Taiwan arrests three foreigners in $2.5m ATM cyberheist

[Truth_hurts]

Taiwan arrests three foreigners in $2.5m ATM cyberheist

 

Taiwan has arrested three foreign suspects over a $2.5 million cyberheist which used malware to hack into a major local bank's ATM network and steal bags of cash, police said Monday.

 

The attack, the first of its kind in Taiwan, targeted the First Commercial Bank's ATM network last week, using malware to withdraw more than Tw$81 million ($2.5 million) from dozens of machines in three cities.

 

A Latvian suspect, identified as Andrejs Peregudovs, was arrested by police in the northeastern county of Yilan after being spotted by an off duty police officer from Taipei who was on holiday in the area.

 

A notice posted at a branch of First Commercial Bank in Taipei notifies customers of the suspension of ATM machines ©Benjamin Yeh (AFP/File)

 

 

Two other suspects from Romania and Moldova were arrested Sunday at a hotel in Taipei, police said, adding they believed the heist was carried out by a 16-member international crime ring.

 

"This is the first ATM theft by a foreign crime ring in our country," the police said in a statement.

 

Police have recovered more than half of the stolen money, but warned that 13 of the suspects -- including five Russians -- had already fled Taiwan after the heist.

 

"We will continue to search for the rest of the stolen money to let international hackers know that Taiwan is not a crime haven," the statement said.

 

Police have sought assistance from both Interpol and Russia's de facto embassy in Taiwan.

 

Surveillance images released by the bank showed masked robbers working in two-man teams targeting 41 ATMs belonging to the First Commercial Bank in three cities.

 

It is not clear how the thieves installed malware on the ATMs, but within five to 10 minutes, the thieves are seen walking away with bags full of stolen cash, the bank said.

 

After the theft was discovered, more than 1,000 ATMs of the same type targeted in the heist have been shut down by banks nationwide.

 

http://www.dailymail.co.uk/wires/afp/article-3695141/Taiwan-arrests-three-foreigners-2-5m-ATM-cyberheist.html

 

 

They were caught because a couple saw those foreigners standing in front of the ATM and they noticed a lot of money coming out of the machine so they thought it was suspicious. The couple went to a police that was near by and when the foreigners saw the police they started to run. A lot of money was still coming out of the machine.

 

The police notify The First Commercial Bank that someone sold money from the ATM and the bank said that they would investigate it themselves but the police already started to investigate.

 

I think someone in Taiwan was also involved.

[Truth_hurts]

Russians suspected of stealing NT$70 million from ATMs

 

Authorities have asked Interpol to issue international alerts for two Russians suspected of stealing about NT$70 million (US$2.17 million) from automatic teller machines (ATMs) belonging to First Commercial Bank (第一銀行) and then fleeing on a flight to Hong Kong, as well as checking on the likelihood of there being Taiwanese collaborators.

 

The Criminal Investigation Bureau said it had identified one of the suspects as Sergey Berezovskiy, 34, according to information from a copy of his Russian passport, which was circulated to media outlets last night along with video footage of him allegedly taking money from ATMs, as the bureau appealed to the public to provide leads in the case.

According to customs records and video footage, the two Russians entered Taiwan on tourist visas on Thursday last week and then took advantage of Typhoon Nepartak making landfall to pull off the ATM heist while police were distracted on Friday, the bureau said.

 

Bureau officials said the Russians withdrew the cash from more than 20 ATMs in several cities from Friday to Sunday and then departed on a Cathay Pacific (國泰航空) flight bound for Hong Kong on Monday morning at Taiwan Taoyuan International Airport.

 

Taipei prosecutors said it was likely the suspects were working with a local Taiwanese gang, since it would not have been possible for foreigners to know the precise locations of the ATMs in Taipei, New Taipei City and Taichung, while video footage indicated the involvement of a Taiwanese driver in the operation.

 

Furthermore, prosecutors said there was a risk of getting caught at the airport with large bundles of cash and that most of the NT$70 million was likely converted into foreign currency and then wired to overseas banks through “informal channels,†which would have required the assistance of collaborating Taiwanese.

 

First Commercial Bank executives said the heist was committed without “using ATM cards†or “touching the ATM in any improper or illegal way,†with the machines simply “spitting†out bills, leading the bank and police to suspect that the criminals used malware to hack into the ATM operating system and manipulate the machines.

 

Prosecutors questioned a number of First Commercial Bank employees yesterday due to the suspicion the Russians could have received inside help to access and download malware into the ATM operating system.

 

However, authorities said they have not yet received any information from other nations about suspicious outflows of money.

 

It also remains unclear if the alleged thieves had any accomplices abroad or support from any known international criminal ring, but authorities have contacted Interpol to ask for its help in tracking down the suspects.

 

The authorities said the suspects traveled to the ATMs in a car they rented at the airport, which was driven by a Taiwanese man.

 

http://www.taipeitimes.com/News/front/archives/2016/07/13/2003650921

[Truth_hurts]

Key ATM heist suspects turned over to prosecutors

 

Criminal Investigation Bureau (CIB) officials spent yesterday questioning three key suspects in the heist that targeted First Commercial Bank’s (第一銀行) automated teller machines (ATMs), before transferring them last night to the Taipei District Prosecutors’ Office for further questioning.

 

Latvian Andrejs Peregudovs, Niklae Penkov from Moldova and Mihail Colibaba from Romania are among 17 people suspected of involvement in the theft of more than NT$83 million (US$2.6 million) on July 9 and July 10.

 

Peregudovs, who was apprehended in Yilan County on Sunday, was not fully cooperative during questioning, CIB Taipei office squad leader Lee Wen-chang (æŽæ–‡ç« ) said.

 

Evidence collected so far points to him being a high-level member of the gang because he was the main person collecting the money stolen from the ATMs, taking it to hotel rooms and then to storage lockers in the basement of Taipei Railway Station, and telling other “money collectors†when and where to pick up the money, Lee said.

 

Police said Peregudovs has told them he cannot say too much because he fears the “Russian mafia will harm to my wife and kids,†and he has asked for a lawyer.

 

Peregudovs said that he was not a member of the Russian mafia, but was recruited to take part in the operation, which he agreed to do because he owed a debt of 3,000 euros (US$3,315), Lee said.

 

Peregudovs refused to undergo questioning yesterday morning, and asked for medical treatment for blisters on his toes he developed while biking in Yilan, Lee said, adding that the Latvian also said he required medication for a chronic ailment.

 

Although the investigators thought he was trying to play for time, he was taken to Taipei Medical University Hospital for an examination.

 

Investigators said that Peregudovs was willing to open up a bit after learning that he would not face the death penalty if convicted of involvement in the theft.

 

Examination of surveillance camera footage showed that Peregudovs used a mix of old spying technique — “dead letter drops†— and modern technology to move the stolen money around, officials said.

 

He allegedly placed suitcases filled with the stolen money in storage lockers and other locations, then used WhatsApp to send instructions on the locations and passwords for the lockers for other members of the gang to pick up, they said.

 

Peregudovs told investigators that left a suitcase containing about NT$20 million near a hiking trail in Taipei’s Neihu District (內湖), which was picked up later on.

However, he also said that the gang operated in closed cells, and he did not know the other suspects involved in the heist.

 

Penkov and Colibaba — who were arrested on Sunday at the Grand Victoria Hotel in Taipei’s Dazhi area (大直) — have also denied knowing other gang members.

 

They reportedly admitted to collecting the stolen money, acting according to instructions received via WhatsApp on their mobile phones, but police still want to know how and where they collected the NT$60.24 million found in their hotel room.

 

http://www.taipeitimes.com/News/front/archives/2016/07/19/2003651333

[Truth_hurts]

Ko lauds police for solving ATM heist

 

Taipei Mayor Ko Wen-je (柯文哲) yesterday commended 10 Taipei Police Department officers who helped solve the theft of more than NT$83 million (US$2.59 million) from First Commercial Bank ATMs, saying that young officers are important with crimes involving technology on the rise.

 

A task force of 10 officers established to investigate the case received a reward of NT$300,000 from Ko yesterday at a Taipei City Government policy meeting.

 

Officer Sung Chun-liang (宋俊良), who was off duty on Sunday when he saw one of the suspects — Latvian Andrejs Peregudovs — at a restaurant in Yilan’s Dongau (æ±æ¾³) area and tipped off the local police, received an additional NT$20,000.

 

Ko praised Sung for going beyond the call of duty and playing a crucial role in solving the case.

 

“He stayed vigilant and sharp even when he was on a trip with his wife and children,†Ko said. “He could have said it was his day off and done nothing.â€

 

The mayor underlined the role of young officers in criminal cases involving new technologies, saying that their older counterparts might have to rely on them to solve crimes sometimes.

 

The international fraud ring that hacked into First Commercial Bank’s ATMs had committed crimes in several countries before “hitting a snag†in Taipei, indicating that the city’s capacity to tackle intricate crimes has improved, Ko said.

 

He also lauded the city’s network of surveillance cameras that helped identify other key suspects in the heist, adding that he had instructed Taipei Police Department Commissioner Chiu Feng-kuang (邱è±å…‰) to confer with information technology colleges at several universities to devise ways to boost the efficiency of the city’s network.

 

http://www.taipeitimes.com/News/taiwan/archives/2016/07/20/2003651413

[Truth_hurts]

ATM heist suspects behind bars

 

HELD INCOMMUNICADO:The Taipei District Court denied the three bail, saying that they pose significant flight risks, and could attempt to collude with other suspects

 

Three East Europeans arrested following the theft of more than NT$83 million (US$2.59 million) from First Commercial Bank automated teller machines (ATMs) spent their first day in custody at the Taipei Detention Center yesterday.

 

A judge granted prosecutors’ request that the trio be held incommunicado, but they may have access to their lawyers.

 

Saying that the three pose considerable flight risks, and could attempt to collude with other suspects to manipulate evidence, the Taipei District Court denied their application for bail, and ordered them taken to the detention center in New Taipei City’s Tucheng District (土城).

 

At the bail court hearing, Andrejs Peregudovs, 41, from Latvia; Niklae Penkov, 34, from Moldova; and Mihail Colibaba, 30, from Romania, were all provided with translators, and were allowed to make statements on their own behalf with the aid of their lawyers.

 

Under questioning, Penkov and Colibaba said that they were recruited by a Ukrainian man they knew only as “Ion,†who promised to pay them US3,000 each if they worked as “money collectors†for him in Taiwan, prosecutors said.

 

Peregudovs allegedly said he took the job because he had a 3,000 euro (US$3,307) debt, and was promised a reward of US$10,000 after completing the task.

 

According to the Criminal Investigation Bureau (CIB), a total of 17 foreigners came to Taiwan to carry out the alleged theft from ATMs in the greater Taipei area and Taichung on July 9 and July 10.

 

The CIB said the group included seven Russians, six Romanians, one Lithuanian, one Australian, one Latvian, one Moldovan, all of whom are male, and one Russian woman, identified as Oxana Sarkisova, 42.

 

According to CIB investigators, a voice recording server at a London branch office of First Commercial Bank was hacked and implanted with malware ahead of the ATM heist, and insider assistance could not be ruled out yet.

 

Officials said that when information security personnel investigated how the bank’s network was hacked and how the ATMs had been controlled, they found irregularities in the connections between the voice server in London, the bank’s internal network and the ATMs in Taiwan.

 

After analyzing the connections, the technicians discovered malware and content that should not have been there, and they concluded that the server was the likely network endpoint exploited by the hackers.

 

An investigation by the CIB indicated that the initial hack took place on July 4 and was tested on ATMs on July 9.

 

The bureau said that because the bank’s computer system is a closed network, an international ring had likely hacked the computer system of the bank’s London branch and then obtained the account number of the ATM computer system’s administrator, giving the ring access to the internal network.

 

To check its suspicions, the bureau summoned staff from the bank’s London branch to Taiwan on Friday to cooperate in the investigation.

 

The bureau has questioned staff from the bank’s London branch and headquarters as well as personnel from Wincor Nixdorf, the manufacturer of the compromised ATMs.

 

First Commercial Bank chairman Tsai Ching-nain (蔡慶年) on Monday said that 51 of the bank’s 438 Wincor PC1500 ATMs were hacked during the heist.

 

Tsai said that the company has decided to phase out the PC1500 ATM, adding that deputy managers and other executives would be disciplined over the heist.

 

http://www.taipeitimes.com/News/taiwan/archives/2016/07/20/2003651412

[Truth_hurts]

This happened recently in other countries.

I wonder if they are part of this group.

 

Banking industry fears hackers can too easily attack the global financial system

 

http://money.cnn.com/2016/05/18/technology/hackers-smaller-banks/?iid=EL

 

 

Casinos, money laundering and wire transfers: Inside a global bank heist

 

http://money.cnn.com/2016/03/18/news/bangladesh-bank-heist-philippines-casino/

 

 

Hackers stole millions in third attack on global banking system

 

SWIFT, or the Society for Worldwide Interbank Financial Telecommunication, warned customers that two previous attacks against banks in Bangladesh and Vietnam appeared to be "part of a wider and highly adaptive campaign."

 

The hacks targeting banks in Asia follow the pattern described by Banco del Austro:

 

1. Attackers used malware to circumvent a bank's local security systems.

2. They gained access to the SWIFT messaging network.

3. Fraudulent messages were sent via SWIFT to initiate cash transfers from accounts at larger banks.

 

http://money.cnn.com/2016/05/20/news/swift-bank-attack-global-ecuador/index.html?iid=EL

 

 

Two hours and 1,600 fake credit cards later: $13 million is gone

 

http://money.cnn.com/2016/05/23/news/bank-fraud-south-africa-japan/index.html?iid=EL

[Truth_hurts]

Investigators find more ATM cash

 

NEIHU HIDING PLACE: A black plastic bag filled with cash was located near a hiking trail in Sihu Park, but officials said that about NT$10 million of the loot is still missing

 

A black bag containing some of the cash stolen from First Commercial Bank’s automatic teller machines (ATMs) is pictured yesterday in among items of trash left in Sihu Park in Taipei’s Neihu District. Photo: Chen Yi-yun, Taipei Times, from a police photo

 

The discovery of a black bag containing bundles of cash near a hiking trail in Taipei’s Neihu District (內湖) means that most of the NT$83 million (US$2.6 million) stolen from First Commercial Bank’s (第一商業銀行) automated teller machines (ATMs) earlier this month has been recovered, officials said yesterday.

 

Based on information provided by Latvian suspect Andrejs Peregudovs, Criminal Investigation Bureau (CIB) and Taipei police units searched Sihu Park (西湖公園) and were able to find the bag, which was hidden under a pile of trash on a rarely used hiking trail.

 

However, exhilaration over the discovery, which initially was thought to be the more than NT$22 million missing after the recovery of NT$60.24 million from a Taipei hotel room on Sunday, was tempered last night after the money was counted.

 

It amounted to NT$12.63 million, leaving NT$10 million unaccounted for.

 

Investigators said that they would continue their hunt for the missing cash.

 

As part of their investigation, police and prosecutors took Peregudovs out of the Taipei Detention Center yesterday morning so he could retrace his movements around Taipei.

 

They asked him for the whereabouts of a bag he was seen carrying in Neihu in surveillance camera footage.

 

Peregudovs was taken to Sihu Park, but he said he could not remember the exact location where he had left the bag, because it had been late at night, telling investigators that he had tossed the bag into a grass overgrowth next to a hiking trail.

 

After pressing him for more details, investigators checked GPS positioning on maps of the park, and conducted an extensive search in the area. The bag was found at about noon.

 

Peregudovs was taken back to Sihu Park in the afternoon so he could reconstruct his movements for investigators and show how he had disposed of the bag.

 

When shown the black bag, he nodded in agreement when he was asked to identify it, saying that it contained the rest of the money from the heist, Taipei Xinyi District (信義) Police Precinct chief Wu Ching-tien (å³æ•¬ç”°) said.

 

Peregudovs had previously told police that the remaining NT$23.03 million had been transferred to Moscow, but officials said they were convinced that it was still in Taiwan because there was no evidence any of the 13 heist suspects who fled the country had large amounts of cash with them when they left.

 

The three suspects in custody — Peregudovs, Romanian Mihail Colibaba and Moldovan Niklae Penkov — only arrived in Taipei after the heist was committed to handle the stolen money and get it out of the country, officials said.

 

First Commercial Bank executives said they were pleased with the efficiency of the police and announced that the bank would donate NT$2 million to a group that supports Taipei police.

 

Additional reporting by CNA

 

http://www.taipeitimes.com/News/front/archives/2016/07/21/2003651464

[Truth_hurts]

NT$10 million still missing from ATM heist

 

 

TAIPEI, Taiwan -- About NT$10 million in cash stolen from Taiwan ATMs remains missing as of Wednesday, according to police.

 

Police announced the figure after counting the sum in a bag of stolen cash retrieved from the mountains of Neihu on Wednesday afternoon.

 

A total of NT$83 million had been stolen from First Bank ATMs in Taiwan from July 9 to July 11, prosecutors said.

 

The ATM heist was allegedly committed by three Eastern Europeans: Latvian Andrejs Peregudovs, Romanian Mihail Colibaba and Moldovan Niklae Penkov.

 

Police arrested the suspects on Sunday and recovered around NT$60 million of the stolen money.

 

Investigators made a major breakthrough after returning to Neihu District with one of the suspects, Peregudovs.

 

The suspect had previously claimed ignorance of the whereabouts of the stolen money

 

According to one of the officers, Wu Jing-tien, they had discovered that Peregudovs had gone to Xihu Park, Neihu at 11:20 a.m. on the day of the heist, shortly after surveillance cameras filmed him leaving the Ximending shopping district.

 

Another camera showed him leaving Neihu empty-handed.

 

Investigators then identified the location as the possible hiding place of the remaining NT$20 million.

 

On Wednesday afternoon, officers discovered a black garbage bag containing around NT$10 million in Neihu.

 

According to the police, the garbage bag was found in a cave filled with trash that was concealed by trees at the entry to a hiking trail in a parking lot in Xihu Park.

 

Prosecutors later verified that the money was part of the cash stolen from First Bank ATMs.

 

An estimated NT$10 million in stolen cash is yet to be found, police said.

 

Police Efficiency Lauded

 

Although 16 suspects fled the country and the sum has not been fully recovered, police were praised for the arrest of the three suspects and for retrieving NT$70 million so far.

 

Director General of the National Police Agency Chen Kuo-en (陳國æ©) said that police officers made great efforts in the case.

 

He said that Taiwan was not a haven for criminal activities and that its law enforcement had produced a "major setback" for an international crime ring.

 

According to prosecutors, the international ring used malware to force the ATMs to dispense cash without a bank card. The process took no more than 10 minutes in total.

 

Forty-one ATMs reported malfunctions in Taiwan on the day of the heist, investigators said.

 

 

http://www.chinapost.com.tw/taiwan/national/national-news/2016/07/21/472926/NT$10-million.htm

 

[Truth_hurts]

This clip is in Chinese.

At first the police wasn't sure if it was them.

Those foreigners who stole money from the ATM were wearing baseball caps to cover their face.

After they left the hotel room the police went into the room and they saw those baseball caps so that's how they got caught.

[Truth_hurts]

Police search Neihu park again for missing money

 

A man, surnamed Ko, who found some of the money from the First Commercial Bank heist, and his son, with face masks, are surrounded by reporters at the Taipei District Prosecutors’ Office yesterday. Photo: George Tseng, Taipei Times

 

 

Law enforcement officers were out in force yesterday in Sihu Park (西湖公園) in Taipei’s Neihu District (內湖), searching for more of the missing money from the First Commercial Bank (第一商業銀行) automated teller machine (ATM) heist.

 

Hours after investigators on Wednesday found a black bag containing NT$12.63 million (US$393,949) in a search of the park, a 65-year-old man, surnamed Ko (柯), told police that he had also found NT$4.54 million in a bag in the park on Wednesday morning.

 

However, the unusual manner and strange circumstances of Ko’s find aroused investigators’ suspicions, and Ko and his son were summoned yesterday as witnesses for questioning at the Taipei District Prosecutors’ Office.

 

Prosecutors said it was necessary to verify the exact amount of Ko’s find, to determine if he had kept some of the money and how he had found it, among other questions.

 

Ko reported his find at a local police station 13 hours after he said he stumbled across the money in the park.

 

When questioned by prosecutors, Ko took a NT$1,000 note out of his pocket and said it had also come from the bag he found in the park, which raised questions as to whether he had kept more of the money that he had found.

 

Police officers escorted Ko back to his residence yesterday afternoon to conduct a search of it and then took him to Sihu Park show re-enact his movements and explain where and how he found the bag of money.

 

Criminal Investigation Bureau staff said they could not rule out the possibility that Ko had known the exact location of the money and tried to recover it before police searched the park on Wednesday.

 

Heist suspect Andrejs Peregudov told investigators that he had left two bags with money near a hiking trail in the park.

 

Yesterday’s search of the park found no trace of the remaining NT$5.86 million from the NT$83 million heist.

 

http://www.taipeitimes.com/News/front/archives/2016/07/22/2003651535

[Truth_hurts]

 

Prosecutors summon mountain hiker who turned in NT$4.54 mil.

 

 

The man who discovered and turned in NT$4.54 million in stolen money, left, leaves the Taipei District Prosecutors Office accompanied by his son, Thursday, July 21. The man, surnamed Ker, and his son were summoned by prosecutors to give details of the day they discovered the fortune. (CNA)

 

 

 

TAIPEI, Taiwan -- Prosecutors called in a man for questioning Thursday, after he turned in NT$4.54 million, suspected to be nearly half of the remaining sum missing from last week's ATM heist.

 

The 65-year-old man, surnamed Ker, told police on Wednesday night he "may have" found the stolen money

 

However, he vehemently refused to sign an official statement, stressing he had accidentally found the cash.

 

"Why do I have to undergo police inspection for coming across cash," remarked Ker, insisting on not signing.

 

Police said Ker could face charges of holding onto unclaimed property, since he waited for approximately 16 hours before turning the cash in.

 

Ker said the money was found on Wednesday morning at a mountainous location near a parking lot in Xihu Park (西湖公園). The spot was only 30 meters away from where police discovered NT$12.63 million of stolen money later that day, said police.

 

Following orders from the prosecutor's office, the police returned to the site with Ker at around 7 a.m. Thursday, in a bid to recover the remaining NT$5.85 million. A total of NT$83 million was stolen from First Bank Commercial Bank (第一銀行) ATMs in Taiwan from July 9-10, said prosecutors.

 

According to the New Taipei Field Division of the Investigation Bureau, the international fraud ring used malware to hack into First Bank's computer system, forcing its ATM machines to dispense cash without the use of bank cards.

 

Forty-one ATMs reported malfunctions in Taiwan on the day of the heist, said prosecutors.

 

President Vows to

 

Step Up Security

 

Presidential office spokesman Alex Huang (黃é‡è«º) said President Tsai Ing-wen had praised the police and concerned units for the speed with which suspects in the ATM heist were caught.

 

　　Huang said Tsai also stressed information security attacks have big consequences — not only has this been shown in the recent ATM heist, but it can also deal heavy blows to the global financial system, he added.

 

This is the first large-scale ATM heist in Taiwan, in which suspects penetrated multiple information security barriers, said Huang.

 

Similar attacks might also happen to other banks and organizations, said the spokesman, stressing it is necessary to step up information security.

 

 

http://www.chinapost.com.tw/taiwan/national/national-news/2016/07/22/473051/Prosecutors-summon.htm

 

[BigManSam]

Any more info?

 

Lol at it being eastern europeans, they love ATM scams.

[Truth_hurts]

Any more info?

 

Lol at it being eastern europeans, they love ATM scams.

More updates

 

Part of missing money from ATM theft found

About NT$10 million still unaccounted for: reports

 

By Matthew Strong

Taiwan News, Staff Writer

2016-07-20 02:34 PM

 

The missing NT$23 million (US$718,000) from the automatic teller machine theft by an East European group were found along a path in Taipei City’s Neihu District Wednesday afternoon, reports said.

 

Missing money from ATM theft found

Central News Agency (2016-07-20 15:15:02)

ATM theft suspect Andrejs Peregudovs.

 

Missing money from ATM theft found

Central News Agency (2016-07-20 15:06:12)

The Neihu area where the money was found Wednesday.

 

 

TAIPEI (Taiwan News) – A bag believed to contain the missing NT$23 million (US$718,000) from the automatic teller machine theft by an East European group was found along a path in Taipei City’s Neihu District Wednesday afternoon, but by evening it became clear that not all the money was inside, reports said.

 

A group of up to 19 people were believed to have been involved in the theft of a total of NT$83 million (US$2.59 million) from more than 40 First Commercial Bank ATMs during the July 10 weekend.

 

Most of the suspects fled the country, but the arrest of Latvian citizen Andrejs Peregudovs in Yilan County on July 17 supplied investigators with a major breakthrough. The same day, Romanian national Mihail Colibaba and Moldovan citizen Nikolay Penkov were picked up by police at a Taipei hotel, and NT$60 million (US$1.8 million) was found soon after. The group had used lockers at Taipei Railway Station as a hiding spot.

 

Peregudovs, who was transferred to the Taipei Detention Center with his two suspected accomplices, claimed he had put the missing money in a bag and deposited it somewhere near a parking lot in the Neihu District, apparently to be picked up by other members of the group, reports said.

 

On Wednesday, police searched the area and found a black bag containing cash half-buried among trash some steps away from a hillside path opposite Xihu Park, reports said.

 

The cash turned out to be the missing money from the ATM case, police said. Later in the afternoon, police took the suspect to the site for a reconstruction. The event drew a crowd of onlookers despite the rain.

 

However, in the latest dramatic turn of events, after the money was counted, it turned out the bag only contained NT$12.63 million (US$394,000), meaning that about NT$10 million (US$312,000) was still missing after all. There was no immediate word on what could have happened with the latter sum.

 

Peregudovs reportedly told investigators he had been told online to deposit the bag with the cash at a given location on July 12. There was no word who ordered him to do so and what the plan was, but the Latvian said he might still be able to find the bag if police took him to the area. He later reportedly changed his story to say he had just dumped the bag there, while media speculation started that this was a part of the money he did not want to share with the other members of the gang but wanted to keep for himself.

 

As to how a group of East Europeans with no apparent knowledge of Taiwan managed to make ATMs produce so much money without the use of bank cards, the investigation has been focusing on malware possibly introduced into the bank’s system through its London branch.

 

Prosecutors were reportedly questioning four people as witnesses Wednesday, including a manager from the London office, an electronics expert from the bank’s headquarters and a representative of the ATM supplier, Wincor Nixdorf International.

 

Most other members of the group, predominantly Russians, left Taiwan for Hong Kong, where they transferred to flights to Moscow before disappearing.

 

http://www.taiwannews.com.tw/etn/news_content.php?id=2954736

[Truth_hurts]

Edit: Over NT$5 million stolen from ATMs still unaccounted for: police

 

Central News Agency

2016-07-21 08:17 PM

 

Taipei, July 21 (CNA) Most of the NT$83.23 million (US$2.6 million) stolen from First Bank's automated teller machines (ATMs) earlier this month has been recovered, with only about NT$5.79 million still left unaccounted for, police said Thursday.

Police had already recovered NT$60.27 million of the NT$83 million stolen from 41 First Bank ATMs from July 9 to 11 and had initially thought they had retrieved the remaining NT$23 million after discovering a bag containing a large amount of money near a hiking trail in Neihu on Wednesday.

 

But a count of the money in the bag yielded only NT$12.63 million, NT$10.4 million short of the intended target, and police said Wednesday they would continue to try to track down the remaining amount.

 

Later Wednesday, a father-and-son pair handed to police another black bag containing bundles of cash they discovered earlier that day at Xihu Park in Neihu. After the money was counted, police found it amounted to NT$4.54 million, leaving nearly NT$5.79 million still unaccounted for.

 

Investigators said that after the discovery of NT$60.27 million in a Taipei hotel room on Sunday, and the NT$12.63 million and NT$4.54 million found in the two black bags at Neihu Wednesday, they would continue their hunt for the missing cash.

 

In fact, police launched a search for the missing cash around Xihu Park Thursday morning but to no avail.

 

Investigators said the remaining money could still be in Taiwan or has been distributed among the 14 money carriers thus far connected to the ATM theft ring. (By Liu Jian-bang and Evelyn Kao)

 

http://www.taiwannews.com.tw/etn/news_content.php?id=2955562

[Truth_hurts]

Sat, Jul 23, 2016  

 

Man to be charged for not reporting ATM heist stash

 

NEIGHBORHOOD WATCH:A woman said she took a picture of the man because she thought he acted strange as he walked past her wearing a motorcycle helmet

 

 

A man surnamed Ko, who found money from the First Commercial Bank heist, wearing a face mask, arrives at the Xinyi police station yesterday in Taipei. Photo: Chen Yi-yun, Taipei Times

 

 

Police plan to bring charges against a 65-year-old man, surnamed Ko (柯), who investigators say had found two bags of cash at a park in Taipei’s Neihu District (內湖) and had wanted to keep the money, which was reportedly hidden there by the Latvian suspect Andrejs Peregudovs in connection with the millions of dollars that were stolen from of First Commercial Bank’s automated teller machines (ATMs) earlier this month.

 

Accompanied by his lawyer, Ko went to Taipei’s Xinyi District (信義) Police Precinct yesterday, where investigators questioned him regarding his activities on Wednesday, when he allegedly found NT$4.54 million (US$141,565) in the hills of Neihu’s Sihu Park (西湖公園).

 

Ko will likely be charged with offenses relating to the transport and possession of illegally obtained assets, police said, because the money he took home was related to a criminal case under investigation and he did not immediately report his find to police, instead waiting more than 14 hours before he contacted the authorities.

 

Police said that Ko went to Sihu Park at about 6am on Wednesday morning, according to surveillance camera footage, found the heist money and transferred NT$4.54 million of it from the first bag into a plastic bag, then exited the park to go home shortly after 8am.

 

Police said Ko was shown by surveillance cameras returning to Sihu Park at 9am, this time carrying two plastic bags, with the intention to take out the cash contained in the other carrying bag, which he left behind likely because it was too heavy for him to carry.

 

However by that time, Criminal Investigation Bureau officials and police had arrived at the park to retrieve the money, based on information given by Peregudovs, and had set up patrols, so Ko was unable to retrieve the second bag, containing NT$12.63 million, which the authorities found that afternoon.

 

A woman also provided the police with a photograph of Ko on Wednesday carrying two plastic bags and wearing a motorcycle helmet while walking toward the park.

 

“I saw this man walking past me, and he was acting in a suspicious way. There was something strange in the look of his eyes, so I took pictures of him,†the woman reportedly told police.

 

Police said Ko admitted he intended to keep the money, but that he said his son later convinced him to report his find to the authorities after seeing media reports of police taking Peregudovs to Sihu Park to retrieve the money on Wednesday.

 

Police said that their priority is to determine whether Ko was in any way connected to Peregudovs and the East European criminal gang who allegedly carried out the ATM heist, or whether he was instructed by a third party charged with collecting and laundering the money and sending it abroad.

 

http://www.taipeitimes.com/News/taiwan/archives/2016/07/23/2003651613

 

 

 

[Truth_hurts]

.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

[Truth_hurts]

This is translated by me

 

2016-07-21

 

Prosecutors investigating this case discovered two recording from a hard disk/drive in London branch host computer.  The hackers timeline, the ATM software was updates at the end of June giving the group opportunity to hack. On July 4 the ATM services were controlled by counterfeit software. On the 9th hackers/intruders were once again recorded implanting malicious program to remotely control the ATM.  Around 5:00 PM the Taipei District Prosecutors Office interviews four system engineer and a bank employee as witnesses.

 

This morning New Taipei City Bureau of Investigation Branch interviewed four people as witnesses. The system management engineers and a system maintenance and manufacturer. 

 

The staff noted that after several digital evidences through forensic they can confirmed the crime occurred during the day of the 9th to 11th.  A telephone recording from the London Branch hosts main engine and Taiwan ATM had unusual connection, that touches the firewall, after another check they discovered that another main engine had the same malicious program/malware, London branch identified that their network was hacked.

 

http://news.ltn.com.tw/news/society/breakingnews/1770527

 

 

edit: Another translation

 

Prosecutors reported that the Bureau of Investigation found two telephone recording from London Branch Drive mainframe computer was hacked. 

 

Since the malware remotely control the ATM services through counterfeit software, New Taipei City Bureau of Investigation interviewed three management system engineers and a management systems maintenance and manufacturer engineer. 

 

http://news.ltn.com.tw/news/society/breakingnews/1769960

[Truth_hurts]

New updates 

 

Police investigating man who found heist cash

 

CNA

July 23, 2016

 

TAIPEI--A man who found some of the cash stolen from First Bank's automated teller machines (ATMs) earlier this month is now under investigation on suspicion of transporting stolen goods, police said Friday. 

 

Late Wednesday, the 65-year-old man surnamed Ko handed police a bag containing NT$4.54 million that he said was discovered on a forested hill near Xihu Park in Taipei's Neihu District.

 

Ko told police that he found the money when he was exercising and feeding wild cats there that same morning and that he then brought the money home to prepare to report it to the police.

 

Police, however, received a tip-off Friday indicating that Ko attempted to return to the site to collect another bag of money after taking the NT$4.54 million home.

 

Photos taken by the informer show that Ko arrived home at around 8 a.m. Wednesday carrying two plastic bags, one white and one black.

 

Ko later attempted to get back to the hill, possibly to pick up another bag of money dumped there by the ATM heist suspects, but he gave up his bid after seeing police officers at the foot of the hill, the informer told police.

 

The original heist occurred between July 9 and 11 when an international ring stole NT$83.27 million from 41 of First Bank's ATMs in Taipei, New Taipei and Taichung using malware to hack into the bank's computer system.

 

On July 17, police recovered NT$60.24 million of the stolen cash from the hotel room of two of the three suspects arrested, Romanian Mihail Colibaba and Moldovan Niklae Penkov.

 

Based on information provided by the other suspect, Latvian Andrejs Peregudovs, police found a bag containing NT$12.63 million on the hill near Xihu Park on Wednesday.

 

The police were not aware that another bag of money dumped there had been taken away by Ko until he turned it over to police that same night.

 

According to lawyers, Ko's act might have constituted the crime of transporting stolen goods, embezzlement or theft.

 

So far, nearly NT$5.79 million of the stolen cash is still unaccounted for. Police said they suspect the missing money might have been taken overseas by at least 13 suspects who have already fled the country.

 

http://www.chinapost.com.tw/taiwan/national/national-news/2016/07/23/473141/Police-investigating.htm

[Truth_hurts]

There's more updates on this case in Chinese.

Some old articles with translations

 

translated by me

 

 

2016-07-20 

 

This morning Taipei Lutheran branch of police had prime suspect Andrejs Peregudovs in their custody, and finally found the remaining stolen money. However, what is curious, is why Andrejs argued to the police that the money was sent back to Russia, and now they fit to testify, in the middle there is such a big change, because Andrejs was still worried he will be shot.

 

http://news.ltn.com.tw/news/society/breakingnews/1769558

 

 

2016-07-22

 

Hackers sold money from 41 ATM, and another three ATM were connected to London Branch main engine record, and in another two ATM the driver had appeared on the surveillance video, but did not participate in this crime, the new Taipei investigation Bureau seized more than 46 sets of ATM hard disk, after nearly 2 week analysis, staff will now know how the hackers and other malicious programs record were implanted, the digital evidence forensic report in the ATM was sent to prosecutors for investigation. 

 

 

New Taipei investigation Bureau discovered the criminal group hacked into London Branch server main engine, and further obtain the ATM main engine software updates.  

 

http://news.ltn.com.tw/news/society/breakingnews/1771082

[Truth_hurts]

Translated by me

 

2016-07-21

 

 

The three arrested suspects will be sentenced to a maximum of seven years, since Andrejs is going to help the police search for the money, it is likely that in the future his punishment will be reduce/less severe.

 

"United Daily News" reported that, according to the collected evidence of fraud, and obstruction of computer use, the crime of money-laundering charges against Andrejs, Mikhail, Penkov, they might be involved in almost non-felony offenses, the maximum sentence is up to seven years after Andrejs was arrested he admitted about the money and he is going to help the police recover the stolen money, so the court will give him a lighter sentence.

 

In addition, different ATM were stolen up to 34 times several times, the judge will look at the crime or several crimes, which will greatly affect the punishment of the defendant.

 

http://news.ltn.com.tw/news/society/breakingnews/1769759

[Truth_hurts]

 

Latest ATM heist suspect

 

CNA

July 24, 2016

 

 

The undated photo shows Russian national Oxana Sarkisova, 42, the latest suspect identified by the police implicated in the First Bank ATM heist. Sarkisova's role in the crime was not clear until yesterday, when investigators discovered her helping transport NT$22.51 million stolen cash. A total of 17 suspects have been confirmed by the police. Sarkisova has escaped the country.

 

http://www.chinapost.com.tw/taiwan/national/national-news/2016/07/24/473243/Latest-ATM.htm

[Truth_hurts]

Russian woman listed as suspect in First Bank ATM heist

 

 

Taipei, July 23 (CNA) A Russian national has been added to the list of suspects in the theft of more than NT$83 million (US$2.6 million) from First Bank automatic teller machines (ATMs) in Taiwan earlier this month, police said Saturday.

The latest addition is 42-year-old Oxana Sarkisova, who arrived in Taiwan from Macau at 11 a.m. July 11 and departed for Macau again at 8 p.m. that same night. She was previously listed as an associate in the case.

The latest findings by police show that Sarkisova headed directly to the Humble House Taipei hotel to look for her boyfriend Alexander Lvovskiy, another Russian suspect in the case, immediately after she got off the plane.

She was seen on surveillance camera footage pulling a piece of white luggage into the hotel at 6 p.m., police said.

The luggage, containing more than NT$22.51 million, was eventually handed to Evgenni Babii, also a Russian, who stored it in a locker at the Taipei Railway Station July 13. It was then taken away by Romanian Mihail Colibaba July 16, according to police.

With Sarkisova included, 17 suspects from six countries have so far been identified in the high-profile ATM theft involving an international crime ring.

The heist occurred between July 9 and 11 when the ring stole NT$83.27 million from 41 of First Bank ATMs in Taipei, New Taipei and Taichung using malware to hack into the bank's computer system.

On July 17, police recovered NT$60.24 million of the stolen cash from the hotel room of Colibaba and Moldovan Niklae Penkov following their arrest.

Based on information provided by the other suspect arrested, Latvian Andrejs Peregudovs, police found a bag containing NT$12.63 million on a hill near Xihu Park in Taipei's Neihu District July 20.

Also July 20, a man surnamed Ko handed to police another bag containing NT$4.54 million that he discovered earlier that day at the same site.

To date, nearly NT$5.79 million of the stolen cash is still unaccounted for.

Police said they suspect that the missing money might have been taken overseas by the other suspects who have already fled the country.

It has been found that Estonian Xander Tann and Australian Victor Kharechko converted more than NT$200,000 into South Korean won, Australian dollars and U.S. dollars at Taiwan Taoyuan International Airport right before they flew to South Korea July 11.

All told, 17 suspects from six countries are involved in this case, including Vladimir Berkman (Russia), Sergey Berezovskiy (Russia), Gaik Manukian (Russia), Adiian Kamo (Russia), Oleg Malic (Romania), Ion Secrieru (Romania), Igor Valicoglo (Romania), Sergey Berezovskiy (Romania, different passport number and birth date from Russian), and Alexandru Arsenii (Romania), according to police. 

(By Liu Chien-pang, Lin Chang-shun and Y.F. Low) 
ENDITEM/J

 

 

http://focustaiwan.tw/news/asoc/201607230022.aspx

[Truth_hurts]

yesterday

 

Man who found ATM money faces scrutiny

 

By Matthew Strong

Taiwan News, Staff Writer 

2016-07-22 03:00 PM

 

 

TAIPEI (Taiwan News) – The investigation into the theft of NT$83 million (US$2.59 million) on Friday shifted from three detained East Europeans to a local man who had found but not immediately reported part of the missing money.

 

A group of more than a dozen foreign visitors were helped by malware in removing the money from First Commercial Bank ATMs over the July 10 weekend, but all of the cash was thought to be still in Taiwan.

 

After about NT$60 million had been found in a hotel room with two suspects, a bag believed to be containing the rest was found near a park in Taipei City’s Neihu District on July 20.

 

However, when counting was completed during the evening of that day, only about NT$12 million was accounted for. It later emerged that a 65-year-old local man surnamed Ko had found NT$4.54 million and taken it home with him before alerting the authorities.

 

Because of the reported 13-hour gap between his find and his contact with the police, investigators were reportedly considering he might be suspected of harboring stolen property and related charges, which might lead to a prison sentence of maximum seven years.

 

On Friday, pictures emerged of Ko walking around the neighborhood of Xihu Park carrying plastic bags and wearing a motorcycle helmet, even though he never rode a vehicle during that outing. A passerby who had taken the pictures reportedly told police that Ko had returned to the park with more plastic bags after having moved a first batch of cash home.

 

Reports suggested that Ko was going back to take the remaining NT$12 million home with him, but failed to do so because he found police were already searching the area.

 

Because Ko had also suddenly produced a NT$1,000 note during a meeting with prosecutors Thursday, investigators were also wondering whether he had not stashed more of the money away for his own use, reports said.

 

Ko’s home was reportedly searched and he was asked to take part in a reconstruction of his find in the park, but none of the actions reportedly turned up the missing money, estimated at NT$5.86 million.

Theories mentioned in the media include the possibility that the missing cash might still be lying in a bag somewhere in the Neihu park, or that it had been spent by the East European group before they left Taiwan.

 

Only a Latvian, a Romanian and a Moldovan had been apprehended, though attention is still focusing on the First Commercial Bank’s London branch, where the malware was suspected to have been introduced. Several bank officials have been questioned as witnesses, though the theory of an inside accomplice had not been completely ruled out.

 

http://www.taiwannews.com.tw/etn/news_content.php?id=2955886

 

[Truth_hurts]

Translated by me

 

 

2016-07-23

 

Prosecutors Investigating this case found that not only was London branch hacked by Eastern European crime groups they suspected Southeast Asia was also hacked, the ATM connection signal was unusual, the Bureau of investigation said by next Monday this case will be more clearer.

 

New Taipei City Bureau of Investigation/Xinbei Bureau of Investigation found several digital evidence that the criminal group hacked into a London Branch host server, and further obtained the ATM software updates send to  ATM host server, implanted the malicious program, remotely controlled the ATM, New Taipei City investigation Department/Xinbei investigation branch interviewed a management and systems engineer, maintenance and system manufacturer "three computer companies" three engineers, a total of four people, in addition still need to clarify the hacker technique.

 

http://news.ltn.com.tw/news/society/breakingnews/1772280

[Truth_hurts]

edit: 2016-07-25

 

New Taipei said that at present finds London Branch is still hacked and not rule out the interviewing employees from Vietnam Ho Chi Minh and Phnom Penh Branch branch (According to information, reporters Luopei De photo)

 

 

The new Taipei found that Eastern European crime groups not only hacked into London Branch but branches in Vietnam Ho Chi Minh Branch and Cambodia Phnom Penh Branch, and unusual connections between London branch, they suspect these two overseas branches in Southeast Asia were also hacked into,  therefore connections in Vietnam Ho Chi Minh, Cambodia Phnom Penh and London branches appear to be unusual.

 

New Taipei/Xinbei said that as of today London Branch was still hacked, but did not remove talks of questioning employees from Vietnamese Ho Chi Minh Branch and Phnom Penh Branch Branch to clarify whether it was the internet flaw or human error, the detailed forensic report is expected to be complete in late July or early August, after the case is complete it will be clearer. 

 

Officials said if the host IP traced the hacker's location in a foreign country, the case will be a "breaking point" fearing it will be difficult to uncover a curtain shape seen from behind the military,  probably because of this the IP location is another springboard for attacks.

 

http://news.ltn.com.tw/news/society/breakingnews/1774018