DOJ Charges Latvian National for Role in 'Trickbot' Ransomware Scam
The "Trickbot Group" told victims they would need to purchase special software through a bitcoin address to decrypt their files.
Jun 4, 2021 at 9:54 p.m. UTCUpdated Sep 14, 2021 at 1:06 p.m. UTC
:format(webp)/cloudfront-us-east-1.images.arcpublishing.com/coindesk/NDNVTTI47ZBTVHGWM2EK2VFP4Y.jpg)
/arc-photo-coindesk/arc2-prod/public/LXF2COBSKBCNHNRE3WTK2BZ7GE.png)
The U.S. Department of Justice today charged a Latvian national for her alleged role in an international cybercrime organization that created and deployed a suite of computer banking malware known as "Trickbot" to attempt to defraud consumers, businesses and other organizations.
- The DoJ charged Alla Witte (aka Max), 55, with 19 counts of a 47-count indictment, accusing her of participating in the “Trickbot Group,” which operates in Russia, Belarus, the Ukraine and Suriname, the small country on South America’s northeast coast.
- The ransomware notified victims their computers were encrypted and they would have to buy special software through a bitcoin address that the "Trickbot Group" controlled to decrypt their files.
- Witte allegedly provided code to the "Trickbot Group" that tracked authorized users of the malware and developed tools and protocols to store stolen login credentials from the users.
- The group targeted computers belonging to individuals and organizations in northern Ohio, where the charges were filed in U.S. District Court, and elsewhere in the U.S.
- The FBI, which conducted the investigation, arrested Witte in Miami on Feb. 6.
- “'Trickbot' infected millions of victim computers worldwide and was used to harvest banking credentials and deliver ransomware,” said Deputy Attorney General Lisa O. Monaco.
:format(webp)/downloads.coindesk.com/arc/failsafe/user/1x1.png)