Vietnamese Cybercrime Group Indicted in US for $71M Crypto Hacking Scheme

Key Takeaways:

• A Vietnamese cybercrime group known as FIN9 has been indicted in the United States for orchestrating cyber attacks that led to $71 million in losses from 2018 to 2021.
• The charges against the group include wire fraud, fraud, money laundering, computer damage, and identity theft, which carry potential prison sentences of up to 20 years.

Vietnamese Cybercriminals Indicted for $71M Losses in the US

The accused individuals, identified as members of the Vietnamese cybercrime group “FIN9,” allegedly engaged in sophisticated hacking operations targeting networks throughout the United States from May 2018 to October 2021.

Based on the indictment, the defendants are Ta Van Tai (also known as “Quynh Hoa” and “Bich Thuy”), Nguyen Viet Quoc (aka “Tien Nguyen”), Nguyen Trang Xuyen, and Nguyen Van Truong (aka “Chung Nguyen”).

The indictment alleges that the group gained unauthorized access to the computer systems of victim companies using various methods, including phishing campaigns and supply chain attacks. Once inside, they reportedly stole sensitive information, employee benefits, and funds, resulting in significant financial harm.

Charges Involve Fraud, Identity Theft, Money Laundering

The cybercriminals exploited their access to divert digital employee benefits, such as gift cards, to accounts under their control. They also targeted and stole personal data and credit card information from employees and customers of the infiltrated companies. To hide their identities, the defendants supposedly created online accounts using stolen information and engaged in transactions, including selling stolen gift cards through cryptocurrency platforms.

The charges against Tai, Quoc, Xuyen, and Truong include conspiracy to commit fraud, extortion, and computer-related offenses; conspiracy to commit wire fraud; intentional damage to a protected computer; conspiracy to commit money laundering; aggravated identity theft; and conspiracy to commit identity fraud. Depending on the offense, these charges carry penalties ranging from up to five years in prison to a mandatory maximum of 20 years.