• The agency also announced the seizure of $6.1 million in ransomware payments that had previously been made by victims of the Sodinokibi/REvil attacks.
• Another accused is 28-year-old Russian Yevgeniy Polyanin. According to the indictments, Vasinskyi and Polyanin accessed the internal computer networks of several victim companies and used Sodinokibi/REvil ransomware to encrypt the data on the computers of victim companies. And then, they demanded money in exchange for access to the data. In total, Vasinskyi managed to carry out approximately 2,500 ransomware attacks globally using Sodinokibi/REvil, while Polyanin was responsible for some 3,000 such attacks.
• Vasinskyi has been taken into custody in Poland, where he remains held by authorities pending proceedings in connection with his requested extradition to the United States. Polyanin has been indicted. The ministry thanked the National Police of Ukraine and the Prosecutor General’s Office of Ukraine for their assistance. According to the agency, in Romania, in cooperation with local law enforcement authorities, it has arrested two other Sodinokibi/ REvil actors.
• Many agencies, particularly the FBI, were working to identify the hackers behind the Sodinokibi/REvil attacks. According to the agency, Vasinskyi has spent a lot of time hiding under different names to avoid identification.
• He is particularly accused of attacking the international IT company Kaseya in the summer of 2021. According to court documents, Vasinskyi used Sodinokibi/REvil malware to gain access not only to Kaseya’s network but also to that company’s end-user networks. The malware employed by the accused caused customer data to become encrypted, effectively locking those globally affected clients out of their own systems. About 1,500 businesses were affected during this attack. The total ransom demanded exceeded $70 million.
• Vasinskyi and Polyanin are charged with fraud and money laundering. If convicted of all counts, each faces a maximum penalty of 115 and 145 years in prison, respectively.

About BTC-Alpha

The BTC-Alpha cryptocurrency exchange was founded in Ukraine in 2015 and recently belonged to the Coinmarketcap TOP 100 Exchanges (now it is much lower because of understandable circumstances). Its founder and leadership are Ukrainians. However, the company initially was oriented toward Europe and Asia because, when the exchange was founded, the cryptocurrencies were not well developed in Ukraine.

According to BTC-Alpha’s founder Vitalii Bodnar, today, the company negotiates with the Ministry of the Digital Transformation of Ukraine to register in Ukraine as soon as the cryptocurrency law comes in force.

Currently, BTC-Alpha has 365,000 users, but there are not many users from Ukraine among them. According to Coinmarketcap, the current daily trading volume on BTC-Alpha is $223 million.

How the hack became possible

BTC-Alpha was hacked on November 1, 2021 — just on the 5th anniversary of the company. According to Vitalii, the attack has been well planned over a half-year ago. He also noticed that the attack was performed not through the exchange code (a technical bug) but because of human failure.

“They were gunning for our both Ukrainian and foreign employees. As they managed to hack public persons of our company, they sent viruses through their computers directly to our employees, and one of them let this virus in,” explained Vitalii.

“They were gunning for us long and seriously. A pre-analysis confirmed that enormous resources were spent on this attack to ‘congratulate’ us on our birthday in this way.”

“The analysts of BTC-Alpha estimated the cost of this attack about a few hundreds of thousands of dollars. Due to the fast reaction of the team, the attack consequences were minimized: no user funds were stolen, but their user credentials were compromised. “The passwords are hashed, and we don’t store them in an open format,” Bodnar said.

After the attack, the hackers demanded a ransom of 100 BTC for stolen data, but BTC-Alpha refused to negotiate.

Bodnar also admitted that, although BTC-Alpha did not lose any user coin, the attack hardly damaged their reputation. There are still a bunch of unsolved issues that currently do not allow the company to make a full assessment of the damage.

What should users do

The exchange is currently not working; the users can’t access their accounts. It can cause some impatience. But Bodnar assures that all assets are intact. At the moment, all funds have been transferred to the cold wallets to secure them. The access to the users will be re-granted as soon as BTC-Alpha will be online again.

After the work of the exchange is back up and running meaning, Bodnar promises to conduct an independent financial audit, which will confirm that the users’ balances coincide with the actual ones in the accounts of the company.

According to Vitalii, the analytical department is continuing to investigate the situation and the security of the platform. Soon it will be known when BTC-Alpha will be able to restore work.

According to the National Commission, “the regulator considers it its systemic task to protect the rights and interests of investors, so it constantly researches the market and identifies questionable financial projects. These companies have attracted our attention because they meet the signs of a fictitious investment project, which were developed by the Commission and are publicly available to all citizens on its website.”

This time the National Commission added seven projects to the list:

• EverFX
• Freshforex
• Royal Trust Group
• GTTC TRADE
• FINVESTING
• TRADING GLOBAL
•  LimeFX

Currently, the list contains 90 records. Projects that the regulator considers dubious can be found here. You can read about the signs of fictitious investment initiatives here.

He also named three old ones that were popular back in the 2000s. AIN.UA shares his insights.

Ye olde schemes

Back in 2005, when Dovgopoliy came to the industry, there were only three main types of scammers, he says.

1. Scammers who tried to sell a non-existent startup or a startup with a non-existent product, but the existing methodologies du jour cut off most such attempts.
2. Pseudo investors sent startups for overpriced audits to a related auditing company. Understandably, after such an audit, a negative decision was made about the investment.
3. Raiding companies and using startups and venture capital firms to launder criminally obtained money. 

“Over the years, the industry has adopted these risks. Entrepreneurs and investors who understand the rules of the game have learned to mitigate such risks. But new times call for new solutions,” says Denis Dovgopoliy.

New mass-fraud scheme is hitting the VC industry

Entrepreneurs and consultants who helped funds do the due diligence and raise money for startups (one of those are Denis himself) encountered a new kind of fraud that split into two independent lines — they called them “gray” and “black” schemes.

Details of the Gray scheme

The startup pays for a consulting or advertising contract, which, minus a commission, it begins to receive in the form of revenue. Thus, the conditional $50,000 returns in the form of $30,000-$40,000 ARR multiplied at round A industry multiplier (7-15x). That means, for the $50,000-$100,000 startup can get an additional $1 million in valuation. That said, the execs know how to manage the churn of the project.

This scheme works for both b2b and b2c startups with checks from $20 to $100 for a monthly or annual payment.

“The case is an apparent fraud on the investor who determines or confirms the startup’s valuation at the investment round. We found a company that tried to add +$4M to their valuation this way,” says Dovgopoliy.

Details of the Black scheme

The second scheme is more unpleasant. It implies that for $50,000, you can get up to $300,000 in such proceeds, but then the money will come in either from stolen cards or cards from risky countries. 

“Such a scheme falls ultimately under AML law and is 100% criminal. It can be determined by having access to the startup’s billing during due diligence,” says Dovgopoliy. 

How to detect the scheme

Both schemes can be detected by picking out the cluster of paying clients who do not use the service at all – scammers can easily automate the creation of new accounts, payments, including recurring ones. Still, they cannot imitate the usage of the startup’s product at the moment. Moreover, the second scheme sometimes has a high payback request. 

“We managed to find more than 20 startups that have suspicious signs in two months. There are checks on them, and even two forensics goes,” Dovgopoliy shares. “At the moment, we have already managed to find two independent contractors for such schemes.”

Experts are now trying to understand the scale of this kind of fraud on the market. It is yet unclear what damage those schemes have already done.

To get money, the criminals organized a large-scale scheme. They used different nicknames on the Dark Web, had many fictitious persons, and worked through various financial services.

The clients of the criminals were hackers engaged in cyber theft who wanted to take the stolen money in cash; for example, criminals who hacked into the bank accounts of companies around the world and took the victims’ virtual money.

Furthermore, these individuals made and sold flash drives with malware that hacked digital wallets and stole cryptocurrency from them.

The SSU arrested the criminals in Mykolaiv in international cooperation with the US authorities. As a result of searches, the law enforcement officers seized from the perpetrators:

• Computer equipment with evidence of illegal activities
• Malicious software and hardware
• Draft notes and cash

The investigators are now analyzing the obtained evidence to bring criminal charges against all responsible persons, including foreign beneficiaries of the frauds.

Ultrashop is a chain of brand boutiques that together with mono-brand boutiques of Levi’s, Guess, Baldinini, Karl Lagerfeld, Boss, and Hugo constitute Ultra Group based in Odesa. On the 21st of May 2019, one of the group’s legal entities, EOST Inc., concluded an agreement with the Romania-based company Starsoft Europe to create a web store branded as Ultrashop. The court documents do not mention the name of the Israeli citizen residing in Germany who was concluding the agreement from Starsoft’s side.

According to the Unified State Register of Legal Entities of Ukraine, Odesa-based Starsoft, LLC belongs to Martin Shein. Additionally, according to the register of pre-court decisions, he is a suspect in the other case, and he should be held in custody during the court process:

According to the files of the case, the implementation of the online store was split into stages, and deliverables should have been presented to the client. Moreover, the company was supposed to deliver the finished online store by November 20, 2019. The representative of Starsoft received payment from EOST Inc. for the development of the store from May to August 2019, with a total amount of ₴1,745,939 (confirmed by the representative’s receipts).

According to the investigation materials, the second party had no intent to fulfill its part of the agreed obligations and was imitating the online store’s coding work. In May 2019, Starsoft’s CEO gave his order to the UI/UX designer, SEO specialists, and a project manager to develop a website concept, its ad policies, and a project task list. Nonetheless, two technical leads were not receiving any orders to write program code for the store during the period from May to August 2019.

Meanwhile, Starsoft’s representatives were showing the client some pieces of work done from the online store, including the interface’s graphic elements, ad policies, project tasks, claiming that the work on the store was going and it would be delivered in time. EOST Inc. was transferring money as follows: ₴436,323 in May 2019, ₴435,315 in June 2019, and ₴426,649 and ₴420,352 in August.

Meanwhile, Starsoft’s management had left Ukraine and was not communicating since then. The developers who were supposed to work on the project were not receiving salaries, and all had quit by October 2019. Starsoft’s management was not paying the rent since September 2019. In September 2019, the representatives of EOST Inc. had checked the progress of work, and there was less than 5% of completion. Whereas according to the agreement, there should have been 75% of the project done. As of November 30, 2019, the end date stated in the Agreement, the online store was still not delivered to the client.

The total amount of material losses of EOST company was ₴1,745,939.

In August 2020, investigators from the Investigations Unit of the Primorsky Police Department drew up a report regarding suspected fraud by the management of Starsoft. Several members of the company were put on the international wanted list, and as of March 2021, it was established that (presumably) Martin Shein was in Bogota, Colombia. He was detained for extradition to Ukraine.

The case is being investigated: the last court hearing took place on August 27, 2021. No verdict has been issued yet.

According According to Bloomberg, these gift codes were often sold on reseller markets at a lower price. This reselling phenomenon can be traced to Volodymyr Kvashuk, a Ukrainian who lived in the US and, being a Microsoft employee, had unlimited access to the generation of such codes.

Testing of the payment system did find glitches

Volodymyr Kvashuk moved to the United States and got a job at Microsoft in 2017. Among his job duties was to test the payments system in the company’s stores. He “bought” a Dell laptop on the website, paid for it with a faux credit card, and documented errors. The system made the purchase and sent notifications, but the money was not debited, and the order was not shipped. After all, all these actions were only necessary to test the system.

In the winter of 2017, Kvashuk found that unlike buying physical products, every time he checked gift card purchases, the Microsoft Store sent real gift codes. The money was still not deducted, and the tester could generate an almost unlimited number of cards.

He realized that his team’s experimental accounts were programmed only to prevent them from sending fake purchases of physical goods such as PCs, tablets, keyboards, etc. Microsoft simply didn’t plan for its digital retail testers to order Xbox gift cards on the job. Kvashuk could have reported the vulnerability to his management, but instead, he started reselling them.

Underground business affecting global prices for the gift cards

Kvashuk started small, generating Xbox cards in increments from $10 to $100. But by the time federal agents arrested him almost two years later, he had stolen more than 152,000 Xbox gift cards, worth $10.1 million, and was living off the proceeds in a lakefront home with plans to buy a ski chalet, yacht, and seaplane.

In January 2018, Kvashuk built a computer program, PurchaseFlow.CS, to sell a really large number of gift cards. With a few clicks in the app, he could select a gift card denomination (30, 75, 100), the currency output (USD, EUR, GBP), and the desired number of purchases. Prosecutors later said the program was “created for one purpose, and one purpose only: to automate embezzlement and allow fraud and theft on a massive scale.”

At one point, Kvashuk reached such volumes that prosecutors said it began to influence global price fluctuations for Xbox gift cards on reseller markets. When prices dropped too low because of an oversupply of codes on the market, he would stop in the hope the lack of product would push the market upward.

Kvashuk bought a red Tesla Model S for $162,899 and then a modern house for $1.675 million. He explained his expenses are disproportionate to the income he earned by investing in cryptocurrencies.

Microsoft knew about the scam but couldn’t figure out the scammer

Kvashuk was very careful. Usually, he and his colleagues switched between a couple of fake profiles that they registered in the Microsoft store. To conceal his identity, Kvashuk figured out his colleagues’ passwords and used their test logins. Also, he masked his Internet traffic by routing it through servers in Japan and Russia.

But in February 2018, Microsoft’s Fraud Investigation Strike Team noticed an unexplained spike in online purchases using gift card codes that was about double normal redemption levels. Investigators assumed that the hack came from an “external bad actor” but soon realized that it was an inside job.

In March, corporate investigators traced the irregular activity to two internal test accounts assigned to Microsoft sales employees. The accounts, they learned, had already gobbled up almost $8 million in codes that were selling on the reseller markets.

Investigators questioned the employees behind those test accounts, who seemed like stunned victims, not perps. Microsoft determined that a testing program called Fiddler, which employees used to file bug reports, contained data divulging tester logins. Anyone with Fiddler access could have hacked the accounts.

The company soon discovered that one of Kvashuk’s accounts had bought three Nvidia graphics cards that had been shipped to a non-existent address. When asked whether he used the test accounts to generate codes, Kvashuk admitted to redeeming about 600 of them, but only for buying movies from the Microsoft store. Four weeks later, Microsoft fired Kvashuk.

FBI, searches, and jail

For a seemingly sophisticated engineer, Kvashuk had made many mistakes. Although he cloaked his address through international servers, he used the same Linux-based computer with the same outdated version of the Firefox browser to commit the theft. In addition, the Microsoft Office license he bought at the start of his scam was registered to an administrative account for SearchDom, his startup. This circumstantial evidence allowed Microsoft to link him to the crime.

Soon, federal agents, who had conducted their own investigation into Kvashuk after Microsoft referred the case to them, searched his home and found a lot of incriminating evidence, such as crypto wallet keys, notebooks with bank account information, USB drives stuffed with stolen codes, and lots of cash.

The agents also found a list of Kvashuk’s future investments. The list was written in Ukrainian and was titled: “How I will manage my next 10 million.”

In February 2020, federal prosecutors from the Western District of Washington brought Kvashuk to trial for money laundering, identity theft, mail fraud, and filing false tax returns.

Kvashuk’s attorneys argued that their client did not intend to defraud anyone. He generated the gift card codes to help the company because the more free gifts Xbox gave away, the more popular the platform would be, which would increase overall costs.

The judge and jury found his defense ridiculous and declared him guilty on all counts. He’s likely to be deported back to Ukraine after serving time in prison until March 2027 and will have to pay back $8.3 million.

According to the statement by the Ministry of Internal Affairs’ (MIA) press office, this virus has caused $2.5 billion in damage to American and European banks and financial institutions.

How the scheme worked

As reported by the Attorney General’s Office, since 2014, a group of Ukrainian hackers using a piece of malware, the so-called encryption virus (“banking Trojan”), designed to steal personal data (passwords, logins, and payment details), has carried out massive interferences in the functioning of servers of both private and state-run banking institutions.

EMOTET’s infrastructure included servers around the world and was effectively a botnet. The “virus” was spread via spam mailouts, Word documents, Excel tables, and email messages.

After penetrating the target software, the virus used the “infected” device for further spamming, as well as install additional viruses. Consequently, the malware stole users’ personal data, including passwords, logins, browsing history, payment and banking details, etc. Later on, the perpetrators would transfer the money to their controlled accounts.

Simultaneous searches in eight countries

The Cyber Police, along with local law enforcement agencies, has conducted simultaneous searches in Ukraine, the Netherlands, Germany, France, Lithuania, Canada, the USA, and the UK.

As a result, the enforcers seized server equipment, computer hardware, and data storage media containing information about the companies targeted by the cyber-attacks. Banking cards, money, and secret ledgers with passwords, logins, and keys to services were also seized.

“Criminal proceedings are being conducted under Art. 361 (Unauthorized interference in the functioning of computers, automated systems, computer networks, or telecommunication networks), Art. 361-1 (Creation of malicious software or hardware with the purpose of usage, distribution, or sale), and Art. 190 (Fraud) of the Criminal Code of Ukraine. The attackers face up to 12 years of imprisonment, with confiscation of property,” the MIA comments.

Now, the activity of the EMOTET network, which was distributed across more than 90 servers in many countries, is completely blocked.