Cobalt gang accused of multiple cyber thefts across Europe

Criminal group suspected of $2 million online bank raid in Taiwan said to be behind a string of similar crimes across many parts of Europe last year.

The group that orchestrated the theft of more than US$2 million from cash machines at Taiwan’s First Commercial Bank in July was also behind an ATM hacking spree in more than a dozen European nations last year, according to the cyber security firm Group-IB.

The methods that the so-called Cobalt gang used in Europe matched those used in Taiwan, Group-IB said in its latest client report.

Three Eastern European men were arrested in Taiwan in July on suspicion of collecting cash stolen from ATMs owned by First Commercial Bank, a unit of First Financial.

Attorneys for the three defendants in an ongoing trial in Taipei said their clients were not familiar with the Cobalt gang.

The men – identified in court documents as Peregudovs Andrejs of Latvia, Colibaba Mihail of Romania and Pencov Nicolae of Moldova – were allegedly among a total of 22 individuals, all foreign nationals, that Taiwanese authorities suspect of taking part in the theft, where most of the money was subsequently recovered.

The suspects used malware dubbed “ATM spitter” in the First Commercial Bank attacks, as well as similar hacks in countries including Armenia, Belarus, Britain, Bulgaria, Estonia, Georgia, Kyrgyzstan, Moldova, the Netherlands, Poland, Romania, Russia and Spain, Group-IB said.

Investigators in Taiwan said they were not aware of any links between Cobalt and the hackers behind the First Commercial Bank heist.

“What we can say is the people behind this hacking were very good,” a Taiwanese investigator familiar with the case said, on condition of anonymity because the investigator was not authorised to speak with media.

The defendants, who maintain their innocence, said in a court hearing on Wednesday that they were not members of any international crime gang.

Taipei prosecutors have said they suspect First Commercial Bank’s network was breached at a London branch office.

* Reuters

Follow The National's Business section on Twitter