Arrests Tied to Citadel, Dridex Malware
Summary: Authorities in Europe arrested a 30-year-old Moldovan man in Cyprus and a 27-year-old Russian man identified only as "Mark" in Norway, both wanted by U.S. authorities in connection with the Dridex and Citadel banking Trojans. The Moldovan suspect is believed responsible for more than $3.5 million in bank fraud, while the FBI contends Mark is "Aquabox," the developer of Citadel, malware reportedly used to steal credentials from a Pennsylvania HVAC vendor that were then leveraged in the Target breach that took nearly 40 million credit cards.
Why it matters: Citadel was sold as a service with developer support and feature requests, and its stolen credentials from one small HVAC vendor fed a breach that cost Target nearly 40 million credit cards - a reminder that the weakest third party in your supply chain can be the entry point to your crown jewels.
Read the original at Krebs on Security ↗
- Topics
- Cybercrime & Law Enforcement
- Related
- Gootloader Malware Disrupted After Infecting 25,000 Computers Cyber Risks · Nov 13, 2026354 dark web vendors and buyers arrested in Operation Tor Nado Cyber Risks · Nov 13, 2026Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure Cyber Risks · Nov 13, 2026