Nov. 27 (UPI) -- Eight people have been charged in two digital advertising fraud rings uncovered by the U.S. Justice Department in New York, alleging they cost advertisers tens of millions of dollars.
A 13-count indictment was unsealed Tuesday in federal court in Brooklyn, N.Y., the DOJ announced in a news release.
"As alleged in court filings, the defendants in this case used sophisticated computer programming and infrastructure around the world to exploit the digital advertising industry through fraud," U.S. Attorney Richard Donoghue, of the Eastern District of New York, said in a statement. "This case sends a powerful message that this office, together with our law enforcement partners, will use all our available resources to target and dismantle these costly schemes and bring their perpetrators to justice, wherever they are."
He noted the FBI Cyber Division sprearheaded the multi-year investigation.
"As alleged, these individuals built complex, fraudulent digital advertising infrastructure for the express purpose of misleading and defrauding companies who believed they were acting in good faith, and costing them millions of dollars," FBI Assistant Director-in-Charge William Sweeney said. "This kind of exploitation undermines confidence in the system, on the part of both companies and their customers."
The charges include wire fraud, computer intrusion, aggravated identity theft and money laundering.
Three defendants have been arrested in Malaysia, Bulgaria and Estonia, and they await extradition. The remaining five suspects are at large.
Besides the indictment, the FBI received seizure warrants to take control of 31 Internet domains and search warrants to take information from 89 computer servers that were all part of the infrastructure for botnets in digital advertising fraud activity.
The FBI worked with the New York Police Department, private sector partners that included Google and Microsoft, and other international law enforcement agencies to unravel the digital schemes, prosecutors said. They redirect the Internet traffic going to the domains, which are known as "sinkholing," to disrupt and dismantle these botnets.
"This investigation highlights public- and private-sector collaboration across the globe, and again confirms the absolute necessity for interagency information-sharing," NYPD Commissioner James O'Neill, said. "Criminals -- especially those operating via the Internet -- do not concern themselves with jurisdictional boundaries, so it is critical that the law enforcement community works together to achieve our shared goal of protecting the people we serve."
Digital advertising revenue is based on how many users click or view the ads on those websites.
In court filings, the defendants claimed to run legitimate companies that delivered advertisements to real human Internet users accessing real internet webpages.
Instead, they faked the users and the webpages, according to the indictment, by programming computers they controlled to load advertisements on fabricated webpages, via an automated program, to fraudulently obtain digital advertising revenue.
Ad Network #1, between September 2014 and December 2016, rented more than 1,900 computer servers in commercial datacenters in Dallas and elsewhere to load ads on fabricated websites, "spoofing" more than 5,000 domains. The defendants leased more than 650,000 Internet Protocol addresses. Ad Network #1 caused businesses to pay more than $7 million for ads that were never actually viewed by real Internet users, prosecutors allege.
Ad Network #2, between December 2015 and this October, allegedly used a global "botnet," network of malware-infected computers operated without the true owner's knowledge or consent to perpetrate their fraud. The defendants accessed more than 1.7 million infected computers of ordinary individuals and businesses in the United States and elsewhere. Consequently, Ad Network #2 falsified billions of ad views and caused businesses to pay more than $29 million for ads never actually viewed by real Internet users, the DOJ said.
During its investigation, the FBI discovered an additional cybercrime infrastructure committing digital advertising fraud through datacenter servers in Germany and a botnet of computers in the United States infected with malicious software known in the cybersecurity community as "Boaxxe."
