“Eighteen,” Kozlov interrupted.
Turner could sense the tension build between the two men. Now he knew the amount of firepower they would be dealing with.
“Right,” the man said. “Before we get too comfortable, forty grand. In cash.”
Trent Turner knew Russians were critical by nature and smiled inside as he listened to the Bratva leader size up the American. Treating him like shit wouldn’t do him any favors, so he was enjoying the radio show. He heard a rustling sound before Kozlov said, “Here’s your money, plus a twenty-thousand-dollar bonus.”
He felt a slap on his face he assumed was a stack of bills, before Kozlov said, “For him.”
Turner knew the money would smooth over the previous conversation, so a rift between them when the shit hit the fan would now be unlikely.
“Works for me,” the man said. “He didn’t have a radio or ID on him, so it looks like he was flying solo.”
Turner had to fight back a smile. He knew what the man had said would match any MO that Kozlov would have assumed for him. Based on the timing of events, the operative suspected it was his recent job in Europe that had exposed him. He had been there alone.
“I trust your people are in place to deal with any other unwanted visitors?” Kozlov said.
“That they are. I’ve given your men some radios so we can stay in touch.”
“Good, and the men he took down? They’ll be okay?”
“They’re unconscious but alive. They’ll live.”
“I’m impressed,” Kozlov admitted. “Most people who have had a run-in with him don’t survive.”
Turner could sense the Russian’s glare on him.
“We’ll be sure to tie up this loose end quickly,” Kozlov added. “We wouldn’t want any more surprises.”
Chapter 127
Things had finally settled down enough for Etzy Millar to connect with The Shop using his computer. Dennis Zander was able to lay out what he knew about the underlying software that made up the Russian’s botnet. He had only been working on one aspect of the operation, information acquisition, but he made it a point to learn as much as he could from his roommate and the other hackers he had gotten to know. Zander was able to confirm much of the information they already knew but shared some new details with the analysts that he hoped would prove useful.
“It’s in Northern Virginia somewhere,” Zander said, referring to the Bratva’s backup location. “Near the airport. It’s off a main road close to one of the big data centers.”
“So you’ve been there?” Cynthia Grayson asked.
“Once,” Zander said dismissively. “It was at night. I rode in the car with the courier to set a server up with my stuff. I wasn’t familiar with the area, and he took a lot of back roads. The only thing I really remember was seeing signs for the airport.”
“Did you ever connect to the servers there to remotely transfer files?” she questioned.
“No. No way,” Zander said. “Dmitri, the Russian hacker guy who ran the operation, wouldn’t allow it. They were pretty paranoid about stuff like that. The funny part is that I was supposed to be blindfolded when we got close to the place, but the courier forgot to put it on, and by the time he realized what he’d done it was too late.” Zander thought about what else he knew that might be helpful. “I overheard a lot of their conversations. The backup location was to stay off-line, and they would only bring it up if something happened to the place in Chicago. I would encrypt the account files I was responsible for and put them on a USB drive for delivery. Same with the others.”
“You mentioned a courier?”
“Yeah. The courier drove back and forth with the files and the encryption key updates. He didn’t say much. I’m not really sure if he could speak English. I had to hit the bathroom on the way there, and it took me a minute to get him to understand.”
“Were they the encryption keys for the files?” Grayson asked.
Zander thought about it for a moment, knowing any details would help to narrow things down. “That and the botnet, I think. My Russian isn’t that great, so I’m not one hundred percent sure.”
“The keys were different? One for the files and one to control the bots?”
“I’m pretty sure. I overheard conversations to that effect. At least I think that’s what they said.”
“Did all of you use the same keys to encrypt the various files?” she pressed.
“Yeah, Dimitri wrote the encryption algorithm,” Zander said. “He’s really smart, arrogant too, but he knew his stuff.” He looked at Millar and shrugged. “There was an internal server that we’d browse to, similar to uploading a photo to Facebook or whatever. You’d select the files you wanted to encrypt and then click on a button to encrypt them. The server would do its thing and encrypt the files and then copy them onto the USB drive for you. It was pretty simple really. I couldn’t tell you if anyone else created files, though.”
“Were your files always the same name?”
“Yeah. The same name and listed by bank, by its ABA number, only it was backwards. Nothing complicated, just a way to hide them in plain sight in case someone happened onto the files somehow.” He thought some more and laughed. “In fact, the files I created were always the same.”
“What do you mean?” Grayson asked.
“Like I said before, I was trying to figure out how I could screw their operation up without getting caught, so I’d messed with my code in ways I thought I could get away with.”
“I’m not sure I follow.”
“Dimitri didn’t trust anyone. The obvious place to hose up the account file was in the query I wrote that selected the accounts — you know, the accounts that were active — but the owners didn’t bother to check their balances very often.” He started to get animated. “I made sure that part was right, since I knew how critical it was to the operation. Instead of messing with the obvious, I tweaked the code that outputs the results to the file instead. It was supposed to use the data retrieved by the query to create the new file, but I coded it to load the accounts from the old file instead of the updated list of accounts from the query.” He smiled smugly at Millar. “That way the file would always have stale information. I don’t know. I was hoping it would trip them up somehow.”
They continued to pepper the hacker with questions about the various aspects of the operation. He named several target banks in the US that the team was unaware of and explained that the vector of the attack was centered on the browser. They had found an exploit and were able to manipulate the HTML and CSS so that what the user was presented with on the screen was different than the actual transactions that were being processed and sent to the server. The premise was simple. They used legitimate user credentials to post fraudulent transactions.
One other crucial detail Zander was able to confirm was that there was another operation going on in Europe. He didn’t have much detail other than it existed, but was able to provide the name for one of the foreign banks. The news raised more questions than answers, since the bank in question had already come up clean as part of their investigation, but now they knew they needed to dig deeper.
“So how soon do you think they could execute the operation?” Grayson asked.
“It would take some time for sure,” Zander said.
“Good,” Grayson said, her sense of relief evident.
The hacker realized his mistake — time was relative after all — and clarified. “My guess is if they started today, they wouldn’t be ready until tomorrow morning sometime. They couldn’t do it today. That’s what I meant.”
Grayson let out an audible sigh and said, “That’s what I was afraid of.”