A New York City man Vitalii Antonenko, 28, was charged for hacking, credit card trafficking, and money laundering.

Antonenko was arrested in March 2019 and detained for money laundering charges after he returned from Ukraine with computers and other digital goods that hold thousands of stolen payment card numbers.

SQL Injection to Steal Payment Card Data

Antonenko and co-conspirators used the SQL injection attack method to steal credit card data from vulnerable networks and extracted Payment Card Data and other personally identifiable information (PII).

Then they transfer the stolen data for sale on online darknet marketplaces that are used to exchange various illicit goods.

According to the complaint, Antonenko and two co-conspirators sold stolen credit cards by using multiple carding websites according to reports.

Law enforcement agencies tracked the activity for more than two years purchasing personally identifiable information and stolen payment card numbers paying in bitcoin for American Express and Mastercard numbers.

The agents tracked the bitcoin transaction through the blockchain, that has more than 19,000 address controlled by the hacker group.

“As alleged in the indictment, Antonenko and co-conspirators scoured the internet for computer networks with security vulnerabilities that were likely to contain credit and debit card account numbers, expiration dates, and card verification values (Payment Card Data) and other personally identifiable information (PII),” reads DoJ press release.

Antonenko and co-conspirator sold the data to others and used Bitcoin, as well as cash to disguise their nature, location, source, ownership, and control.

Cybercriminals use cryptocurrency to avoid government scrutiny and law enforcement. The anonymous nature of the cryptocurrencies makes them more attractive.

Antonenko may face up to 25 years in prison and fine up to $750,000 for money laundering conspiracy. “Sentences are imposed by a federal district court judge based on the U.S. Sentencing Guidelines and other statutory factors.”

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.

Source: https://gbhackers.com/sql-injection-to-steal-payment-card-data/