175: Bayrob
Summary
Liam Merku, a Symantec malware analyst, investigates BayRob, a sophisticated eBay fraud operation that used geo-fencing and complex proxy chains to hide its Romanian-based creators. After Merku infiltrated the network, he collaborated with FBI agents Stacey Whitaker and Ryan McFarlane, along with AOL’s Owen Miller, to track the criminals. Despite years of encrypted communications and moving infrastructure, a single unencrypted login slip-up by an attacker provided the breakthrough needed to identify the group and build a case for prosecution.
Topics discussed
Introduction and ThreatLocker sponsorship
Liam O'Murchu discovers Bayrob malware
Analyzing the malware's proxy chain and evasion
Setting up an infected honeypot to track attackers
FBI agent Stacey Cohen joins the investigation
Ryan McFarlane takes over and follows the money
Identifying attackers through OPSEC failures
Decrypting Jabber logs and finding the master fraudster
Surveillance and arrest of the first suspect in the US
Tracking the remaining suspects in Romania
Extradition, plea deals, and cracking encrypted drives
The trial, verdict, and prison sentences
Reflections on the case and closing remarks
Listen ad-free on Castria