Going price
The hacker used bank account information scraped from more than 25,000 victims' computers, in some cases renting other cyberthieves' networks of infected computers. He created counterfeit checks with banking data and mailed them to money mules throughout the United States. They cashed them, then forwarded the funds untraceably to Russia. He even used stolen credit card numbers vacuumed from the victims' hard drives to buy prepaid postal-service labels for the packages.
"From start to finish, this guy leveraged every bit of data," said Alex Cox, an investigator for Netwitness, a cybersecurity division of EMC, which has also been tracking Soldier's activities.
The most remarkable thing about the theft -- and this is, to experts in the field, the most worrisome development of the past few months -- was that Soldier didn't need any special expertise with computers. All he needed was a shopping list.
"He's not a lone hacker," said Trend Micro's David Perry. "He didn't write any code."
Shopping list
Strom said the FBI is also tracking Soldier and is confident they'll get him. "These guys are very sophisticated, but oftentimes they slip up," Strom said.
Strom and other investigators have one significant advantage: The hackers have a habit of turning their skills on one another. The FBI's DarkMarket sting started with a hacker war between a hacker calling himself Iceman, who ran CardersMarket, and JiLsi, the DarkMarket administrator, whose real name was Renukanth Subramaniam, the FBI said.
"We took advantage of that animosity," Strom said. JiLsi was eventually persuaded to turn over the site to the FBI, giving the bureau control over all communications involving DarkMarket's 2,500 members. As a result, Subramaniam was sentenced to more than four years in prison in the U.K.
Maza, the elite Russian forum, was recently hacked and its database dumped online, presenting a priceless opportunity for law enforcement. The forum's database held membership lists, email addresses, IP addresses and passwords -- the kind of information the world's top cyberthieves try very hard to keep secret. The main suspect in the Maza attack is the administrator of a rival site, Hex Nightmare said.
Lessons learned
"We learned a lot of lessons with DarkMarket, and we've passed that experience on not only to other offices within the FBI but to our counterparts overseas," Strom said. "We're definitely taking the fight back to them."
Hex Nightmare agrees the FBI may eventually make more progress. When Slavik, the author of the ZeuS malware, disappeared in 2010, he was at the height of his fame. Theories about his disappearance abound on the underground: He was killed; he now works as a cyberspy for the Russian government. Hex Nightmare has her own theory: "I think Slavik thought it was a good time to get out."
More from Bloomberg:
