KUALA LUMPUR: A MAN, believed to be responsible for using malware to steal more than RM3.42 million from automated teller machines of several banks here in September, is expected to be charged in a London court today.
The 37-year-old man, identified as Grigore Paladi, fled to London after his gang hacked into 19 ATMs in Johor, Kuala Lumpur, Selangor, Penang and Malacca between Sept 24 and 29.
He was nabbed by the British authorities on Oct 24 in London for siphoning RM8.13 million (£1.5 million) using a similar malware there in May.
Federal Commercial Criminal Investigation Department deputy director (cyber and multimedia crimes) senior Assistant Commissioner Mohd Kamarudin Md Din said the arrest was made after Interpol and Malaysian police shared information on the suspect.
“We believe that he continued his crime spree in several countries before fleeing to London. Investigations showed that he had carried out similar thefts in the United Kingdom, Russia, Malaysia, Germany and Canada.
He also holds dual Romanian and Republic of Moldova citizenship.
“He is also believed to be involved in hacking 58 ATMs in the UK, causing a total loss of £1.5 million; two ATMs in Russia amounting to 287,000 roubles (RM16,300); and 18 ATMs in Germany amounting to €195,000 (RM833,000).”
Kamarudin said records from the Immigration Department showed that Paladi had entered Malaysia between Sept 24 and 29, the dates when the ATM hackings were reported.
“The Immigration database revealed that he had entered the country on Sept 24 at 11pm and left at 2.30am on Sept 29.”
British police also seized two handphones — a Blackberry Q10 and a Nokia model — from Paladi.
“The British police are extracting data from the phones’ SIM cards to track incoming and outgoing calls, as well as text messages. We hope the information will shed light on the identities of the gang members.”
Kamarudin said investigations here showed that Paladi was responsible for ATM thefts in Puchong, Sea Park, Jalan Yong Shook Lin in Petaling Jaya and Shah Alam.
“Images recorded by the closed-circuit television cameras of several banks showed him withdrawing substantial amounts of cash.”
In earlier reports, police had said a Latin American gang was involved in the ATM thefts.
“After conducting further investigations, it showed the gang is from eastern Europe, and not Latin America. The gang has between 10 and 12 people, who will split into four groups to hack ATMs in the country simultaneously,” said Kamarudin.
On Sept 30, the federal police launched Op Albatross to track down the gang following a spate of 19 ATM thefts in four days.
The gang targeted NCR 5877 models, which operated on an outdated software and also lacked security features compared with newer ATM machines.
It is understood that the gang inserted a compact disc into the ATM’s CD-ROM drive to spread the ulssm.exe malware. This caused the ATM system to reboot, which allowed them to withdraw money.
Kamarudin said Op Albatross was ongoing to track the whereabouts of the gang members and also the stolen money.
“With the arrest of Paladi, we hope to trace and nab the rest of the gang members so that such incidents will not recur. We are working with the police worldwide to hunt them down.”