In August of 2014, it was reported that a group of hackers had exploited a vulnerability in the websites of JPMorgan. After breaking into the company’s network, the attackers then allegedly staged additional attacks that were custom-made to JPMorgan’s servers, which gained them access to internal systems on which customer account data was stored.
Several months later, investigators revealed that the criminals, who were believed to be Russian in origin, used zero-day exploits to gain access to the sensitive data of 76 million households and 7 million small businesses. Their analysis also suggested that the hack may have occurred as a result of a misconfiguration on one of JPMorgan’s servers for which two-factor authentication had been disabled, a security oversight which may have led to the compromise of an additional 90 servers before the attack was detected and ultimately thwarted.
It has been nearly a year since the hack against JPMorgan occurred. However, authorities may finally be closing in on those responsible for the incident.
On Tuesday of last week, federal authorities in Israel arrested two men—Gary Shalon and Ziv Orenstein—who were indicted over an alleged pump-and-dump scheme by a Manhattan federal grand jury back in June. Their operation involved artificially inflating the value of low-volume stocks and then selling them at an elevated price to users through spam e-mail.
The Manhattan U.S. Attorney’s Office has stated that it will seek the extradition of Shalon and Orenstein so that the two can stand trial in the United States.
Israeli authorities also sought the arrest of Joshua Samuel Aaron in connection with the pump-and-dump scheme, but he did not return to Israel by the middle of the month as federal authorities had expected he would. According to The New York Times, photographs on social media suggest that Aaron may currently be in Russia with his wife Alona Chaim Aaron.
Meanwhile, the Federal Bureau of Investigation last week arrested Anthony R. Murgio and Yuri Lebedev for running an unlicensed Bitcoin exchange called Coin.mx. The two men allegedly traded more than $1.8 million worth of Bitcoin on behalf of tens of thousands of customers, including victims of ransomware attacks. These deals occurred in violation of U.S. federal anti-money-laundering legislation.
At first glance, the crimes of the five men appear unrelated to the JPMorgan hack. However, federal authorities consider the men’s arrest a crucial first step in gathering further evidence that might implicate one or more of them in the Wall Street attacks that targeted Fidelity Investments Ltd., E*Trade Financial Corp., and other financial institutions in addition to JPMorgan last summer. The FBI also believes that the men, whom investigators have concluded lack the requisite computer skills to have carried out the JPMorgan hack, could help lead them to an elite group of Russian criminals who is believed to have been the true mastermind behind the breach.
Spokesmen for both the U.S. Manhattan Attorney’s office and JPMorgan have declined comment on the men’s arrest.
Meet Fortra™ Your Cybersecurity Ally™
Fortra is creating a simpler, stronger, and more straightforward future for cybersecurity by offering a portfolio of integrated and scalable solutions. Learn more about how Fortra’s portfolio of solutions can benefit your business.
