Cyber Crime Stages in Ukraine Raids in International Probe

Europol said  the access to tens of thousands of compromised servers of unknowing victims was offered for sale,” on xDedic Marketplace Europol said “access to tens of thousands of compromised servers of unknowing victims was offered for sale,” on xDedic Marketplace

Ukrainian authorities aided by Belgian, US and other investigators have staged raids aimed at smashing the illegal trade of access to hacked computer systems, officials said Monday.

Police and prosecutors conducted house searches in nine places in Ukraine last Thursday, seizing several IT systems and questioning three Ukrainian suspects, Belgian prosecutors and the police agency Europol said.

“The house searches were related to two criminal investigations into the xDedic Marketplace, on which access to tens of thousands of compromised servers of unknowing victims was offered for sale,” Europol said.

Both individual personal information and companies were compromised via the Remote Desktop Protocol, it said. Buyers and sellers traded servers from anywhere between $6 to $10,000 (8,7450 euros) each.

Belgian federal prosecutors and Europol said the US Federal Bureau of Investigation and Internal Revenue Service took part in the probes.

Belgian federal prosecutors added that a US court barred access to the xDedic online market place last week.

German police were involved in “making the online marketplace inaccessible” and confiscating its IT criminal infrastructure, according to the prosecutors.

The Russian computer security firm Kaspersky Labs described xDedic as a trading platform where cybercriminals can buy any of more than 70,000 hacked servers from around the internet.

The underground market “appears to be run by a Russian-speaking group of hackers,” it added.

“The forum provides members with tools to patch RDP servers to support multiple user logins, as well as other hacking tools, such as proxy installers and sysinfo collectors,” Kaspersky said.

“The main goal of the xDedic forum is to facilitate the buying and selling of credentials for hacked servers which are available through RDP,” it said.