1. Melissa McBee Anderson Ethan Via Federal Bureau of Investigations
IC3 – Internet Crime Complaint Center
Melissa McBee Anderson
Ethan Via
Federal Bureau of Investigations

2. Tallking Points IC3 Overview Business Email Compromise
Account Compromise
Ransomware
Case Study

3. IC3 Mission
The mission of the Internet Crime Complaint Center is to provide the public with a reliable and convenient reporting mechanism to submit information to the Federal Bureau of Investigation concerning suspected Internet-facilitated criminal activity and to develop effective alliances with law enforcement and industry partners. Information is analyzed and disseminated for investigative and intelligence purposes to law enforcement and for public awareness.

4.
61,151,134 hits in 2016
All PSA’s and Scam Reports are available via Really Simple Syndication (RSS)

5. What is Business Email Compromise?
The business compromise (BEC) is a sophisticated scam targeting businesses working with foreign suppliers and/or businesses that regularly perform wire transfer payments.
The scam is carried out by compromising legitimate business accounts through social engineering or computer intrusion techniques to conduct unauthorized transfers of funds.

6. What is a Business Email Compromise?
The 5 Scenarios of BEC
Business working with a foreign supplier
Business executive is compromised
Business contact list is compromised
Business employee is contacted by fraudulent lawyer or law firm
Business Compromise of W-2 and/or PII; “Data Theft”

7. What is Email Account Compromise?
The Account Compromise (EAC) is a sophisticated
scam that targets the general public and professionals
associated with, but not limited to, financial and lending
institutions, real estate companies and law firms.

8. Ransomware Form of malware Targets human and technical weaknesses
Typically delivered via or compromised websites
Encrypts data on computers and networks

9. Stages of Ransomware Installation Contacts Server Encryption Extortion
Victim opens a malicious or visits a compromised website
Contacts Server
Malware communicates with criminal’s server
Encryption
Malware encrypts victim’s files
Extortion
Message on victim’s computer displays ransom amount and the amount to be paid via virtual currency

10. Ransomware Variants 2012 - Reveton 2013 - Cryptolocker
Cryptowall
Teslacrypt
Locky

11. What to do if Infected Isolate the infected computer
The FBI does not advocate paying
Paying ransom emboldens the adversary
Ransom payment funds illicit activity
Contact your local FBI field office
File a complaint with the Internet Crime Complaint Center (IC3)

12. Operation Wellspring Success
Merchant transaction data documenting fraud in Tooele, UT
Salt Lake City Cyber TaskForce opened case
Conducted surveillance
Arrest
Sentencing

13. Operation Wellspring Success

14. Cyber Criminal Enterprises
Marketplace
Infrastructure
Coders
Delivery
Money Transfers
Cash Out
800+ forums
25+ languages
More than 1.25 million monikers
50+ roles/specializations
95% of cyber criminals have membership on a forum

15. Infrastructure providers
Hack-a-preneurs
Service Providers
Technical people
Infrastructure providers
Cyber-criminal marketplace
English-speaking
Exclusive
members

16. What’s Inside?

17. What’s Inside?

19. SSA Ethan Via
Seattle Field Office
Complex Financial Crime Squad
Melissa McBee-Anderson
Management and Program Analyst
Internet Crime Complaint Center (IC3)