminals of large retail store chains with data of several million clients infected.^[38] The group has not performed successful thefts since early 2015.^[39]

Reverse ATM Attack

In autumn 2015, a novel technique of targeted attacks called a "reverse ATM attack" that allowed criminals to steal money from ATMs. "Money mules" (criminal payment agents) would deposit small sums into unembossed cards with legitimate accounts, immediately withdrawing what they'd put in. They also took a receipt from the ATM, which contained a payment reference number and the amount withdrawn. That information was sent to hackers who would use the data and their access to thousands of point of sale terminals, primarily based in the US and the Czech Republic, to create "a reversal operation" on a terminal that tricked the bank into believing the withdrawal of funds had been cancelled. At the point of sale terminal, this looked as though goods were returned or a payment was declined, whilst to the banks it appeared the ATM withdrawal had been cancelled. Funds were returned to the account, though the perpetrators had already taken the cash. The process was repeated until there was no money remaining in the target ATM. During these attacks criminals managed to steal 252 million rubles ($3.8 million) from five large Russian banks. The fraud can no longer be perpetrated due to additional security systems implemented by banks with the assistance from VISA and Mastercard.^[40]

ISIS hacker attacks on Russian resources

According to the report released by Group-IB in March 2015, hackers from the self-proclaimed Islamic State of Iraq and the Levant (ISIS) attacked 600 Russian Internet resources in 2014. Criminals primarily defaced websites placing pictures and video with ISIS propaganda. Hackers are believed to have attacked not only government organizations, banks and popular resources, but also galleries and schools. These attacks were chaotic and massive; researchers believe that they were aimed to gain experience and perform reconnaissance of the Russian Internet. According to Group-IB's report, these attacks were performed not just by ISIS cyber division, Cyber Caliphate, but by 3 more criminal groups called Team System Dz, FallaGa Team and Global Islamic Caliphate totalling over 40 members.^[41]

Notable public investigations

Exploits: Blackhole (Paunch)

In Autumn 2013 Group-IB supported investigative activity that resulted in the arrest of Dmitry Fedotov, known under the nickname Paunch, the author of the infamous Blackhole exploit pack, which was, at the time, used to conduct 40% of infections worldwide.^[42] The criminal was sentenced to 7 years in prison according to the national legislation in April 2016.^[43]

Attacks on legal entities: Carberp, Germes, Hodprot

In 2012 law enforcement agencies, with assistance from Sberbank and Group-IB, arrested the largest criminal gang in Russia. In two years, the group managed to infect over 1.5 million computers worldwide and steal approximately $250 million from bank accounts. In total, over 100 banks suffered from their attacks throughout the world. Group-IB engaged their partners in the Netherlands and Canada in the investigation, which enabled the company to identify the full chain of actors including the organizer, who owned the botnet, operators, and cashers ("money mules").^[44] It was the first case in Russia when all members of the criminal group were arrested; the leaders were sentenced to between 5 and 8 years in prison.^[45] In the same year members of other criminal groups, who used Carberp modifications to attack individuals and companies, were arrested. In the summer of 2012 a hacker known as Germes (aka Arashi) was arrested. He was a creator of one of the largest global botnets that had infected over 6 million computers.^[46] Following this, 7 members of the Hodprot criminal group were detained. One of the oldest Russian hacker gangs is known to have stolen approximately 125 million rubles from Russian bank accounts. All members of the criminal group were arrested, even though they are known to have used control servers located abroad – in the Netherlands, Germany, France and the USA.^[47]

Android Trojans: "5th Reich", WapLook, Cron

In April 2015 members of a hacker group, which had infected over 340,000 Android-based devices to steal money from bank accounts, were arrested with assistance of Group-IB and Sberbank. Hackers dubbed their malware "the fifth Reich" and used Nazi symbols in the control system.^[48] The hackers distributed the malware via SMS messages containing a link to download a program masked as Adobe Flash Player. The Trojan enabled hackers to intercept SMS notifications from banks and furtively confirm money transfer to hackers' accounts. The attack scheme was similar to that used by WapLook, the first criminal group members which were arrested for money theft from individuals using malicious mobile apps in Russia. Group leaders were arrested in September 2014 with assistance from Group-IB. In May 2017 Russian Ministry of Internal Affairs announced the arrest of Cron gang that had infected more than 1 mln smartphones. Group-IB provided expert support to the investigation.^[49] Cron Banking Trojan spread itself in two ways—via SMS, when the user clicked on the link in the message and installed a malicious application, or disguised as a legitimate application Navitel, Framaroot, Pornhub, Avito etc. The hackers infected up to 3,500 smartphones daily, and managed to steal about $1 mln in total.

Phishing: Popelysh brothers

In June 2015, twin brother hackers were reportedly arrested in St. Petersburg, Russia, as part of a police operation assisted by Group-IB. Over 4 years, the Popelysh brothers had stolen money from client accounts of VTB24 online banking using a fake bank page to grab client data. This was the first case in Russia, when legal proceedings were taken against criminals using phishing schemes.

References

1. ^¹{{cite web |url=https://www.gartner.com/doc/2874119/competitive-landscape-threat-intelligence-services |title=Competitive Landscape: Threat Intelligence Services, Worldwide, 2015 |author=Ruggero Contu, Rob McMillan |date=14 October 2014 |website= |publisher=Gartner |access-date= |quote=}}
2. ^{{cite web |url=http://www.idc.com/getdoc.jsp?containerId=CEMA42095117 |title=Russia Threat Intelligence Security Services 2016 Market Analysis and 2017–2021 Forecast |last=Maslennikov |first=Denis |date=2017 |website= |publisher=International Data Corporation |access-date= |quote=}}
3. ^{{cite web |url=https://www.group-ib.com/threat_intelligence_vendors.html |title=Cyber Threat Intelligence Vendor landscape by Forrester |author= |date=2017 |website= |publisher=Forrester Research |access-date= |quote=}}
4. ^{{cite web |url=https://www.reuters.com/article/us-taiwan-cyber-atms-idUSKBN14P0CX |title=Taiwan ATM heist linked to European hacking spree: security firm |author=Jim Finkle and J.R. Wu |date=January 5, 2017 |website= |publisher=Reuters |access-date= |quote=}}
5. ^{{cite web |url=http://www.group-ib.com/index.php/7-novosti/940-group-ib-supports-interpol-in-disrupting-dorkbot-botnet |title=Group-IB supports INTERPOL in disrupting Dorkbot botnet |author= |date=December 17, 2015 |website= |publisher=Group-IB |access-date= |quote=}}
6. ^{{cite web |url=http://www.group-ib.com/about.html |title=About Group-IB |author= |date= |website= |publisher=Group-IB |access-date= |quote="80% of high-profile cybercrimes in Russia and CIS are investigated by Group-IB"}}
7. ^{{cite web |url=http://www.bankinfosecurity.com/russian-police-bust-alleged-bank-malware-gang-a-9163 |title=Russian Police Bust Alleged Bank Malware Gang |last=Schwartz |first=Mathew J. |date=June 2, 2016 |website=bankinfosecurity.com |publisher= |access-date= |quote=}}
8. ^{{cite web |url=http://www.pcworld.com/article/2032336/researchers-find-new-pointofsale-malware-called-blackpos.html |title=Researchers find new point-of-sale malware called BlackPOS |last=Lucian |first=Constantin |date=March 28, 2013 |website=pcworld.com |publisher= |access-date= |quote=}}
9. ^{{cite web |url=https://cctld.ru/en/news/news_detail.php?ID=3366&sphrase_id=138576 |title=Group-IB to help combating cibercrime in domains .РФ and .RU |author= |date=2011-12-23 |website= |publisher=Coordination Center for TLD RU |access-date= |quote=}}
10. ^{{cite web |url=http://www.group-ib.ru/testimonials/sochi.pdf |title=Sochi 2014 Commemorative certificate |author= |date=2014 |website= |publisher=International Olympic Committee |access-date= |quote= |format=PDF}}
11. ^{{cite web |url=http://www.group-ib.com/index.php/7-novosti/828-internet-criminalists-how-russias-main-cyber-detective-agency-is-organized |title=Internet criminalists: how Russia’s main cyber detective agency is organized |author= |date= |website= |publisher=Group-IB |access-date= |quote=}}
12. ^{{cite web |url=http://www.cnews.ru/news/line/qiwi_i_groupib_obedinili_usiliya_dlya |title=Qiwi и Group-IB объединили усилия для защиты электронных платежей |author= |date=2014-04-10 |website=cnews.ru |publisher= |access-date= |quote= |language=Russian}}
13. ^{{cite web |url=https://www.gartner.com/doc/2874317/market-guide-security-threat-intelligence |title=Market Guide for Security Threat Intelligence Services |author= |date=14 October 2014 |website= |publisher=Gartner |access-date= |quote=}}
14. ^{{cite web |url=https://www.rbth.com/business/2016/04/14/russia-loses-33-billion-to-cyber-attacks_584971 |title=Russia loses $3.3 billion to cyber attacks |last=Kuchma |first=Anna |date=April 14, 2016 |website= |publisher= |access-date= |quote=}}
15. ^{{cite web |url=http://en.leta.vc/news/menedzhment-group-ib/ |title= Group-IB management buys out LETA Group’s share|author= |date=5 November 2013 |website= |publisher=LETA Group |access-date= |quote=}}
16. ^{{cite web |url=https://vc.ru/n/group-invest |title=Российские специалисты по информбезопасности Group-IB продали 20% компании фондам Altera и Run Capital |last=Фролов |first=Андрей |date=2016-08-15 |website=vc.ru |publisher= |access-date= |quote=}}
17. ^{{cite web |url=https://www.europol.europa.eu/newsroom/news/europol-signs-agreement-group-ib-to-cooperate-in-fighting-cybercrime |title=Europol signs agreement with Group-IB to cooperate in fighting cybercrime |author= |date=17 June 2015 |website= |publisher=Europol |access-date= |quote=}}
18. ^{{cite web |url=http://www.group-ib.com/index.php/7-novosti/932-europol-signs-agreement-with-group-ib-to-cooperate-in-fighting-cybercrime |title=Europol signs agreement with group-ib to cooperate in fighting cybercrime |author= |date=17 June 2015 |website= |publisher=Group-IB |access-date= |quote=}}
19. ^{{cite web |url=https://www.trusted-introducer.org/processes/overview.html |title=Trusted Introducer overview |author= |date= |website=trusted-introducer.org |publisher= |access-date= |quote=}}
20. ^{{cite web |url=https://www.first.org/members/teams/cert-gib |title=Computer Security Incident Response Team CERT-GIB |author= |date= |website=first.org |publisher= |access-date= |quote=}}
21. ^{{cite web |url=http://www.group-ib.com/index.php/7-novosti/714-group-ib-to-participate-in-the-owasp-project |title=Group-IB to participate in the OWASP project |author= |date=19 March 2013 |website= |publisher=Group-IB |access-date= |quote=}}
22. ^{{cite web |url=https://wiki.oasis-open.org/cti/Products |title=OASIS Products |author= |date= |website= |publisher=OASIS organization |access-date= |quote=}}
23. ^{{cite web |url=http://www.mxphone.net/250716-kmitl-group-ib-it/ |title=สจล. ร่วมมือยักษ์ไอทีรัสเซียยกระดับไซเบอร์ซีเคียวริตี้ไทย |author= |date=2016-07-25 |website=mxphone.net |publisher= |access-date= |quote= |language=Thai}}
24. ^{{cite web |url=http://www.ixbt.com/news/soft/index.shtml?18/34/85 |title=Российские киберпреступники получили в 2013 г. почти $2,5 млрд |author= |date=2014-10-15 |website= |publisher=Vedomosti |access-date= |quote= |language=Russian}}
25. ^{{cite web |url=https://www.anti-malware.ru/analytics/Market_Analysis/protection-market-against-targeted-attacks-review |title=Обзор рынка защиты от целевых атак |author=Иван Бойцов |date=2016-10-26 |website=anti-malware.ru |publisher= |access-date= |quote= |language=Russian}}
26. ^{{cite web |url=http://www.group-ib.com/secure_bank.html |title=Secure Bank: Innovative solution for secure online payments |author= |date= |website= |publisher=Group-IB |access-date= |quote=}}
27. ^{{cite web |url=http://www.ey.com/ru/en/newsroom/news-releases/news-russian-winners-announced-for-2015-ey-entrepreneur-of-the-year |title=Russian winners announced for 2015 EY Entrepreneur Of The Year® |author= |date=27 November 2015 |website= |publisher=EY |access-date= |quote=}}
28. ^{{cite web |url=https://www.forbes.com/30-under-30-2016/enterprise-tech/#ccb431a50230 |title=Meet The 30 Under 30: Enterprise Tech |author= |date=2016 |website= |publisher=Forbes |access-date= |quote=}}
29. ^{{cite web |url=https://www.bfm.ru/news/340112 |title=Стало известно имя победителя международного конкурса EY «Предприниматель года 2016» в России |author= |date=2016-11-29 |website= |publisher=Business FM |access-date= |quote=}}
30. ^{{cite web |url=https://www.theregister.co.uk/2017/05/30/nork_spy_agency_lazarus_group_attribution/ |title=NORK spy agency blamed for Bangladesh cyberheist, Sony Pictures hack |last=Leyden |first=John |date=30 May 2017 |website= |publisher=The Register |access-date= |quote=}}
31. ^{{cite web |url=http://www.ibtimes.co.uk/thai-bank-shuts-down-half-its-atms-after-eastern-european-cyber-gang-heist-1577806 |title=Thai bank shuts down half its ATMs after 'Eastern European cyber-gang' heist |last=Murdock |first=Jason |date=August 24, 2016 |website= |publisher=International Business Times |access-date= |quote=}}
32. ^{{cite web |url=https://www.reuters.com/article/us-cyber-banks-atms-idUSKBN13G24Q?il=0 |title=Hackers target ATMs across Europe as cyber threat grows |last=Finkle |first=Jim |date=2016-11-21 |website= |publisher=Reuters |access-date= |quote=}}
33. ^{{cite web |url=https://www.group-ib.com/cobalt.html |title=Cobalt: logical attacks on ATMs |author= |date=2016 |website= |publisher=Group-IB |access-date= |quote=}}
34. ^{{cite web |url=https://www.bloomberg.com/news/articles/2016-02-08/russian-hackers-moved-currency-rate-with-malware-group-ib-says |title=Russian Hackers Moved Ruble Rate With Malware, Group-IB Says |last= |first= |date=2016-02-08 |website= |publisher=Bloomberg |access-date= |quote=}}
35. ^{{cite web |url=https://www.vedomosti.ru/finance/articles/2016/03/18/634123-hakeri-rossiiskih-bankov |title=Хакеры украли $25 млн у 13 российских банков |last=Kantyshev |first=Pavel |date=2016-03-18 |website= |publisher=Vedomosti |access-date= |quote=}}
36. ^{{cite web |url=https://www.bloomberg.com/news/articles/2016-03-17/new-russian-hacker-cell-hit-13-banks-since-august-group-ib-says |title=New Russian Hacker Cell Hit 13 Banks Since August, Group-IB Says |author= |date=2016-03-17 |website= |publisher=Bloomberg |access-date= |quote=}}
37. ^{{cite web |url=http://www.group-ib.com/buhtrap-report.html |title=Buhtrap: the evolution of targeted attacks against financial institutions |author= |date=2016 |website= |publisher=Group-IB |access-date= |quote=}}
38. ^{{cite web |url=http://www.forbes.ru/tekhnologii/internet-i-svyaz/276227-brat-po-krupnomu-kak-odna-gruppirovka-khakerov-ograbila-bolee-50 |title=Брать по-крупному: группировка хакеров ограбила более 50 банков |author=Pavel Sedakov, Dmitry Filonov |date=2014-12-22 |website= |publisher=Forbes |access-date= |quote= |language=Russian}}
39. ^{{cite web |url=http://www.group-ib.com/index.php/7-novosti/939-high-tech-crime-trends-2015 |title=High-Tech Crime Trends 2015 |author= |date= |website= |publisher=Group-IB |access-date= |quote=}}
40. ^{{cite web |url=http://securityaffairs.co/wordpress/42272/cyber-crime/reverse-atm-hack-method.html |title=Russian criminals Steal $4 Million In cash with a new technique dubbed reverse ATM Attack. |last=Paganini |first=Paganini |date=November 26, 2015 |website=securityaffairs.co |publisher= |access-date= |quote=}}
41. ^{{cite web |url=http://thehill.com/policy/cybersecurity/237031-isis-hackers-have-hit-hundreds-of-russian-websites |title=ISIS hackers have hit hundreds of Russian websites |last=Bennett |first=Cory |date= |website= |publisher=The Hill |access-date= |quote=}}
42. ^{{cite web |url=http://krebsonsecurity.com/2013/12/who-is-paunch/ |title=Who Is Paunch? |last= |first= |date=December 2013 |website=krebsonsecurity.com |publisher= |access-date= |quote=}}
43. ^{{cite web |url=https://www.infosecurity-magazine.com/news/blackholes-paunch-sentenced-to-7/ |title=Blackhole's Paunch Sentenced to 7 Years in Russian Penal Colony |last=Seals |first=Tara |date=2016-04-19 |website=infosecurity-magazine.com |publisher= |access-date= |quote=}}
44. ^{{cite web |url=https://www.group-ib.com/index.php/7-novosti/627-members-of-the-largest-criminal-group-engaged-in-online-banking-fraud-are-detained |title=Members of the largest criminal group engaged in online banking fraud are detained |author= |date= |website= |publisher=Group-IB |access-date= |quote=}}
45. ^{{cite web |url=http://www.securityweek.com/russian-authorities-claim-capture-mastermind-behind-carberp-banking-trojan |title=Russian Authorities Claim Capture of Mastermind Behind Carberp Banking Trojan |author=Fahmida Y. Rashid |date=April 4, 2013 |website=securityweek.com |publisher= |access-date= |quote=}}
46. ^{{cite web |url=http://www.cso.com.au/article/428671/russian_carberp_botnet_kingpin_arrested_/ |title=Russian Carberp botnet kingpin arrested |author=Liam Tung |date=June 26, 2012 |website=cso.com.au |publisher= |access-date= |quote=}}
47. ^{{cite web |url=http://www.welivesecurity.com/2012/06/04/carberp-and-hodprot-six-more-gang-members-held/ |title=Carberp and Hodprot: six more gang members held |last=Harley |first=David |date=2012-06-04 |website=welivesecurity.com |publisher= |access-date= |quote=}}
48. ^{{cite web |url=http://ren.tv/novosti/2015-04-13/kiber-fashisty-iz-chelyabinskoy-oblasti-ispolzovali-virus-5-reyh |title=Кибер-фашисты из Челябинской области использовали вирус "5 рейх" |author= |date=2015-04-13 |website= |publisher=REN TV |access-date= |quote= |language=Russian}}
49. ^{{cite web |url=https://www.reuters.com/article/us-russia-cyber-banks-idUSKBN18I0VE |title=Hackers hit Russian bank customers, planned international cyber raids |last=Stubbs |first=Jack |date=2017-05-22 |website= |publisher=Reuters |access-date= |quote=}}
50. ^{{cite web |url=https://ria.ru/incidents/20121221/915789715.html |title=Дело о фишинге: как ловили хакеров-близнецов из Санкт-Петербурга |author= |date=2012-12-21 |website= |publisher=RIA Novosti |access-date= |quote= |language=Russian}}