DOJ Charges Latvian National for Role in ‘Trickbot’ Ransomware Scam

The U.S. Department of Justice today charged a Latvian national for her alleged role in an international cybercrime organization that created and deployed a suite of computer banking malware known as “Trickbot” to attempt to defraud consumers, businesses and other organizations.

• The DoJ charged Alla Witte (aka Max), 55, with 19 counts of a 47-count indictment, accusing her of participating in the “Trickbot Group,” which operates in Russia, Belarus, the Ukraine and Suriname, the small country on South America’s northeast coast.
• The ransomware notified victims that their computers were encrypted, and that they would have to buy special software through a Bitcoin address that the “Trickbot Group” controlled to decrypt their files.
• Witte allegedly provided code to the “Trickbot Group” that tracked authorized users of the malware and developed tools and protocols to store stolen login credentials from the users.
• The group targeted computers belonging to individuals and organizations in northern Ohio, where the charges were filed in U.S. District court and elsewhere in the U.S.
• The FBI, which conducted the investigation, arrested Witte in Miami on February 6.
• “’Trickbot’ infected millions of victim computers worldwide and was used to harvest banking credentials and deliver ransomware,” said Deputy Attorney General Lisa O. Monaco.