175: Bayrob

It started with a fake car listing on eBay. What looked like a simple online scam quietly grew, over more than a decade, into one of the most sophisticated cybercrime operations the FBI had ever traced. Custom malware. Opsec off the charts. Fleets of infected computers mining cryptocurrency for someone else. Millions of dollars siphoned from victims who had no idea. This is the story of Bayrob and the three men from Romania who were behind it. And the long, strange road that led American investigators to their door. SponsorsSupport for this show comes from ThreatLocker® https://www.threatlocker.com/. ThreatLocker® is a Zero Trust Endpoint Protection Platform that strengthens your infrastructure from the ground up. With ThreatLocker® Allowlisting and Ringfencing™, you gain a more secure approach to blocking exploits of known and unknown vulnerabilities. ThreatLocker® provides Zero Trust control at the kernel level that enables you to allow everything you need and block everything else, including ransomware! Learn more at www.threatlocker.com https://www.threatlocker.com/. This show is sponsored by Meter https://www.meter.com/, the company building networks from the ground up. Meter delivers a complete networking stack - wired, wireless, and cellular - in one solution that’s built for performance and scale. Alongside their partners, Meter designs the hardware, writes the firmware, builds the software, manages deployments, and runs support. Learn more at meter.com https://www.meter.com/. This show is sponsored by Maze http://mazehq.com/darknet. Maze uses AI agents to triage and remediate cloud vulnerabilities by figuring out what’s actually exploitable, not just what’s theoretically risky. They remove the noise, prioritize vulns that matter, and manage remediation, so your team stops wasting time on meaningless vulns. Visit MazeHQ.com/darknet http://mazehq.com/darknet for more information. Support for this episode comes from NetSuite https://www.netsuite.com/darknet. NetSuite gives you visibility and control of your financials, planning, budgeting, and of course - inventory - so you can manage risk, get reliable forecasts, and improve margins. NetSuite helps you identify rising costs, automate your manual business processes, and see where to save money. KNOW your numbers. KNOW your business. And get to KNOW how NetSuite can be the source of truth for your entire company. Visit www.netsuite.com/darknet https://www.netsuite.com/darknet to learn more. This show is sponsored by Chainguard https://www.chainguard.dev/. Chainguard provides secure open source artifacts that are built from source so engineers can be confident that what they’re using in production matches the source bit-for-bit. Chainguard’s trusted open source has minimal vulnerabilities, provable provenance, and malware-resistance by design, defending against supply chain attack risk without adding any engineering toil. Head to chainguard.dev https://www.chainguard.dev/ to see how secure your software supply chain can really be.

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Jack Rhysider?

  Hey, this is Jack, host of the show. What a fun show this has been to make over the years. I'm having such a blast doing this. And I think this episode is one that sent me on an adventure that I'll never forget. It's a big and wild story, so let's not waste any time.

• 0:20Jack Rhysider?

  These are true stories from the dark side of the internet.

• 0:27Jack Rhysider?

  I'm Jack Resider. This is Darknet Diaries.

• 0:48Jack Rhysider?

  This episode is sponsored by ShipStation. During Black Friday and Cyber Monday, things can get a bit hectic. Millions of people scrambling to find the lowest price online and then all clicking "Buy" multiple times within a 72-hour period. Now, retailers all over have to somehow ship those orders out on time, and that seems like a whole new level of hectic, one that ShipStation is built to help businesses manage. ShipStation is an end-to-end order fulfillment platform, built to handle the order surge of peak season and bring all your orders into one place, so your team isn't scrambling when volume spikes. Over 1 million businesses have learned on ShipStation to get through peak season, scaling fulfillment up to 40 times while cutting costs up to 30%. If I needed to ship a lot of stuff, I would definitely be using ShipStation.

• 1:33Jack Rhysider?

  Peak season doesn't wait, and neither should you. Get ahead of it today with ShipStation. Get 60 days free at shipstation.com and use code DARKNET. That's shipstation.com code DARKNET. Taxes and fees apply.

• 1:53Jack Rhysider?

  This episode is sponsored by DeleteMe. Have you ever thought I should really be doing something to protect myself from stalkers, scammers, and hackers? But you're not sure what? Here's what you do. Go to joindelete.me/darknetdiaries and enter code DD20 and you'll get 20% off DeleteMe. A few years ago, I signed up. And ever since then, DeleteMe has been busy scouring the internet for my name and giving me reports on what they found and deleted stuff. Take control of your data and keep your private life private by signing up for DeleteMe now at a special discount just for my listeners. Get 20% off your DeleteMe plan when you go to www.joindelete.me/darknetdiaries and use promo code DD20 at checkout.

• 2:36Jack Rhysider?

  The only way to get 20% off is to go to www.joindelete.me/darknetdiaries and enter code DD20 at checkout. That's www.joindelete.me/darknetdiaries code DD20.

• 2:55Jack Rhysider?

  Meet Liam.

• 2:56Speaker 01

  Yeah, I'm Liam Murcu. I work with Symantec and I've been there since 2004. And I work in the Security Response Department and analyze malware.

• 3:06Jack Rhysider?

  I've seen you before. Have you been on TV?

• 3:09Speaker 01

  I have been on TV. So I was part of the team at Symantec that analyzed Stuxnet, the virus that was infecting equipment at uranium enrichment plants in Netance in Iran.

• 3:21Jack Rhysider?

  Yeah, you were the one of the early ones to explain this is what was discovered.

• 3:26Speaker 01

  That's right. We were the team that discovered what Stuxnet did, what the payload was, how it worked, how it had spread, who it was targeting.

• 3:36Speaker 01

  Yeah, and then because of that, I was in a documentary that was shortlisted for an Oscar in 2016 called Zero Days by Academy Award-winning director Alex Gibney. So if you want to know what I do in my job, you can see it all there. And then also Kim Zetter wrote a book about it as well. And that whole story and my work and my team's work was featured in that book as well.

• 4:00Jack Rhysider?

  Yeah, Stuxnet was a huge deal, which really revealed the length that NSA will go to create malware. And I covered Stuxnet in episode 29, if you're interested, and I actually interviewed Kim Zetter for that one. And so after that, Liam continued to investigate threats. I think he has the most fun investigating novel threats, that is, threats that the world has never seen before or figured out yet. And so one day, a new piece of malware showed up on Liam's desk.

• 4:27Speaker 01

  Yeah, so our customers at Symantec, they'll get malware on their machines and then they'll send it to us for analysis. So I got this file that I wanted to analyze for this customer. And when I started looking at it, something felt off about it compared to the other malware that we would look at regularly. It just, it wasn't run-of-the-mill. There was something different about it.

• 4:45Jack Rhysider?

  There's a lot to do when analyzing new malware, but first you need to collect a sample of it. And Liam didn't have a complete sample yet. He really wanted to know what this malware does and what it does to the victim and what's the objective of it and who are the people who created it and how does it spread?

• 5:00Speaker 01

  And I understood that they were trying to defraud customers of eBay. So I decided to name it, I couldn't use eBay as a trade name, so I decided to call it Bayrob because they were robbing customers of eBay. And what the malware was doing was it was sitting on your computer and when you tried to connect to the eBay website, it would intercept your connection and it would inject false information into your browsing session. And it made it look like the false information was actually coming from the eBay legitimate URL. So you wouldn't notice that anything was different. And then they were using that to sell you things that didn't exist on eBay.

• 5:39Jack Rhysider?

  He wrote up a little thing and published what he knew about this malware, but he still didn't quite have all the pieces for it yet. And he really wanted to know more about it. The sample he got wasn't quite enough for him to fully infect a machine, to watch this malware, like it seemed to be infected, but it would never actually do anything on his machine. So he went on a hunt to learn more and had to think like a victim. How do victims get hit with this? How is it delivered? How do you get infected? And he learned where the watering holes were that people were going to get infected with this, specifically through phishing emails and Craigslist posts.

• 6:16Speaker 01

  I kept searching to see if I could find that missing piece. And I just kept on looking through our telemetry and looking to see where I might find this. And I knew there was some places where this was probably going to be distributed. So I was looking in those places like on Craigslist, for example, in email. I'm looking to see if I could find any places where I could find a complete package that would help me to analyze it from beginning to end and understand exactly what the attackers were doing, how they were making money, where they were sending the money, the entire thing. I wanted to know it all. And it turns out that the reason I couldn't solve the entire problem was because the attackers were geofencing their fraud so that it could only happen in America and only happen in certain locations within America. And I was in Ireland at the time, I was based in Ireland.

• 7:01Speaker 01

  So when I tried to connect to these auctions, because they were posting these fraudulent auctions, because I wasn't in America, I wasn't authorized to see this fraudulent data.

• 7:11Jack Rhysider?

  Wow, that's already impressive to me that this malware only worked for Americans? If anyone else in the world would be infected by it, they're basically immune to it? Wild. So since he couldn't get scammed by these fraudulent eBay auctions, he tried to find someone who had been scammed by them. And he did find someone who lost thousands of dollars after trying to buy a car on eBay.

• 7:31Speaker 01

  And I managed to discover who that victim was. I reached out to that victim and she had actually signed up for an auction after she had been defrauded the first time. She went, she found another auction that was very similar and she signed up for that. And she had gotten the entire package, the entire malware package. And I spoke with her and she's prepared to share that with me.

• 7:50Jack Rhysider?

  He was able to get the malware off her machine and analyze it. And he discovered how it works and what it does, how the infection happens and how the criminals use it to steal money. But he wanted to see it in action still, so he got a plan.

• 8:04Speaker 01

  I posed as her, I recorded my entire session and I went online and I bought this car and as part of the fraudulent information that they were injecting into the eBay website, they injected a chat window where you could chat about this fraudulent auction. And when you chatted, you thought you were talking to eBay support, but you're actually talking to these attackers. So I recorded this entire thing. I went and I bought a car, I talked to the attackers, tried to engage them as much as possible to see if their English was good and tried to talk to them at different hours of the day to see when they might be awake and not. And I recorded this entire thing and ended up being successful, buying this car and going all the way through with the transaction to the point where they send me information about a money mule where I was meant to send my money.

• 8:48Speaker 01

  And that was where I stopped, I didn't actually go through and send any money. But at that point, I had victim information, I knew exactly how the threat worked, I knew exactly how much money they were making, and I understood how the whole thing worked. And more importantly, I had a video of exactly how it would work from beginning to end. And what I did was I published that, a blog, saying, here's the threat, here's how it works, here's how you can protect yourself, here's what it looks like, here's a video of me buying a car, here's a video of me talking to the attackers, and I published that.

• 9:22Jack Rhysider?

  Liam's blog post was well received. People liked it and shared it, a lot of people read it. And after posting it, Liam kind of moved on to other things. He felt like he pretty much got to the bottom of this. Like, he created signatures for how people can detect this and what command and control servers it uses. This was enough information for companies to create antivirus rules and block these servers. And that should have been it for Liam researching this Bayrob malware. But the Bayrob malware started changing after that.

• 9:51Speaker 01

  So they would name their command and control servers various different things. They picked random names for the URLs of their command and control servers, but then they started putting my name in there. So they had domain names like geassoleam.com, tinycocklem.com, leamthemule.com, thankyoulem.com.

• 10:13Speaker 01

  Yeah, a variety of different variations of that over the years. And then also because there was a little encrypted section underneath that, they could also leave a message in the malware that they knew only I would see or someone who was analyzing the malware would see. And then they left messages in there like, uh, Symantec does group masturbation was one of them. So just over years, they would leave these messages in there for me. And of course, when I saw that, that made me more interested in understanding what was going on.

• 10:43Jack Rhysider?

  My favorite message they left for him in the malware was, Symantec team is a big hen coop chicken smart. Hen coop chicken smart, what does that mean? And all this mocking and taunting actually made Liam want to look more into this Bayrob malware. His name in the malware is what drew him back into this. So he got a computer and set it up in the lab and got infected with a fresh copy of the malware and went to analyze it further. Now, because he worked at Symantec, this gave him access to some pretty powerful malware analysis tools. So he ran this through there.

• 11:16Speaker 01

  I was able to see where they were connecting, where they were hosting, where they, how they were routing their traffic, how we could get, become part of that routing, how we could see some of their messages, how we could infiltrate, how they communicated, and that was super, super important in understanding the entire attack.

• 11:37Jack Rhysider?

  The way this malware routes across the planet is fascinating to me.

• 11:42Speaker 01

  The way they were protecting their identity was they were routing their traffic through infected machines. So that if someone like me or law enforcement tried to trace them to their original location, it would be very difficult to do that because they would jump through multiple infected machines in multiple countries. So if you saw their first IP address and you tracked that down, you would get a victim. And even if you monitored that victim machine, you would get another victim in another country. And to go and trace it all the way back to their home machine would be very, very difficult. So it was a really smart way for them to hide their, hide their traces.

• 12:18Jack Rhysider?

  Ever, right? So the attackers would never directly connect to their command and control server or their victims. Heck, they wouldn't even talk amongst each other directly. Instead, they would always use at least three hops through their infected victims to communicate with anything, even just Googling things. And if they wanted to connect to a victim, they'd go three hops to their command and control server and then three hops to the victim. This made it incredibly difficult to trace even just what country the Bayrob gang is located in. And at the time, there were over 6,000 computers infected by this Bayrob malware, and any of them could be part of this proxy chain. And that gave Liam an idea. If they're using the infected computers to connect through, then does that mean the

• 13:00Jack Rhysider?

  infected computer Liam has in his lab has a 1 in 6,000 chance of seeing a connection from these attackers? Maybe. So he gets this infected computer back online, puts some packet captures on it, and waits a long time, like over a month, and he never saw anything.

• 13:19Speaker 01

  It all started off under my desk, actually, in the office. I had my little test machine under my desk, and I set it up there and I ran the malware. And I was very disappointed to see that they never connected to my machine. And then I started to realize, oh, there's an algorithm that they're using to decide which machine to connect to.

• 13:36Jack Rhysider?

  Yeah, get this. After Liam had his infected machine online for a month, listening for connections from these criminals, he noticed the malware suddenly changed after a month of being online. More code was added to it, and this code had all the details for how the proxy chain worked. So to begin with, a machine had to be infected for 30 days before it even received the proxy chain code at all. And so he analyzed this proxy chain code, and he saw that not all infected machines have the same weight for being used by the hackers to hop around.

• 14:07Speaker 01

  So then I understood that if you had a higher bandwidth, you had a better chance of being used. If you were in different geographies, you had a better chance of being used. So it went from underneath my desk to a server in the west coast of the US, then to a server in the east coast of the US.

• 14:24Jack Rhysider?

  This time with a beefier server with higher bandwidth. And now this gave him a 1 in 400 chance that these attackers might connect through his machine. But still, after sitting there listening for any proxy traffic coming through, nothing.

• 14:39Jack Rhysider?

  He looked at this proxy chain code again. And he learned that before they would use a computer in the proxy chain, they would take a screenshot of that computer and look at it to see if this looked like a normal person's computer. Because if it looked like a threat researcher like Liam's computer, or a cop, they might notice something off and not connect to that machine. These hackers would vet every single computer before using it in that proxy chain. Holy cow. So Liam had to make sure his computer in his lab looked like someone's home computer. But on top of that, Liam also discovered that if the infected computer was in Romania, it would be given priority in the proxy chain. Basically, it had a higher chance of being chosen for their first hop,

• 15:23Jack Rhysider?

  which might also be a clue as to where these guys are from. So he rented a computer in Romania, infected it with this malware, beefed it up with a fast internet connection, made it look like a regular user's computer, and waited 30 days for the proxy chain code to come on, and then waited some more. This time, he thought he had a 1 in 40 chance of them connecting to his machine now.

• 15:45Speaker 01

  And eventually, they would connect to my machine as their first machine in the chain, which meant I got their home, or what I thought was their like home IP address. So I was getting these addresses in Romania, in Bucharest, and in a town called Brashov. And every now and again, they would slip up and you would see that that's exactly where they were coming from. So by using those proxies, not only was I able to see where they were coming from originally, but also I got to see like an absolute treasure trove of information that they sent across that network, because they felt they were protected. So we would see, first of all, they would see them setting up their campaigns. So I would see them transferring all the files that they needed to run their fraud. I could see them Google searching for images or for text that they were going to use.

• 16:28Speaker 01

  I could see them setting up email campaigns.

• 16:31Jack Rhysider?

  Wow, what an amazing insight he had to these attackers. These guys were using this proxy network for everything. Every time they'd check email, or move money, or yeah, even searching Google, they were unknowingly routing their traffic through Liam's computer. Or at least sometimes it would be chosen to go through Liam's computer, and he was capturing it all. But just because Liam was in the connection path capturing this data, the data was unreadable. And that's because these guys were encrypting everything. All communications to the command and control server was encrypted. All communications between the different attackers was encrypted. He could tell these guys were talking over Jabber, but couldn't see any of the messages since they were using OTR off the record,

• 17:13Jack Rhysider?

  which does end end encryption on all Jabber chats. So most of the time Liam had nothing but encrypted gibberish. But only every now and then that he'd see a small blip where something wasn't quite encrypted all the way or metadata about a connection would tell him what they were doing right now. And by this point Liam had been investigating and tracking this malware for years and has a way deeper understanding of who's behind this compared to his first blog post.

• 17:42Speaker 01

  I was analyzing malware and I knew where they were connecting. And I could see where they were connecting all over the world. And I was like, I can't do anything about this, but I know law enforcement could go and they could get these servers and these computers and these addresses and they could actually take action on them. So we went searching for law enforcement who would work with us on this case. And we had a long list of all of the things that the attackers were doing. And that was how we ended up contacting the FBI.

• 18:08Jack Rhysider?

  But as it turned out, the FBI was already on this.

• 18:12Speaker 02

  Hi, I am Stacy Whitaker. I am now a retired FBI agent. In 2007, I was a pretty new FBI agent, had only been in for a year and was still learning kind of my job. But yes, so I had been contacted very early on by one of the initial victims of the Bay Rob group. She had reached out, I was working in the Cleveland Division at the time. And so she reached out to the Cleveland FBI office to report that she had been victimized on eBay.

• 18:42Speaker 02

  And so I had simply answered her phone call when she called the office and talked to her about what had happened to her. And she explained to me that she had tried to purchase this vehicle on eBay and that she had supposedly won the auction. She had paid for the vehicle, approximately $8,600. And then she never received the car. It was supposed to be transported to her and she never received it. And on the initial phone call, that was, that was pretty much all that she knew. And so I had asked her, as we typically do in the FBI, to report this information to IC3. IC3.gov is a website that we use to collect information from victims of all different types of crime, related to the internet primarily. And so she did.

• 19:27Speaker 02

  She went to IC3 and she reported it. And at the time, I thought that was the end of that conversation. Because of course, for $8,600, the FBI typically is not going to open a case. But she actually called me back about two or three days later and told me that, it was explaining to me that she had figured out on her own that her computer was infected with a virus. And it was related to this eBay fraud. And it took a little bit of convincing to convince me that she actually was correct. She sent me Liam's report on Bay Rub. And so I read, that was the first time I had read his report about this virus. And so basically, I had decided to go out and meet with her.

• 20:10Speaker 02

  I took a computer forensic examiner from our office with me so that we could look at her computer. We could verify that she was in fact infected on her computer with this virus, which we did. And so because of that, because she was infected with malware, we were then able to open investigation, even though it was such a small amount of money that we were talking about.

• 20:31Jack Rhysider?

  And it was around here, in 2007, is when Liam got in contact with FBI Special Agent Stacy to tell her all about what he learned. But even with all that information, the FBI didn't make any progress on this case. In fact, for the first five years of this case being opened, very little happened with the FBI.

• 20:48Speaker 02

  It was very slow and very frustrating. Very slow and frustrating. So, one thing I would say about... I think this case is a very good example of the evolution of the FBI in many ways as well. So, in the beginning, in 2007, that was a time when we in the FBI, we didn't necessarily work hand in hand with private sector, right? So even though I ended up talking with Liam in 2007, we shared some information a little bit, but then we kind of went our separate ways. We didn't talk again until 2012, because that was kind of the way that we did things at that time in the FBI. We didn't share information too much with the private sector. We would, you know, do subpoenas.

• 21:31Speaker 02

  We would do search warrants and we would gather information, but we didn't necessarily work hand in hand like we do today. Also, at that time, we didn't necessarily work very many investigations that touched overseas either. So, again, I was a new agent in the FBI, and I opened this investigation and pretty quickly was able to determine that all the money was going overseas. I was tracking the money, was figuring out where it was getting picked up in different countries in Europe. And when I figured that out and I was talking with the other agents on my squad, their reaction was basically, "Oh, you need to close that case." Again, this is in 2007, and we just didn't have as much visibility

• 22:14Speaker 02

  and as much partnership with other countries as we do today. And so, I refused to close the case and kept working it and kept collecting information, even though I was very limited in what I could do. I was talking with the... I mean, we did have an FBI office in Bucharest in Romania, and so I was sending information to our FBI office over there to try to... Initially, I was simply sending them information on the money mules that were picking up the money. So I was able to track the money being sent via Western Union. And initially, it was getting picked up in Greece, and then it was in Hungary, and then it was Romania. It was several different countries in Europe

• 22:58Speaker 02

  where money was getting picked up. So I didn't necessarily know at first that it was Romania. But most of the money mules were using Romanian IDs when they would pick up the money. So for five years, all I'm really able to collect, for the most part, is victim information, right? I'm creating this spreadsheet of all these different victims that I've identified. I'm identifying money mule accounts or IDs and money transactions, and I'm collecting all of that information.

• 23:26Jack Rhysider?

  Now, even though Stacy was new at the FBI, she was pretty sharp, especially with computers, since she was a computer programmer in the Air Force before this and was really intrigued by this case, probably more intrigued than anyone else at the time. But she knew, if she was going to solve this, she was going to need more help on the investigation.

• 23:43Speaker 02

  I bring in CSIPS eventually to help on the legal side. And then I end up talking with Liam again in 2012, who connects us with Owen. And at this point, I'm figuring out that this is a very sophisticated group that we're dealing with, obviously. And especially from all the work that Liam had already done, I knew, you know, although I was on the cyber squad in Cleveland, I didn't have a super techie background. Certainly, a little bit, but nowhere near as much as Ryan. So I definitely needed some help on that side of things. And so I asked Ryan to work on this case with me.

• 24:21Speaker 03

  Yeah, so my name's Ryan McFarlane. I'm the IR practice lead at Trustit Tech. But at the time, I was a cyber agent. I was coming from DC, where I spent two years at our National Cyber Investigative Joint Task Force, working whole-of-government counter operations against China. And was transferring back to Cleveland and got to Cleveland. And the first thing I ended up getting asked to do was to work with Stacy on this case.

• 24:49Jack Rhysider?

  So Stacy starts bringing Special Agent Ryan up to speed on this case.

• 24:53Speaker 03

  You know, I land in Cleveland and start working this case with Stacy. And I spent the first, you know, six months to a year just going after all the infrastructure that these actors were using and working with. The US Attorney's Office in Cleveland and CSIPS to get legal process and a ton of technical coverage on the Bayrob Group.

• 25:19Jack Rhysider?

  Of course, one thing the FBI is good at is following the money. They learned that these criminals use money mules a lot. So when the criminals would trick a victim into sending them thousands of dollars, like through an eBay auction or something, the victim didn't actually send that money directly to the criminals. Instead, the criminals hired someone else to collect that money, keep a portion of it, and then forward the rest to someone else. And then they would forward that money again to someone else, and eventually it would be forwarded all the way to the criminals or turned into cryptocurrency and then given to the criminals. And they would get these money mules by putting ads on Facebook or Craigslist, advertising a legit job, like a work-from-home type of thing. And then they trick the money mule and lie to them about why they're accepting this money

• 26:04Jack Rhysider?

  and where they're sending it and what's happening. And the strange thing here is that even though the money mule is tricked into thinking they're doing some legit work, being a money mule is actually illegal, and these people could get arrested for this. We're now more than five years into this investigation, and the FBI started bringing even more people into this case.

• 26:24Speaker 04

  I'm Brian Levine. At the time, I was a cybercrime prosecutor at the Computer Crime and Intellectual Property Section in Washington DC.

• 26:32Jack Rhysider?

  That's under the Department of Justice.

• 26:34Speaker 04

  Yes, as part of the Department of Justice. I was also a national coordinator for all the computer hacking and IP prosecutors around the country, one of whom was Duncan Brown, who was in an AUSA, Assistant US Attorney in the Northern District of Ohio, and was brought in by Duncan and Stacy to help on the case.

• 26:52Jack Rhysider?

  Stacy and Ryan looked over the case more. They got a lot of information from Liam at Symantec, who discovered all this stuff about the way that proxy chains work and how he's infiltrated the chain and even captured some interesting things. And also Liam suggested they talk with Owen, so they called Owen up.

• 27:08Speaker 05

  My name is Owen Miller. I worked on AOL's CIRT team from 2011 to 2016. I received a report of abuse on my network from a specific IP at a specific time and was told it was related to potential Bay Rob activity. I went ahead and started taking a look at that and started pivoting around. We were able to connect specific domains that they were using and accessing with various AOL accounts that were being used in order to tunnel traffic through us. AOL allowed anyone to sign up for a free account and then tunnel network traffic through our dial-up IP allocation space. So we were basically like a very large free open proxy service.

• 27:53Speaker 05

  And we're also a free email provider. And basically, we built a full packet capture indexing system. At the time, it was called Molok and is now called Archimy. We had deployed at ISP level. And so us and others as well that offered those same types of services were heavily being leveraged by this group in order to create new accounts, chat with people, all of that good stuff. And so we just started digging around and seeing when they would connect in, where they would connect from, start going through all of the network traffic that they had presented to us.

• 28:28Jack Rhysider?

  So Owen from AOL was now feeding the FBI bits and pieces of things that he was seeing. And at the same time, Liam was still listening to the traffic going over the proxy chains. And every now and then, he'd see them connect to the proxy chain as their first hop, which likely meant the criminals are connecting to this from their home? So he would call the FBI and say, "Look, I have a strong suspicion that these are the IP addresses of the criminals, and they're in Romania." And so the FBI would contact the Romanian police and ask them, "Could you find out whose IP this is? And go see if those are our guys?"

• 29:03Speaker 03

  And the Romanian National Police were great. And they would go and they'd come back and they'd say, "You know, we just talked to a really nice school teacher." And we were sending the Romanian National Police all over Romania. And they were just, you know, the more doors they knocked on, the more we realized something was going on that we just didn't understand.

• 29:24Jack Rhysider?

  So even though they're using six or seven hops through this proxy chain before doing anything malicious, that still wasn't good enough to hide their tracks. These attackers were doing something even before going into the chain to hide their tracks even more. Like, for a while, their connections were all coming from like a schoolteacher's home in Romania, but then into the proxy chain, or it would come from some other house in Romania. And never for a long period of time, their home base seemed to move all over the city. These guys were really good.

• 29:51Speaker 04

  It was really challenging at this point because, at least at that time, the Department of Justice was very careful about the legal process that it issued. And we had to justify what we were doing, which was very challenging because we would often get back what we would describe as nothing. Because everything was encrypted, and, you know, I would have to go and make an explanation as to why this was beneficial, to keep doing this kind of legal process. And they would say, "Look, you're getting nothing. Why are you wasting your time continuing this process?"

• 30:33Speaker 04

  And what we realized was, these guys were so sophisticated, that you just had to get all information you could, all the time, for as long as you could, because you didn't know what was going to end up being helpful in the end. It was all about breadcrumbs.

• 30:48Jack Rhysider?

  The FBI continued to collect all the data they could. They had Liam feeding them data that was captured at Symantec. They had Owen feeding them what he saw at AOL. And they were interviewing victims and money mules, and logging as many chats as they could. I think they did a controlled buy and tried to talk with these hackers as much as they could. But much of this resulted in nothing, since it was all encrypted and obfuscated and wrapped in so many layers.

• 31:11Speaker 02

  We were doing all of those things. We were collecting information from Romania, we were collecting it from Liam. I think one of the biggest breakthroughs came from Owen at AOL, so I'll let him, yeah, talk about that.

• 31:25Speaker 05

  Yeah, sure. So, one of the members of the group was typing in his email address to log in on like gmx.de or One on One Internet. They did not use SSL at the time for the login form. So, when he typed in his email address, he typed in his personal email address. And then went "oops," and then logged in with his, you know, quote-unquote "work" email address. And so we have the same IP address. At the same, within like, you know, 10 seconds, like typing in someone's email address and then this actor's email address.

• 32:02Jack Rhysider?

  Oh wow, what a tiny slip up. In the year that Owen was monitoring this crew, this is the only time they slipped up like this. That's such persistence on the investigators. But also such discipline on the attackers. The attacker accidentally typed the wrong email address and even though the login failed for that email, it was a curious enough clue for Owen to look further into it. The email address was [email protected]. So, was there anything to find for this radu-spr name?

• 32:32Speaker 05

  At the time, you know, Facebook was pretty easy for looking people up based on email address and just, here you go, here he is. And then, oh, all right, pivot around. All right, oh, they had YouTube channels, lots of skydiving. I think it was like TNT Brothers or something like that. Bunch of posts on like various forums for like off-road vehicles and stuff in Romania and everything else. And it was just like, you know, pictures, everything you could want. And it's like, I don't know who anyone else is, but I'm pretty sure this is who this is.

• 33:00Speaker 04

  So, we sent them AOL a search warrant for all of this data. And, you know, they said, all right, this is a lot of information. Come on in and let's explain it to you as we give you that information. So we came in, I remember it was Stacy and Ryan, and it was unbelievable.

• 33:19Jack Rhysider?

  Brian, the DOJ prosecutor for this case was thrilled.

• 33:23Speaker 04

  So, what we started doing at that point was, we had to use legal process. We did hundreds or thousands of different legal process in this engagement, both domestically and abroad. And so, once we had a sense of who one of these actors was, we had more information that we could provide to Romania. We did that through a mutual legal assistance treaty request, shortened as an MLAT. And they started going up and doing whatever they did in Romania to try and get us helpful information pursuant to this legal process. One thing we found was the existing process of MLATs back and forth was too slow for this case because the criminals kept changing their infrastructure.

• 34:08Speaker 04

  So we had to work with our Office of International Affairs to create a faster process or a abbreviated version of the MLAT process.

• 34:15Jack Rhysider?

  What they were doing is actually moving locations, right?

• 34:18Speaker 04

  They were moving, well, we didn't know what they were doing. We just kept getting different IP addresses and different information. So what we discovered through Romania's response to our MLAT request was that there were three people that were communicating with each other, one of which was the person that Ian had identified, with encrypted communications. And we could not get through those encrypted communications, and Romania could not as well. We could see that in their home, on their non-criminal machines, where they weren't encrypting all their traffic, they were going to cryptocurrency websites, and specific ones that we knew this group was focused on.

• 35:03Speaker 04

  But that wasn't really strong evidence. It wasn't enough to indict them, or extradite them, or anything else. It just made us think we had the right people. But for quite a bit of time at that point, we're like, alright, we think we know who the three people are, but we just don't, because they're encrypting everything, we don't really have enough evidence to extradite them or to indict them.

• 35:22Jack Rhysider?

  So at this point, we're going on year seven or eight of this FBI investigation.

• 35:27Speaker 03

  Right around this time, you know, we're in pursuit mode, right? So we're trying to get as much visibility into their infrastructure. And around this time, we get a data intercept on their systems that are controlling all their malware. So they had a multi-layer command and control infrastructure, where all the malware was reporting up to the first layer, and then that layer was forwarding on to a couple of servers that were hosted in different places. And we were able to, as a team, figure out where those servers were located. So we went with legal process. We got a data intercept

• 36:11Speaker 03

  on a couple of these top-level command and control servers, and we were able to see the communications for all the botnet. Which meant that we got to see when they updated their malware, what some of their campaigns looked like, how they were loading additional plugins. So at this time, this group had a number of different lines of business. They were treating all these infected systems, and it was about 400,000 of these systems at the time, as a commodity, right? And every computer could do a bunch of different functions. We saw them instructing these computers to join mining pools and mine cryptocurrency for them.

• 36:57Speaker 03

  They could be used as proxies, and some of those proxies were sold on AlphaBay to other cyber criminals out there. They were doing some ad fraud. They were mining those systems for credit card information, which they then sold on AlphaBay as well. So they were AlphaBay vendors. They were replacing your internet browser with a custom version of their own internet browser. And everything that was done over that internet browser was uploaded to a couple of servers in North Carolina. And then we'd actually see them go and mine through all that data.

• 37:39Speaker 03

  So if they needed Bank of America accounts, they could jump in there and show me all the Bank of America accounts that I have login information to. They could go to Chase and issue a command to say, "Show me all the Chase data I've taken."

• 37:53Jack Rhysider?

  Phew. So while the FBI is ramping up their efforts, the criminals were also ramping up their sophistication and streams of revenue. This has grown quite significantly from its meager eBay fraud with 6,000 infected nodes to now a worldwide plague of hundreds of thousands of computers infected, stealing everything they could and selling everything that they thought was valuable. They were making millions of dollars now, and the FBI really wanted to stop them at this point. But these guys were good, like really good. They had a sophisticated proxy network. They used PGP for all their emails. They used end-to-end encrypted Jabber chats when they're communicating to each other and encrypted everything that they were sending in back and forth between them and the command and control server.

• 38:36Jack Rhysider?

  The FBI couldn't even follow the money since it used a whole vast network of money mills that would scour the world. And on top of that, they were somehow constantly moving around in Romania, changing IP addresses all the time, so the Romanian police couldn't find them either. We're going to take a quick ad break here, but stay with us because the FBI is not giving up.

• 38:59Jack Rhysider?

  This episode is sponsored by Vanta. As AI adoption grows, so do your company's security risks and requirements. New frameworks, audits, and vendors keep piling on, but your team isn't getting any bigger. Most compliance tools promise automation, but you're really stuck doing all the work by hand, chasing screenshots, validating controls, and playing catch-up when audit season is coming around the corner again. Vanta works differently. Their Agentic Trust platform is built to scale with you, not slow you down. With over 1,400 automated tests across 400-plus integrations, Vanta collects evidence and monitors your controls year-round, cutting your audit prep by 82%. Plus, you can access the Vanta agent everywhere you work, whether your team is in Vanta

• 39:44Jack Rhysider?

  every day or living in tools like Claude or Cursor. Want proof? Over 16,000 fast-growing companies like Ramp, Writer, and Harvey save time and resources while scaling fast with Vanta. Learn more at vanta.com/darknet. That's spelled V-A-N-T-A. Vanta.com/darknet.

• 40:07Jack Rhysider?

  Liam over at Symantec kept watch over what was happening on the wires. And at one point, he saw a scam happening in progress.

• 40:16Speaker 01

  I reached out to some people who were about to become victims because I was able to see their information as the auction was in progress. And I saw their telephone number, and I called them, and I said, "You are being victimized. I'm calling you. I'm not trying to sell you anything. I'm telling you now, you're about to get scammed because of this auction." And they wouldn't believe me. They would think I was trying to scam them, and then they would go ahead, and I would see that they had continued, and they had bought their fraudulent car even though I'd actually warned them.

• 40:44Jack Rhysider?

  I'm sure you've heard the phrase that in cybersecurity, the defenders have to be right all the time, but hackers only need to be right once to get in. But in this scenario, the hackers were essentially on defense since they had to be super careful not to reveal anything about themselves because one slip up and the FBI would swoop in on them and it would be all over.

• 41:05Speaker 01

  It is very interesting that what we were doing was we were waiting for their one slip up. We were getting mountains and mountains of data and we knew that they were protecting themselves, but they couldn't be right all the time. It's so, so difficult to be right all the time and to have failed safes everywhere. And eventually, they did make those like tiny, tiny slip ups. It was like, you know, you know, one 10-second period out of three years of monitoring data that, you know, broke the case. So it was incredible.

• 41:33Speaker 02

  And that's what Brian was referring to earlier when he was talking about, you know, we're doing all this legal process and we're at that time getting some pushback on why are you continuing to capture all this data? It's because, yeah, it's all encrypted and we're not getting a lot out of it, but we have to continue capturing it, watching for those one little mishaps where they make a mistake. That's the only time we can get information that is going to reveal to us who these people are.

• 41:59Speaker 03

  And at the time, we had the largest data intercept in the Bureau.

• 42:05Jack Rhysider?

  For this case?

• 42:06Speaker 03

  For this case. Because it was all going through, all the command and control traffic was going through these servers. And we had to keep re-upping because we were getting little snippets here and there. Occasionally, we'd catch them emailing a new email account that we hadn't seen before and that turned out to be one of their money mules. And their OPSEC wasn't nearly as good as these guys' OPSEC. So we were able to start to pull that thread back and work different angles. We had to go brief the Deputy Attorney General during this case because we had done a T3 and Department of Justice doesn't, you know, that's such a...

• 42:46Speaker 03

  You know, a big legal, you know, process that they don't like to use it, especially for long duration. So we had to justify that we're seeing all this encrypted traffic. We are seeing mistakes occasionally, but we had to basically go talk to the DAG and say, hey, this is why we need to do this.

• 43:07Speaker 04

  The reason we had to talk to the DAG, if I remember correctly, was this was the first time in the history of the Department of Justice that we did a wiretap on a server. Previously, you know, wiretaps were invented because of phones. You would listen to the mafia talk to each other. You'd listen to the narcos talk to each other. And they're like, wait, this is a computer. Why, why would you even do a wiretap? And maybe, and there were arguments that we didn't even have to, but we wanted to have belt and suspenders. We didn't want to make any mistakes here. And because we were getting contemporaneous electronic traffic through the server, we wanted to have a wiretap. But this confused a lot of people in the Department of Justice who didn't quite get it.

• 43:46Jack Rhysider?

  Whoa, these guys are really taking this case seriously. They had a T3 wiretap on the command and control server, which happened to be in North Carolina. T3 is short for Title III, which is where they have to get authorization from an attorney general who grants them approval to the data intercept. In this case, the hosting provider for the server was shown the T3 and was able to put a tap in and give the FBI full captures of everything going in and out of that command and control server. But that still didn't help because it was all encrypted. And these Title IIIs expire after 30 days. So they had to keep renewing it again and again and convince the attorney general that they still need to keep it active in hopes that someday they'll see something that will give them the smoking evidence to arrest these guys.

• 44:29Jack Rhysider?

  But month after month, they were not finding anything important.

• 44:34Speaker 02

  We also had a Title III on one of the main email accounts as well. So we were watching the email coming through too. And even though it was encrypted, the body of the email was encrypted, but the email title, the email headers, was not. So we would get the title of the email, and that was the only information that we would see, was just the title.

• 44:55Speaker 04

  You said that, you know, normally the bad guy only has to be right once, and that was sort of flipped around. But that's potentially to identify them. Remember that when, in order for us to indict them, extradite them, and then if they want to go to trial, which these cyber criminals almost always do, we had to be able to prove guilt beyond a reasonable doubt. And these cases are a lot harder to do that with than with a standard case, because you've got to remember you're dealing with a jury. So ultimately, it's not like you're going to be able to go to trial on one mistake. You're going to have to build a body of evidence.

• 45:36Speaker 02

  So they were using an email service that we were able to gather information from as well. And so we literally had over 16,000 emails that we had to sit and review, every single one, pulling out victim information, pulling out MoneyMule information, and information on money transactions, and gathering all of that data together too, to be used later on down the road in trial.

• 46:02Speaker 04

  Most of their emails were PGP encrypted, right? And Ryan explained to me, because I believe the FBI can do anything if they want to. So Ryan explained to me the PGP stands for pretty good.

• 46:14Speaker 03

  Pretty good privacy.

• 46:15Speaker 04

  Pretty good privacy. And so I said, "Ryan, it's only pretty good. Could you get through that encryption?" And Ryan said, "No, you're not putting the right emphasis. It's pretty good privacy. That's how you should be interpreting that."

• 46:31Speaker 03

  And then I also told Brian that I'm only moderately good.

• 46:38Jack Rhysider?

  At some point Liam found something incredible. He was continually capturing all the data through his node that he sneakily set up in their proxy chain, and they were using Jabber to send messages between each other. And they had enabled OTR, which is an encryption, on their Jabber chats. So all Liam could see was that someone was saying something over that port, but he couldn't see what they were saying.

• 46:58Speaker 01

  So Jabber is encrypted, and there are different settings that you can use. And by default, the setting for attach. Attachments is not, it doesn't default to encryption. So your text, all the messages that you sent are encrypted, but attachments are not encrypted. And that was the mistake that they made. They were talking to each other and we couldn't see what it was that they were talking about. But if they sent an attachment like an Excel spreadsheet with all of their accounting in it or a picture of their desktop, that was not encrypted. And we could extract that from the network and we could see what it was.

• 47:29Speaker 03

  Yeah, that being said, the majority of the attachments they sent were encrypted. They just occasionally, you know, they're, they're human too. Forget to, forget to encrypt something or there's a, you know, something, something doesn't work right.

• 47:43Jack Rhysider?

  Whoa, this is something I did not know. That if you take the extra steps to add OTR to Jabber in order to encrypt all your messages, it still doesn't encrypt attachments? And that's a whole separate process to enable and apparently it's extra tricky to do? And it's interesting because these guys were clearly making every effort they could to stay hidden. And they still couldn't reliably keep their stuff encrypted. So many places for your data to leak. And so one day Liam saw an attachment which wasn't encrypted. And it was a goldmine for this case.

• 48:15Speaker 01

  We got to see them transferring spreadsheets, talking about all of the transactions, how much money they were making, who were the victims? What were the credit card numbers of the victims? What were the home addresses of the victims? What money meals they were using, the identity of all their money meals.

• 48:31Jack Rhysider?

  This was huge because it listed each of the members of this group and how much money they each made. Here's what it said. Member MF got 25%. Member Links got 25%. Min got to take 10%. Amy took 25%. And Raul got 15%. This essentially showed how many members were involved and their abbreviated nicknames. They even took extra steps to obscure their hacker names. Like later they would find out that Amy stood for a mighty SA. And by this point, the FBI also stood up an infected machine in their office to watch some of this traffic too. And it's remarkable to think that these criminals were feeling clever and thinking they were super sneaky and laying low.

• 49:13Jack Rhysider?

  While in reality, a lot of their traffic was being routed right through the FBI's office. But that wasn't all Liam captured. He saw another attachment sent over Jabber.

• 49:22Speaker 01

  A picture of their desktop that they had transferred between each other. Two members had transferred between each other. And they were trying to figure out why something wasn't working with their malicious campaign. So one of the Bayrob members had taken a screenshot and had transferred it to another one, but they had actually gone through my proxy machine at that time, so I could see this. They were using encrypted chat, actually, so I couldn't see the chat, but because the pictures that they sent in the chat were not encrypted, I got this rare opportunity to see this image get transferred across, just like flash across my network. And when we decoded it, we saw that it was the attacker's desktop, and he was inside a VM machine.

• 50:03Speaker 01

  And then he had his control panel, his attacker's control panel, on the desktop, and he had a Facebook campaign that they were using to try and find victims on the desktop. And he was running that campaign through a hacked account, so he had the hacked account information there as well. And we could see how many machines they had infected, and we could basically see the entire attack, the entire fraud campaign, from beginning to end, right in that one screenshot. And it was just, it was just, it was just a total encapsulation of all their fraud in one picture.

• 50:38Jack Rhysider?

  The screenshot is incredible for this case. You can see this guy's desktop. You can see he's logged into a victim's Facebook page. You can see he's posted an ad, work from home, to try to recruit a money mule. And you could see the command and control server in the background. You could see he has chats open with somebody called Master Fraud, which is interesting because MF was one of the people getting 25% of the cut. So now they start linking MF must be Master Fraud. And they could also see he's encrypted his computer with TrueCrypt, since that was a process running in the background, which might be helpful later.

• 51:11Speaker 04

  The challenge that we had was there's all this encrypted traffic. We think we have the three guys, but we can't get any substantive evidence connecting any one of them specifically, other than the first mistake, to the scheme. And that's when we found out that one of the other two had decided to travel to Miami, to the United States. And this could only be because after 10 years of committing this scheme and nobody knocking on their doors, they felt like they were pretty secure. At this point, they had really amazing opsec, as Ryan mentioned. And this particular guy, whose name was Tebeju Danet, had competed in international programming competitions

• 51:53Speaker 04

  and had even had an internship at Google in the US before he switched over to crime. So he had friends in the US and we got advanced intelligence was gonna come to the US.

• 52:05Speaker 06

  Arrest him on sight.

• 52:06Speaker 04

  Well, that was our initial thought, but we knew if we arrested him, first of all, we didn't have enough evidence yet. But even if we got that evidence while he was there, if we arrested him, we thought the other two would flee. And we'd never see him again. They would go to Russia or somewhere else where we couldn't get them.

• 52:24Speaker 03

  And when he was coming into the country, we actually had no technical information tying any one of these individuals to the Bay Robb infrastructure. The Romanian National Police had very similar data intercepts upon their homes. And guess what they weren't seeing? Any connection to the Bay Robb infrastructure. They weren't talking to the servers, they weren't talking to the proxies, they weren't talking to Tor off of their home internet.

• 52:56Speaker 06

  So their home ISP was clean, completely clean.

• 52:59Speaker 03

  There was a little bit of encrypted traffic that we couldn't explain, but there wasn't anything that we could do with it, so.

• 53:06Speaker 02

  So I like to refer to what Brian's talking about when this guy comes to Miami as Christmas in May. We were so excited for this to happen. We only had, I think about maybe a 10-day lead that he was coming to the United States. And we had to put together an operation to gather as much information on him as we possibly could when he was here. And we had 10 days to prepare to do that.

• 53:31Speaker 04

  So we decided to get a search warrant. We didn't need a search warrant, technically, because there's a border exception. What we wanted to do is when he came across the border, we wanted to search all his digital devices. And we're hoping he'd have a lot of digital devices on him and that this would break the case. But the exceptions to the search warrant requirement were really under. attack at the time and continue to be in part after Snowden, in part Dural, a number of events that were going on. So we didn't want to rely just on a exception to the warrant requirement, especially if we had time to get an actual warrant. So we did get an actual warrant and maybe you guys could take it from there.

• 54:13Jack Rhysider?

  Did you go to the airport?

• 54:14Speaker 02

  We did, yes. We were down in Miami, both of us with a whole group of support people from the Miami Division as well as from FBI Headquarters to, as Brian said, we were going to do a search warrant on every device that he had. We were hoping it was going to be a lot of devices. It ended up not being very much. He did not have a laptop with him. He had his phone and a camera, and I think that was it.

• 54:38Speaker 03

  And we had a full surveillance team on him.

• 54:40Speaker 02

  Yes.

• 54:41Speaker 03

  And he was coming into the country with another individual. So from the time he stepped on US soil, we had a team that was essentially tracking his activity to see if he was making any contacts or did anything that would indicate he was part of this group.

• 55:01Jack Rhysider?

  So the FBI gets short notice of him coming to the US and scrambles to come up with a plan and to meet him at the airport. What they wanted to do is look through his devices to see if they can see any evidence of him involved with this Bay Rob group in order to lead to an arrest. They thought if they interrogated him, that would spook him and he'd tell the others and they'd all go into hiding. So the plan was to somehow get a hold of his devices and search them without him knowing they got searched.

• 55:26Speaker 02

  So the Border Patrol was actually the ones that, you know, sat down. They have to do their interview when you come through. CBPS to interview you. So they did an interview with him and kind of made it take a little bit longer. But they collected his devices and then provided them to us. We were sitting in a back room that he didn't even know there was approximately 30 people in this back room, all because of him to review his devices, to image his devices. So Customs and Border Patrol did an interview with him, collected his devices, passed them to us. So we could then have our computer forensic examiners image his devices.

• 56:06Speaker 02

  And he had no idea.

• 56:07Speaker 06

  And then he gave it back and he left the airport without knowing everything it copied.

• 56:11Speaker 04

  He did not know, but he was pissed enough and realized that he wasn't gonna do this, he was gonna make this mistake again. So he was communicating with the other members of the group through an encrypted messaging app, Jabber, but it was saving logs. And he changed after this whole incident. He didn't think he was identified, but he's like, "Let's stop recording those logs." And he changed his password on his phone to "the romanian for US Customs can blow me."

• 56:44Jack Rhysider?

  Wow, so the FBI took full forensic snapshots of everything on his phone, and he had no idea they were there. And then they tailed him the whole time he was in the US like ghosts.

• 56:56Speaker 02

  And so he was here in the United States for, I believe, it was about 12 days. So we had him under constant surveillance almost that entire time. And he wasn't just in Miami, so he landed in Miami, they were in Miami for a couple of days. They went to DC for a couple of days, then they went up to New York, and then ended up in Boston. And we knew he was gonna end up in Boston, because that's where he flew out of.

• 57:19Jack Rhysider?

  They took a look at the data they got from his phone.

• 57:24Speaker 03

  Stacy and I are in the Miami field office reviewing this almost immediately. Because this is the best opportunity we have to actually get some visibility that we can tie directly to an individual who we think is a member of the Bayrob Group. And we're rolling through this phone, through all the data, and we come across the Jabber chats. And for the first time ever, we actually find communications that were encrypted, but are decrypted or unencrypted on the endpoint on his phone, talking about Bayrob Group operations. They're talking about crypto mining and how much they're making a month crypto mining.

• 58:08Speaker 03

  He's talking to the head of the group who's in Romania. At that time, they were making about $6,000 a month mining their network of infected systems. Master fraud. Master fraud, yep. Incredibly technically gifted actor out there.

• 58:27Speaker 04

  And by the way, I just, I always want to tell people, when you're naming your criminal character, when you're giving your criminal alias, it's best not to name yourself after the crime. Because it may sound really cool at the time, cool to all your friends, the other group. But when you're eventually caught, and you will eventually be caught, it dramatically limits your available defenses. So here, it limited his defense to, "Master fraud? Who? I had never heard of any master fraud." You can't argue at that point that this wasn't fraud. Everybody, everyone understood what we were doing. No.

• 59:03Jack Rhysider?

  Ryan and Stacy were able to look through the chats, which were logged on the phone that they got a snapshot of. And most of what they saw was benign. Nothing to do with this Bayrob malware operation at all. But because Ryan and Stacy knew this case very well, they would spot tiny clues. Like MF was mentioned every now and then, very rarely. And they knew MF was short for master fraud, one of the leaders of this organization. So little things like that would start to make them see the network of who he's talking to. And another thing they found were chats mentioning a file name that they knew only existed on that command and control server that they had access to. So this linked him to knowledge of that command and control server.

• 59:47Speaker 03

  We have a direct tie from this individual to Bayrob group operations, and we know we've got the right people.

• 59:55Speaker 04

  So at that point, we could have arrested him. We had enough evidence at that point to arrest him.

• 59:59Jack Rhysider?

  While he was in the US?

• 1:00:00Speaker 04

  While he was in the US. So this was a difficult decision. Because he was a high-value target. We figured of these three people, he was probably the second most important. But master fraud was still in Romania. And we knew if we arrested him, master fraud would flee, or we felt like that was pretty likely.

• 1:00:16Jack Rhysider?

  They hoped they can eventually capture the whole gang, or most of them at the same time. So they let him leave the country.

• 1:00:24Speaker 04

  We let him leave the country. And part of the reason we felt comfortable doing that was we had worked with Romania for so long at this point. I personally had been to Romania something like seven times. And so we knew that we could work with them to successfully extradite.

• 1:00:38Jack Rhysider?

  You went to Romania seven times just for this case?

• 1:00:40Speaker 04

  Just for this case, yeah. So this is where it started getting exciting.

• 1:00:46Speaker 04

  Because Danet was here, and we got that additional information from the Jabber chat log, we were able to go to grand jury, get this indictment, do an extradition package to Romania. And then I think both of you went over there, correct, as part of the arrest and takedown?

• 1:01:02Speaker 02

  Yeah, we both went, along with, we took four computer forensic examiners with us as well. So there was a team of six of FBI over there.

• 1:01:10Jack Rhysider?

  They had identified the names and addresses of the three main men behind this Bay Rob malware campaign. There was Bogdan Nicolescu, aka Master Fraud, Tiberiu Danet, aka Almighty SA, Radu Mihlaus, aka Minolta, aka Radu SPR. The goal was to arrest all three at the exact same time so none of them could tip off the others. So the FBI and the Romanian police had to split up.

• 1:01:38Speaker 02

  Yes, yeah. So all three of them were in different locations. So we had to split up. And so, yes, Mihlaus had unexpectedly left town. They thought that he would be, I believe he was living in Brășov, also where Nicolescu was living. And so they expected him to be there, but he had left town like the day before and had gone to visit his grandmother in a completely different city in Romania. And so they had to figure out where he was and do surveillance on him. And then they stopped him in his vehicle on his way back to Brășov.

• 1:02:08Speaker 03

  Stacy, you were in Bucharest, and I was in Brașov, which was where Nicolescu had a home at the end of a street. And we were there when RNP made entry into the various locations that we had.

• 1:02:29Jack Rhysider?

  So what's it like going in their house and collecting that stuff?

• 1:02:32Speaker 02

  It was interesting. It was very different. They have a different process than we do. So I think we found it very interesting to watch the Romanian National Police and see how they do things, how they collect evidence versus the way that we do it. And then, because we were there, the nice thing was, we were then able to, a couple of days later, take all of the evidence with us and take it back to the United States with us.

• 1:02:56Jack Rhysider?

  So they caught him, and they took all their devices back to the United States. But the Bay Rob gang was still in a jail in Romania. And we're going to take an ad break here, but stay with us because the next step is to get him to the United States and to prosecute them.

• 1:03:12Jack Rhysider?

  So the FBI searched the homes of this group. And they were really hoping to catch them in the act with their computers open so they wouldn't have to crack any passwords and unlock computers. But when they entered the house, all the computers were off and locked. But as they looked around, they were able to solve one of the mysteries they had, which was how this group kept moving around with their IP addresses so much, sending the Romanian police to the wrong address so many times. One of the things they found were these large directional antennas.

• 1:03:38Speaker 04

  What we realized with these directional antennas, which made for great trial exhibits, was that they were never using their home internet when they were involved in criminality. They would hack into another account in Bucharest. And Bucharest is a very big city. It'd be like doing it in Manhattan. And so every time, they would just hack into a different person's home Wi-Fi. And that would be the start of their proxy chain. They would start there. Then, at least towards the end, as Danette explained it to us, they would go to Tor. Then from Tor, they would go through their proxy chain, which was typically one to three infected computers.

• 1:04:19Speaker 04

  And then from there, they would go to America Online, where Owen was seeing them. And then from there, that's when they would use commercial ISPs, like Google, Facebook, eBay, et cetera.

• 1:04:32Speaker 03

  So the way they were operating is they would actually meet up. And everybody would essentially get a standard build. So their laptops were all built out the same way. And Nikolescu would configure them to be essentially, you know, they get the cybercrime package, which means multiple levels of encryption. So they were running Linux with Lux on it. And then they had a couple of TrueCrypt containers on it. And then Nikolescu had written his own.

• 1:05:03Speaker 03

  Encryption software for because TrueCrypt was no longer being updated.

• 1:05:10Speaker 06

  So it's five layers of encryption just to unlock the laptop?

• 1:05:14Speaker 03

  Yeah, four or five different layers and everybody in the group got the same package essentially. And they also, that was not the extent of it, they also got some networking gear. So each of them got a custom flash router. And that custom flash router would allow them to proxy their traffic between their different houses. And their operational security was that their first hop from their house was using a directional Wi-Fi to the internet. And that individual, say, you know, Nikolescu was in Brazov, he would establish that on the router, the custom flash router. And then he would communicate to the other group that his router was set up and everybody would tunnel their traffic for the group

• 1:05:59Speaker 03

  through that stolen Wi-Fi, through the router at that location. And then they'd switch the router the next week to another individual's home. And that was why we were seeing the encrypted traffic between the two locations that we couldn't explain. It was their tunneled encrypted traffic that was then being sent over stolen Wi-Fi using the directional antennas, then to Tor or Proxy Network, then to infected systems, then up into the command and control infrastructure. So again, you know, they were doing a pretty good job of hiding their tracks.

• 1:06:35Speaker 01

  So when I was seeing IP addresses that I thought could identify the address of the attackers, it turns out they're using directional antennas to steal their neighbor's Wi-Fi. So the addresses that I was seeing were very rarely their actual home address and I had to look at the data very, very carefully to understand when had they slipped up and they weren't using their neighbor's stolen Wi-Fi. They were actually using their own home IP address by mistake. And those slip-ups are very, very rare.

• 1:07:03Jack Rhysider?

  The FBI wanted to prosecute these three in the United States. But in order to do that, they had to convince the Romanian police to allow them to extradite these three to the US to face trial there. But in order to get extradition approval, they had to have clear evidence as to who everyone was in this case and what they did.

• 1:07:20Speaker 02

  Because it might not be necessarily clear to other people that, you know, when we're indicting this group, we can't just say, "This is the group, and they did all of these things." We need to be able to say, "This person is master fraud, and this person is a mighty SA." And this is the roles that they, each individual, played within the group. And so for a long time, yeah, we knew who the three people were that were running everything, but we could not say which one was which as far as their criminal moniker was concerned. And so it wasn't until we got Danette's phone, and then we were able to, Ryan was able to connect his login activity with his vacation time, that we were finally able to say, "This person is this person, and this person is this person."

• 1:08:03Speaker 04

  So the extradition was seamless with Romania because of all this background work we had done. So this was amazing. We got them into the US in a couple of months.

• 1:08:18Jack Rhysider?

  They get the three guys on US soil and then go in to question them. First, they start with Danette, aka a mighty SA. They show him all the evidence they have against him. And basically said, "Look, you're definitely going to be found guilty. We have a ton of proof. But if you plead guilty, we'll try to get your prison sentence much lower."

• 1:08:39Speaker 03

  So Danette ends up pleading, and we confronted him with the evidence during a proffer session. And during our investigation, one of the things we did with the evidence collection is we had really good visibility into when they were logging into and logging off of all of their criminal accounts. And we didn't know it at the time, but this information ended up being incredibly valuable because it established this pattern of life for all the different actors. We could see when they were online doing, you know, like in their criminal accounts and when there were large gaps.

• 1:09:21Speaker 03

  And when we were able to get Danette's personal computer and search that, he liked to travel. And he vacationed a lot. And he also took photos of everywhere he went. He was an avid photographer. So we could see through the photo metadata when he was in these certain locations. And then we overlaid it with all the criminal account data. And you could see that every time one of these accounts went dark, Danette was on vacation.

• 1:09:54Speaker 04

  He logged on faithfully to the criminal account multiple of times a day, every day, except for the exact periods of times when he went on vacation. And there was something like 30 vacations. And I remember, we talked to him. And I said to him, "Look, we created a spreadsheet or a diagram to show this." And I said, "Like, you know, look, if there were five overlaps in vacations, that would be curious. If there were 10, hmm, something's going wrong here. But with 30, you are the guy. You are a mighty SA."

• 1:10:25Jack Rhysider?

  And Danette told them a lot. One thing he said was how many other members were involved in this back in Romania. And as it turns out, he listed six other members and what roles they had. This was huge for the FBI to paint a full picture of this group, each member and their operations. Okay, so Danette pled guilty. And he was sentenced to 10 years in prison and was cooperating. The other two weren't talking. And they were just sticking to their not guilty pleas. So it meant that this case was going to go to trial. Now, you would think the hard part is over for the FBI and the prosecutors can take it from here. But the opposite is true. In the month before the trial, the FBI had to work harder than ever.

• 1:11:06Speaker 03

  Well, to explain how this process works, we worked, we all worked, probably straight 30 days. You know, my wife at the time, so I've got 15-year-old triplets. And she's from Colombia. And I told her, listen, for the next month, month and a half, I'm not going to be at home. I'll be at the office pretty much the entire time. She takes the kids, heads down to Colombia. And that's the same for all of our families, right? They didn't get to see us. We were in the office. A 10-hour day was probably a short day. This is go time.

• 1:11:44Jack Rhysider?

  Because now, the FBI had to convince a jury that these men are guilty beyond doubt. But it's always very tricky to present electronic evidence to a jury since a lot of times, they aren't very tech savvy or know what this evidence even means.

• 1:11:58Speaker 04

  And I gotta say, the most important, I guess at the end of the day for the jury, the most important piece of evidence came from the fact that Donetsk, when he was cooperating, told us everybody else who worked with the Bayrob group. And Stacy, you know, we talked with Stacy and Ryan and we decided that there was not enough evidence to indict any of those people. Because we couldn't just indict them based on one criminal saying, "These are the guys." Because, you know, the jury's not necessarily gonna believe a criminal. So Stacy said to me, "Well, why don't we just go over to Romania and talk to them and try and get them to testify?" And I said, "Well, I don't, why would they come to the United States,

• 1:12:42Speaker 04

  risk being arrested to testify when we don't have any evidence against them?" And Stacy brought up the good point, "They don't know, we don't have any evidence against them." So Stacy and I went back to Romania right before trial. And we ended up flipping, what was it, five out of six?

• 1:13:01Speaker 02

  Yeah.

• 1:13:02Speaker 03

  Five out of six. All three of us went back.

• 1:13:04Speaker 02

  Yeah.

• 1:13:04Speaker 04

  Oh, yeah, sorry.

• 1:13:06Speaker 03

  And we flipped five out of six of them.

• 1:13:08Speaker 04

  Five out of six.

• 1:13:09Speaker 02

  And they agreed to come to Cleveland and testify at trial.

• 1:13:13Jack Rhysider?

  And what's in it for them?

• 1:13:15Speaker 02

  So again, they didn't know that we didn't have enough evidence to include them.

• 1:13:19Speaker 03

  Well, to be honest, we had a lot of information on them, right? So we knew that they were involved. We knew what their roles were in this because we had a number of individuals at this point in time that were telling us that they were involved and what their roles were and what their criminal modickers were. So we did know, you know, what accounts they were using and what their job was within the group. But we, at the time, we didn't feel, I mean, we could have tried to indict them and extradited them. So it wasn't an empty threat. It was just, we didn't feel like we had enough because in these cases, we really only indict

• 1:14:00Speaker 03

  and extradite folks when we've got a really bulletproof case.

• 1:14:05Speaker 06

  Your track record is 99% conviction rate.

• 1:14:08Speaker 04

  And they have to have had a significant role, too. We're not going to just necessarily indict everybody who did anything. And so, basically, we talked to these people individually and they believed that cooperating was in their best interest. And a lot of them felt really bad about what, because a lot of them had moved on at this point. It took so long to do this case. A lot of them now had kids and had a regular job and were like so embarrassed. Some of them were crying when we were talking to them and not because they were scared of the consequences, but I think because they were humiliated by the fact that they had done this and people now knew they had done this.

• 1:14:42Speaker 06

  So what's the option you give them? Like, can you come testify, please? Or come testify, or we have evidence on you?

• 1:14:49Speaker 04

  I'm going to jump in on this one. There was no quid pro quo or anything. It was purely optional. They had to, we didn't make any promises to them. They had to believe that this was in their best interest or just want to do it out of their own.

• 1:15:02Speaker 06

  So it's just a matter of, hey, come clean.

• 1:15:06Speaker 04

  Well, it was 10 years later, they remembered, all of them remembered, like waking up and Nicolescu and Danet and MacLeod being gone, and word starting to spread, and everyone was freaking out there because there weren't too many extraditions from Romania to the US. I think cyber criminals in Romania felt like the worst thing that could happen was they'd be prosecuted in Romania if they were caught, and in Romania you kind of got a slap on the wrist, you wouldn't spend much time in jail. So, this was like seismic when these arrests happened in Romania, and they just wanted to curry favor, I think, at that point, they wanted to be helpful, they didn't want to risk any bad things happening to them.

• 1:15:49Jack Rhysider?

  Now, even though they had seized everyone's computers, they still couldn't get into them, because remember, each computer was wrapped in five layers of encryption. First was this boot integrity thing, making sure that no hardware changes since setting it up. Then they would use Lux to encrypt the Linux partition, then there was a custom layer of encryption that Master Fraud wrote himself using SSE, then there was a TrueCrypt container, and then there was another TrueCrypt container, and keep in mind that every layer has its own unique, complex password to decrypt, and once they got through all that, then you would boot into Linux, and then finally there were these virtual machines that they would load, and that's where they would do the work from. I think it took like five or eight passwords just to log into work every morning for these guys, which is incredibly impressive.

• 1:16:32Speaker 04

  Master Fraud, he programmed in assembly language, so, very unusual character, and when we got these computers, and Danet explained to us what we were seeing, not only was it this multiple levels of encryption, they had built, Master Fraud had come up with himself, a kill switch that would enable him to press a single button and encrypt the whole machine, and if he didn't decrypt it within a certain amount of time, it would just wipe the whole thing. He created his own software-based keylogger, so if the FBI or Romania had put something in the computer, it would have detected and alerted that. So, you know, he was off the charts compared to what we see, even at CSIPS where it's all very advanced.

• 1:17:17Speaker 03

  So, these systems were all configured the same, and they had similar toolsets and the same kind of encryption everywhere. So when Danette pled, he actually was able to provide his password for a couple layers of that, his work platform. So we were starting to be able to, essentially peel back the layers of encryption and see what was in each layer of encryption. So we'd peel back the first one and we'd get into the Linux operating system that they were using. And we saw that there was some source code for the encryption software,

• 1:18:02Speaker 03

  the container software that Nikolescu had written. We'd come across a couple of additional TrueCrypt containers and we could unpack some of those. And we were doing forensic analysis on these systems. And sometimes we'd be able to find a mistake where they left a password somewhere or we were able to get in because somebody would tell us what their password was. I remember one of the passwords was "pizza kitchen" in Romanian backwards. That was his password. And it was like a 15-letter, or maybe it was longer than that password. And it needed to be in concert with another password. And we only got so far. So we could only get so far through that encryption

• 1:18:47Speaker 03

  because they had been in jail for a bit after being extradited and their passwords were extremely complex. And we could never, never get in past the layer that Nikolescu wrote. I had actually gone to Quantico. We have a lab there that specializes in helping in these highly advanced technical situations. And we brought the source code out there and they analyzed it. And we spent a lot of time trying to break into it. And everybody will say, "The first rule of encryption is don't write your own." But in this case, Nicolescu was so good that he wrote a pretty solid piece of, you know, encrypted container software.

• 1:19:31Jack Rhysider?

  So even the FBI couldn't crack into these machines. And they even tried to crack the passwords by brute forcing it. But the way SEC and TrueCrip was set up was they worked in tandem. So the FBI would have to crack two passwords at the same moment to get through those layers. And that made this astronomically more difficult.

• 1:19:49Speaker 04

  But one of the things we learned is these computers still had value, even if they were completely encrypted. So at trial, we were able to show Nicolescu's tower, which had hard drives that you could just pull in and out like a data center, which was not what a normal person would have. And we were able to have the FBI testify, yes, this was on his desk. This was his tower when we came in there. And, you know, we've used all our tools. We are not able to decrypt any of this. And that's pretty powerful when you have all this other evidence that this guy is master fraud. Because, you know, the jury's looking at this enormous tower of hard drives. They know this is nothing like their home computer.

• 1:20:32Speaker 04

  They know the FBI with all its power can't get into it. And they're thinking, all right, something's up here.

• 1:20:39Jack Rhysider?

  With a list of money mules and money muling being illegal in the United States, were you going around and arresting all these money mules?

• 1:20:46Speaker 02

  So we did have conversations with a lot of the money mules. And many of the money mules were arrested by their local police. We did not arrest any of the money mules or prosecute them, Ali.

• 1:20:57Speaker 04

  Yeah, so at trial, we had some of the money mules testify. And they were victims as well. In fact, in some ways, they were the most scarred victims based on their testimony. First of all, what the Bayrob group told them in many cases, they would place advertisements for them on Facebook, on... Their machines tended to be infected as well. So when they would go to Yahoo or Google, they would see an advertisement for a wire transfer agent. And so they thought this was legit. And what the Bayrob group would tell many of them was that when Americans... Go and travel in Europe. They often get mugged and lose their passport and lose their money. And so what we do is we help relatives get the money quickly.

• 1:21:40Speaker 04

  And so these people thought they were actually doing something good, that they were helping out. And I will never forget when one of the most prolific money mules testified at trial. And the defense attorney tried to cross-examine her and make her, you know, he said, "Well, you're calling these people victims now, but you didn't see them as victims then." She absolutely exploded because she was, she said, "I was so embarrassed. This is like the worst thing that's ever happened in my life. I never knew. I didn't mean to do this, etc." And as he was coming back, he turned to us at the prosecution table and said, "One too many questions."

• 1:22:28Speaker 03

  We took all the evidence that we had collected over this entire case. We took all of our victim complaints. Stacy and I went through all the ic3.gov complaints. We went out and interviewed hundreds of victims, I felt like, at the end of this. And had some of them come testify at trial. We had a search warrant on a couple of the command and control systems, which I had actually stood up a copy of that command and control server in our office. And then I invited Liam to come out because he had done so much of the technical analysis that we needed another expert set of eyes on what we are seeing.

• 1:23:11Speaker 06

  How much money do you think they made?

• 1:23:13Speaker 03

  So we had hard numbers, that they defrauded people out of $4 million.

• 1:23:18Speaker 06

  Defraud?

• 1:23:19Speaker 03

  Yeah, well, in total, made $4 million.

• 1:23:22Speaker 02

  At least $4 million. We had identified over 1,000 US victims.

• 1:23:27Speaker 06

  1,000 victims?

• 1:23:28Speaker 03

  Just on the eBay fraud alone.

• 1:23:30Speaker 01

  What we had estimated they made over the entire length of the operation, because they've been operating for 10 years. And we didn't have accounting for all of those years, but we could see a lot of the output. And we were able to estimate over the given period that it was about $40 million.

• 1:23:46Speaker 06

  And then how big was the botnet?

• 1:23:48Speaker 01

  Botnet reached a maximum of about 450,000 machines. And at any one particular time, they had hundreds of thousands of machines operating.

• 1:23:57Speaker 04

  That was other key evidence, by the way, because once we arrested them, the botnet stopped.

• 1:24:02Speaker 02

  And I was gonna say, one of my favorite moments in this case was actually, you know, we'd been watching this group for almost 10 years and had identified, like I said, over 1,000 victims of eBay fraud. And so it was so frustrating to know that this was continuing to go on, year after year after year. And then finally, we were in Romania when they arrested them. And the day after we arrested them, I turned to Ryan and I said, "Master Fraud is in jail right now. Like, it's done. We have stopped the fraud and the victimization."

• 1:24:35Speaker 06

  Okay, so you bring all this evidence. What's the defense bring?

• 1:24:39Speaker 04

  Well, so the defense's main defense is the most common defense that you typically see at the Department of Justice, which we refer to as the SOTI defense, which stands for "Some Other Dude Did It", which we, I would refer to as the SORTI defense in this case, "Some Other Romanian Dude Did It." So that was their defense. They didn't put on witnesses. They challenged our evidence. And as you would expect in a case like this, argued that there was insufficient evidence to say that these were the guys.

• 1:25:13Jack Rhysider?

  This jury was mostly retired, and a few people didn't even own cellphones. It was going to be tricky to present all this evidence to them.

• 1:25:20Speaker 03

  Owen's doing traffic analysis. You know, Liam's doing reverse engineering. We have title, you know, data intercepts on the command and control infrastructure. We're addressing topics like encryption and crypto mining and being a vendor on the dark web to essentially folks that are not cyber savvy. And frankly, the entire team did a great job of taking this complex evidence and making it relatable to the jury and understanding. A lot of what we did,

• 1:26:00Speaker 03

  it was truly education of what we had and why it was important in very common terms.

• 1:26:09Jack Rhysider?

  And they did it. They were able to convince the jury that both men were guilty.

• 1:26:14Speaker 04

  They were found guilty on all counts. Dinet, consistent with the plea agreement, was sentenced to 10 years in prison.

• 1:26:24Speaker 04

  McClaus was sentenced to 18 years. And Nikolescu, who was master fraud, was sentenced to 20 years.

• 1:26:33Jack Rhysider?

  Wow, 20 years, that sounds like a lot.

• 1:26:37Speaker 04

  These are tremendous sentences for a cybercrime case. What you gotta remember is, the judges who sentence, and it's the judge who sentences, not the jury, they're sentenced for all kinds of cases. They see terrorism, they see murder, they see all these crazy cases. So, at the end of the day, a lot of judges are like, "Well, you know, this guy hacked, you know, we're talking 4 million, or 40 million, or whatever the case may be. It's not a billion-dollar Ponzi scheme, it's not, nobody died, so I'm gonna give him a couple of years." We see that all the time. And so, it was only because, I think, we had so much great evidence, we had so many victims testify about how it impacted them,

• 1:27:22Speaker 04

  the money mules, and the scope of the crime. And we were also able to show that these guys weren't just doing their criminal job, they were really sadistic. They really wanted to hurt the victims. For example, they developed one phishing email that was supposedly your HIV test results. And when you clicked on the link, you were positive. It's like, why would you do that? You know, I mean, like, you're freaking people out way more than even the value of the money. And so, I think the judge realized this was a serious group, it was a serious threat. If they get back out there, they may just start up again. And so, we felt quite good. Those were some of the highest sentences you'll ever see, or at least as of that time, in a cybercrime case. And even today, it's pretty rare.

• 1:28:08Speaker 03

  Yeah, I think the other thing that is sometimes lost in this is that, you know, each one of these victims, this does something different to each one of them, right? So, any one of us may lose, you know, $7,000 and we'd, you know, write it up to, "Man, I made a huge mistake there." But the folks that were being victimized here, you know, they were, they're folks that really couldn't afford an extra $7,000, right? They were buying a vehicle to get to work. Some of these victims, you know, they're, it caused a lot of strife in their relationships, where, you know, one person in the relationship said, "No, that sounds like a scam, don't do it."

• 1:28:52Speaker 03

  And they did it anyway, and they lost it, and it started, you know, kind of a downfall in that relationship. We had some folks that were divorced over this, we had...

• 1:29:01Speaker 06

  What was that for?

• 1:29:02Speaker 03

  Well, because they basically disagreed that, well, when they lost the money, it caused such strife in the relationship, that they...

• 1:29:11Speaker 06

  You idiot, you got scammed?

• 1:29:12Speaker 03

  Essentially.

• 1:29:13Speaker 06

  Wow.

• 1:29:14Speaker 04

  And I want to be clear, though, like, you could be very smart and still fall for this. So, two things I want to make clear, I don't know if it was clear from, um, from the background. When you went to eBay, the malware, if you were infected with the malware, it would make it appear that eBay had an escrow agent protection program, and you were sending the money to a eBay escrow agent, who would only release the money once you got the car and were satisfied with it. That was all just the malware, it was a money mule. But anybody would see that and think, "All right, that sounds very safe."

• 1:29:48Speaker 06

  And the URLs would say eBay even, it was just all malware.

• 1:29:52Speaker 04

  Exactly right.

• 1:29:53Speaker 06

  That's really sophisticated.

• 1:29:54Speaker 04

  And one of the victims who testified at trial was a used car salesman, like, who had a dealership, who would buy cars online all the time. And he fell for this too. He had a very lengthy chat with the Bayrob group, not knowing what was the Bayrob group, about this escrow agent program, because he hadn't seen it before. They must have stayed on with him for an hour to convince him that this was real. And then ultimately, he fell for it. And I think that helped, that the jury, you know, looked at this guy testify, who was victimized as a car dealer, and were like, "Oh, well, if he fell for it, I would have fell for this."

• 1:30:26Jack Rhysider?

  And with that, the FBI investigation and prosecution was over. All three of the main people involved were arrested, found guilty, and put behind bars. Wow, what an investigation.

• 1:30:36Speaker 03

  We've got a ton of people to thank for this. So first of all, the Cleveland Field Office was with us all the way. So our cyber squad, our organized crime squad. We had great supervisors that supported us. We had great executive management, fantastic analysts, our computer scientists, our...

• 1:30:59Jack Rhysider?

  It feels like a lot of interns were going through a lot of data there.

• 1:31:02Speaker 03

  Not so much. I mean, these are all professional folks that are doing this. You know, we typically don't have interns on our squads. And so we got a ton of support from the Miami Field Office. We had Customs and Border Patrol, the US Attorney's Office.

• 1:31:19Speaker 04

  Including Duncan Brown, Brian McDonough, and Omakul Carney, in addition to myself.

• 1:31:25Speaker 02

  And then, of course, Symantec and AOL were hugely instrumental.

• 1:31:29Jack Rhysider?

  I imagine eBay was helpful.

• 1:31:31Speaker 04

  eBay was helpful, as was a lot of the brands whose trademarks these guys mimicked in order to trick people. So we had great cooperation and witnesses from Facebook, from Walmart, from eBay, from Google, from Yahoo, all coming to testify at trial.

• 1:31:53Jack Rhysider?

  So what happened to the millions of dollars these guys made? Well, they spent a lot of it as soon as they got their hands on it. The FBI was able to seize some of that, but not enough to pay back all the victims. However, these guys were running huge cryptocurrency farms, basically putting all the infected machines to use to mine crypto. And the FBI seized the computers which held those crypto wallets.

• 1:32:16Speaker 03

  They did have some cryptocurrency. And actually, at this point in time, it's probably worth a lot of money. But it's locked in a couple of layers of encryption.

• 1:32:28Jack Rhysider?

  Really? You still haven't been able to crack it?

• 1:32:29Speaker 03

  We haven't been able to get there.

• 1:32:34Jack Rhysider?

  Wow, those machines sitting in the FBI evidence room hold the keys to millions of dollars of Bitcoin that the FBI would love to confiscate. But the multiple layers of encryption is just too strong for them to crack. And so it just sits there, in a room, unplugged, dormant. How wild. If it was me, I probably would have used that Bitcoin as some kind of bargaining chip to get my sentence reduced. But because they didn't, it makes me wonder that in 20 years, when these guys get out, they might have saved their keys somewhere else that they can still access and come out of prison as millionaires. That's crazy to think about. In case you were wondering,

• 1:33:18Jack Rhysider?

  yes, I did get all these people in the same room to interview them all at once. We all met up at the RSA conference in San Francisco earlier this year.

• 1:33:25Speaker 06

  What are you all doing at RSA? What are you hoping to get out of this?

• 1:33:28Speaker 01

  See where AI is going and see if we can cut through the AI hype.

• 1:33:31Speaker 05

  I'm just here to talk to you and then get a drink with them. And then I'm going back home.

• 1:33:37Speaker 02

  And that's what I'm doing. I'm flying to Chicago tomorrow morning for an ABA conference, so.

• 1:33:43Speaker 04

  I spoke on a panel today about ethics and cybersecurity. And then tomorrow, I am speaking on a panel about a framework for measuring the security and safety of AI. So I was really excited that I could do this as well while I was here.

• 1:34:00Speaker 03

  I'm on a panel with Brian, talking about AI agent security, safety, and reliability.

• 1:34:10Jack Rhysider?

  I'm really intrigued by this whole case because of how much these Bay Rob guys took their opsec seriously. They deployed all the best practices and took extra steps to keep the FBI or anyone else from discovering them. And it was only from these really tiny mistakes, and over the course of 10 years of the FBI and Symantec and AOL diligently listening and monitoring them, that these mistakes were even found. And it's one of those cases that if the FBI wants to catch you badly enough, even with the best opsec there is, they still can. It might take them 10 years to gather enough evidence on you, though. I just want to recap all the things they did here to try to keep the FBI off them, since it's fascinating to me to watch them work. First, they didn't talk openly.

• 1:34:54Jack Rhysider?

  These guys never casually texted each other about this, or talked about their criminal enterprise over the phone. When they would, they would always use encrypted chats. And the FBI also discovered that they often ran the radio in the background when they were working together in the same room in order to keep any listening devices from hearing what they were saying. Next, they didn't use their home internet. They used stolen Wi-Fi, long-distance antennas, and could connect to the Wi-Fi from miles away. And then they'd VPN into one of their houses where the proxy chain would begin. They used Tor and proxies and hacked routers to get online. They encrypted everything, everywhere. Or at least, they tried to. When moving files, they used SFTP. When connecting to their command and control server, they used SSH. They encrypted their hard drives multiple times. They didn't log anything.

• 1:35:38Jack Rhysider?

  At first, some Java logs were saved, but then they turned those off. Logs are like documenting your activities. It's a liability. They created fake personas. Each of them used their hacker handles when discussing this work and never used these handles outside of work. They were extremely careful in that matter. And then they used abbreviated version of those handles on top of it, making it extra confusing. They didn't contaminate work and personal data. The work computer was for work only. Isolated, not just with a physical computer, but also on a separate network. Only approved virtual machines could be used for work. Never do anything from your personal computer. They reduced who they had to trust as much as possible, keeping a small circle of who knew about this. They built their own computers, their own malware,

• 1:36:22Jack Rhysider?

  and didn't share it with anyone. They were self-sufficient, and those who did get to help them often were lied to about what they were doing. This also meant nobody had any power over them. They had to be paranoid at all times in order to keep up these efforts for years and years. And even when they got arrested, two still refused to talk to cops and actually dealt with the pressure well, staying calm and cool the whole time. They conducted counterintelligence, trying to know who might be looking at them, and then blocking those IPs and domains. Yeah, I was told that they found out which IPs that Symantec had in FBI, and were blocking those IPs from accessing parts of their network. And they did so much more. But my goodness, this is what it looks like when bad guys have good OPSEC. They almost made it impossible to be caught.

• 1:37:07Jack Rhysider?

  Because even though they did an amazing job at protecting their data from leaking, they didn't stop every drip. And enough drips can make a puddle.

• 1:37:26Jack Rhysider?

  Thank you so much to my guests, FBI Special Agent Ryan McFarlane, FBI Special Agent Stacy Whitaker, DOJ Prosecutor Brian Levine, and the director from Symantec, Liam Omerku, and from AOL, Owen Miller.

• 1:37:38Speaker 02

  Now that I'm retired, I've created a nonprofit called Crypto Cops Academy that is dedicated to teaching law enforcement as well as students all about cryptocurrency in hopes to, one, instruct law enforcement so that they can better investigate crimes involved in crypto, but then also to instruct the students, young people, all about crypto and how it works, and how to keep their crypto safe, and how to not fall for scams involving cryptocurrency as well.

• 1:38:07Speaker 04

  And because I met and got to work with such incredibly talented people like you've talked to today, I started formergov.com, the first directory of former government and military professionals. And happy to have any of your listeners who are former gov, and that's federal, state, local, tribal, outside the US or military, happy to give them free membership. They can just reach out to [email protected].

• 1:38:35Jack Rhysider?

  What an incredible story. Hey listeners, I'm gonna be releasing a new podcast soon. And it's by far the most insane, dark and crazy story that anyone has ever told me, and probably will ever tell me. And it'll be a five-part series. And if you wanna get in on it when it's launched, sign up to be a premium listener, since I'm gonna be releasing it to those who support me first. All I'm asking is for you to buy me a cup of coffee once a month to show your support. It might not seem like as much, but it's actually huge. It's way more than you can even imagine. It fuels me, it carries the show, it gives me hope, and it's so helpful. So please, sign up as a premium subscriber by going to plus.darknetdiaries.com.

• 1:39:18Jack Rhysider?

  And hey, when you do, you get an ad-free version of the show and a bunch of bonus episodes that you won't be able to find anywhere else. So thank you very much. This episode is created by me, the man in the black hat, Jack Rees Sider. Our editor is the touch typist Tristan Ledger. Mixing by Proximity Sound. Our intro music is by the mysterious Breakmaster Cylinder. Why did the man get fired at the keyboard factory? He wasn't putting in enough shifts. This is Darknet Diaries.