Operation Phish Phry Nets 100 Suspects

United States and Egyptian authorities began rounding up 100 suspects indicted in connection with a two-year investigation dubbed "Operation Phish Phry."

Operation Phish Phry involved the United States Attorney's Office, FBI, Egyptian authorities and the Electronic Crimes Task Force in Los Angeles. The 53 suspects in the United States are concentrated in North Carolina, Las Vegas, and Los Angeles, with the majority being from LA. The FBI stated that the number of individuals involved in the phishing scam make it the largest number of defendants ever charged for the same cybercrime.

Phishing itself is a play on words. It is a cyber-attack that relies on social engineering to dupe users into divulging sensitive information or downloading malicious software. It derives its name from the use of bait, such as emails and web sites that appear to be from respected, legitimate sources, to attract victims, similar to the way anglers rely on lures to reel in fish.

Typically, a phishing attack begins with an email that is designed to look like it is from a bank or financial institution. The email generally contains a message directing the user to respond with account information or username / password credentials, or provides a link which directs users to a counterfeit web site designed to look like the authentic site for the financial institution in question. The information provided by victims is collected by the attackers and later used to steal the victim's identity or access the victim's accounts and remove funds.

The ring broken up by Operation Phish Phry originated with phishing attack emails from the Egyptian suspects. Those phishing attacks collected account data and personal information which was subsequently used to access the victim's accounts at Bank of America and Wells Fargo and remove money.

The Egyptian hackers enlisted the aid of partners in the United States to assist with moving money from the compromised accounts to launder the funds. There are three primary ringleaders in the United States. The other 50 suspects are alleged moles or runners who set up fraudulent accounts to deposit the stolen money and facilitates transferring funds to Egypt to pay the hackers their cut of the spoils.

The 100 suspects face a 51-count indictment accusing them of conspiracy to commit wire fraud and bank fraud. The ringleaders face additional charges of aggravated identity theft, money laundering, and unauthorized access to protected computers. All of the suspects face possible prison terms of up to 20 years if convicted.

Tony Bradley is an information security and unified communications expert with more than a decade of enterprise IT experience. He tweets as @PCSecurityNews and provides tips, advice and reviews on information security and unified communications technologies on his site at tonybradley.com.

For more PC news, visit PC World. Story copyright PC World Communications, Inc.