Darknet Diaries Episode 175: Bayrob

 

Darknet Diaries Episode 175: Bayrob chronicles the 10-year lifespan, technical execution, and ultimate downfall of the Bayrob Group—a highly sophisticated Romanian cybercrime syndicate.

1. Key Figures & Characters

• The Perpetrators (The Bayrob Group): Operating from Bucharest, Romania, this core three-man team consisted of:

  • Bogdan Nicolescu (alias "Masterfraud"): The leader and primary orchestrator.

  • Radu Miclaus (alias "Minolta"): Key co-conspirator heavily involved in the operations and logistics.

  • Tiberiu Danet (alias "Amightysa"): The third core technical member who later pleaded guilty.

• The Investigators & Researchers:

  • Liam O'Murchu: A top-tier malware analyst at Symantec (famous for early analysis of the Stuxnet virus). He reverse-engineered the malware, named it "Bayrob" (robbing eBay users), and became a direct target of the hackers' taunts.

  • FBI Special Agents (e.g., Stacy Diaz, Macfarlane): Led the federal investigation in tandem with global agencies and the Romanian National Police.

2. The Core Criminal Concept & Mechanics

The Bayrob Group began in 2007 as an online auction fraud scheme but evolved into a massive, multi-vector botnet operation that lasted until 2016.

Phase 1: The Fake Car Scam (Man-in-the-Middle Browser Hijacking)

• The Bait: The hackers placed over 1,000 fraudulent listings for high-end items (primarily cars and motorcycles) on eBay and Craigslist at tempting prices.

• The Infection: The photos of the cars were laced with custom malware. When a user downloaded or clicked to view the vehicle slideshow, the executable stealthily installed itself on the victim's PC.

• Geofencing: The attackers intentionally used geofencing so the fraud execution only active within specific US regions, masking it from European researchers like Liam (who was initially based in Ireland).

• The Hijack: Once infected, the malware performed localized DNS poisoning and browser interception. If the victim attempted to navigate to real eBay, PayPal, or Facebook pages, the malware rerouted them to pixel-perfect, local phishing clones hosted by the hackers.

• Fake Infrastructure:

  • If a victim clicked "Help" or "Customer Service" on the fake eBay page, they were met with a live chat window connected directly to the hackers, who walked them through the "safe transaction."

  • To explain why the car hadn't arrived, they built a completely fake auto-transportation and trucking company website with fabricated tracking numbers to string victims along.

  • The malware explicitly blocked access to security sites and consumer protection portals like ic3.gov (the FBI's Internet Crime Complaint Center).

• The Theft: Victims were instructed to wire funds (usually between $8,000 and $11,000 per vehicle) via non-refundable wire transfers. The funds were instantly extracted by a complex network of international "money mules."

Phase 2: Botnet Proliferation & Diversification

As technology advanced, the trio realized they were sitting on massive computing power and pivoted to exploit their botnet:

• The Proliferation: The malware harvested email address books from infected hosts and used those relationships to blast out over 70 million malicious emails disguised as official notices from Western Union, Norton AntiVirus, the IRS, and AOL.

• AOL Account Hijacking: They forced compromised PCs to systematically register over 100,000 fake or hijacked AOL email accounts to act as clean distribution nodes for spam.

• Cryptocurrency Mining: They harnessed the distributed processing power of their botnet to mine early cryptocurrencies.

• Data Mining: They continuously scraped the 400,000+ infected host machines for passwords, credentials, and credit card numbers, which they packaged and repeatedly sold on Darknet marketplaces like AlphaBay.

3. The Research Feud (Liam vs. Bayrob)

When Liam O'Murchu published a Symantec blog post breaking down their operation—complete with video evidence of him posing as a victim buying a car—the hackers noticed.

Instead of going quiet, their operational security (OpSec) turned into direct trolling:

• Taunting the Analyst: They began hardcoding insults directly into the malware's Command and Control (C2) infrastructure. They registered domain names explicitly targeting Liam (e.g., gayassholeliam.com, tinycockliam.com, liamthemule.com, thankyouliam.com).

• The Chicken Message: Inside the code, they left a broken-English message for the Symantec team: "Symantec team is a big hen coop chicken smart."

• The Backfire: This mocking behavior only motivated Liam to dig deeper. Using Symantec's internal telemetry, he mapped out their multi-layered proxy architecture, noting that the hackers routed their traffic across multiple layers of infected machines globally to hide their exact Bucharest footprint.

4. The Investigation Breakthrough & Downfall

Despite their high-level OpSec, the group was undone by standard human error and aggressive federal tracking.

• The Fatal Mistake: A core member of the Bayrob Group accidentally logged into his personal, real-name email account from an active criminal server infrastructure. AOL's abuse team noticed the overlap and linked the two accounts.

• The Social Footprint: This single unencrypted login gave the FBI a name, which led to real-world social media profiles in Romania.

• The Darknet Trap: The FBI launched undercover operations on AlphaBay, executing controlled buys of stolen credit card data and credentials directly from the group to solidify the evidentiary link between the online personas and the physical individuals.

• The Arrest (2016): Working in tandem with the Romanian National Police and the Romanian Directorate for the Investigation of International Organized Crime and Terrorism, the FBI executed coordinated raids in Bucharest. They seized smartphones, crypto, and servers.

5. Final Case Consequences & Statistics

The legal fallout concluded in late 2019 and early 2020 in the Northern District of Ohio:

• Bogdan Nicolescu ("Masterfraud"): Sentenced to 20 years in prison.

• Radu Miclaus ("Minolta"): Sentenced to 18 years in prison.

• Tiberiu Danet ("Amightysa"): Pleaded guilty; sentenced to 10 years in prison.

The Metrics of the Bayrob Enterprise

• Duration: 9+ Years (2007–2016)

• Infected Assets: 400,000+ computers compromised globally (primarily US-based)

• Direct Financial Theft: Over $4 million verified (excluding the value of dark web data sales and crypto mining)

• Average Damage Per Scam Victim: $8,000 to $11,000

• Spam Footprint: 70+ Million malicious emails sent via 100,000+ automated email registrations