Tech

This young Romanian woman thought she had a customer service job in a tech start-up, but soon discovered she was working for a cybercrime ring

Key Points
  • Across Eastern Europe, cybercrime villages have proliferated to support the lucrative, tax-free industry of scamming people — particularly in Europe and the U.S. — stealing credit card numbers and other schemes.
  • In this excerpt from Kate Fazzini's "Kingdom of Lies," one former Romanian hacker tells how she got into the biz.
marrio31 | iStock | Getty Images

The following is a modified excerpt from CNBC cybersecurity reporter Kate Fazzini's "Kingdom of Lies: Unnerving Adventures in the World of Cybercrime," on sale June 11 wherever books are sold.

There is an old Romanian saying that roughly translates to "she can make a whip out of s---,' meaning, René Kreutz tells me, that she is resourceful, even when working with s---. And she has had to a few times.

She is a Romanian cybercriminal. Was. Is? She is tugging on the collar of a Brooks Brothers raincoat. Her hair is a different color now than the auburn she describes from the old days, her bad girl days.

She has a good, mid-level executive title now with a nice, well-known corporation. (Some names, locations and personal details have been changed to protect confidential sources.)

These have been easy to acquire, she says. She navigates the corporate world deftly. Never get complacent, just keep moving up and if you can't move up, move over, she says. She is beautiful but in a way that blends in nicely. She wouldn't stand out on your morning commute.

But once upon a time, she brought CEOs to their knees with a few well-placed emails and well-timed phone calls. Then she fell in love with a tyrant and fled Romania when she was just barely finished being a teenager. Now she's here, and I can't tell you why I met her because we also share a common secret. She looks 10 years older than her actual age. It's not stress in her face. It's the pearl earrings, the dark leather laptop bag. It's on purpose.

She stresses just how out she is, out of that world, so freeing, she just wants to live the simple life.

But did you hear, she asks me, about that Lithuanian man who died, leaving behind an encrypted laptop – he was a notorious carder, she said, someone who deals in stolen credit card numbers on the darkweb. "Everyone's trying to break it," she says, meaning the encryption on the laptop. "They think there's $10 million, $20 million on it," she says, meaning in bitcoin, procured over a decade spent in the fraudulent credit card trade.

"Everyone?" I ask.

She nods, she's smiling in a way that's a little far off, like she forgot her guard a little. "That's strange," I say, because, "didn't you say," and I stop myself before asking her what she means by everyone, because surely it wasn't her contacts from the criminal underground with whom she's no longer in touch. This story hasn't been in the news much.

I stop myself because I want to hear more of her story, and I like stories. I'm greedy for them. Just as greedy as she is for some dead guy's bitcoin.

This is what she says.

In Arnica Valka

It's 2015. Her hometown, Arnica Valka, is a quiet city of around 100,000 people, nestled in the foothills of the Transylvanian Alps, two hours west of Bucharest.

Arnica Valka has become one of the world's most notorious cybercrime villages, with an underground economy funded almost entirely by ransomware, stolen credit cards, and identity theft. Media will later call some of its neighboring towns among the most "dangerous places on the internet" and "hackervilles."

To her, it is just home. René was born in Arnica and grew up in Nicolae Ceaușescu-era housing projects. About two years prior to her nineteenth birthday, she noticed her hometown changing. Tech start-ups were percolating in warehouses and old barns, furnished like American social media companies with beanbag chairs and exposed brick walls. René heard the pay at these start-ups was fantastic — too good to be true.

René never mastered math like her parents had wanted and had no desire to marry a nice, older rich man, as her mother had suggested. She decides to go into advertising. As a student in marketing at Arnica Community College, she fantasizes about landing a job in tech, but she can't write code. Besides, it's not like these start-ups she keeps hearing about actually advertise job openings. It is all very hush-hush.

What she is good at: talking. She argues her way to better grades in school even when she has cut classes. She talked her way into a job as a waitress as at an upscale cafe called City Italia and talks her way out of parking tickets. She is pretty, too, slender with long auburn hair. Then again, most of the young women in Arnica are pretty. As the economy grows, she can't help but notice how the local pool of beautiful young women grows with it.

It's in this waitressing job that she meets a German man named Sig, who spend his money freely and calls himself the CEO of a new start-up in town, Techsolu. He asks her to come in for a job interview.

So one morning, she finds herself walking through the main street in town, which she'd not visited since starting college. That's where she sees how the new flood of foreign, possibly illicit money has gently shifted the local landscape.

Block by block as she nears the center of town, she sees new streetlights, more police cars. There are more people, too — young people — moving quickly in the cool morning air as they make their way to work. Stores that once sold cheap cell phones are now vending expensive tablets. Computer servers are advertised in the windows like puppies. Some of the storefronts promote the fact that they accept bitcoin as payment.

René passes the old, yellow-drab laundry where her mother would take her when their washing machine wasn't working. It is now called Cafe Americain and looks just like a Starbucks. Wedged between a health food store selling some kind of Korean drink with bubbles in it and a law office advertising financial crime defense is TechSolu.

René grips her handbag a bit tighter as she enters. Inside she finds a beautifully appointed open floor plan. The workers, all men, stare intently at their computer screens.

An offer

Sig says he needs a customer service representative for his business, which he characterizes as a cybersecurity shop. Customers call in he says, and they're upset because they've been hacked. It's up to you to calm them down, and explain how they can pay for Techsolu's services in bitcoin, he tells her. He offers to triple her salary as a waitress.

She accepts. She gets to work right away. And it's clear, from the moment she starts, the business is not what it seems.

On her first day, René helps four customers transmit bitcoin into a digital wallet held by TechSolu. The executives she speaks with on the phone are distraught. Sig explains that that's because they don't get to find out how to fix the cybersecurity problems until after they pay. It becomes clear after not too long, that this enterprise is dealing in a type of malware called ransomware, and its customers aren't willing.

Sig's other "employees" are hackers, not cybersecurity professionals, and they're breaking into American and European companies, freezing their important files, and demanding payment to get them back. She learns this but doesn't leave. It's exciting, she admits. And from what she can, nobody is getting hurt.

What René lacks in computer skills she makes up for in street smarts.

She quickly becomes hooked on customer service. Every day, she talks to distressed businessmen and -women, calms them down, and explains that they have been hacked, that they can restore their data immediately for a small fee, and they can make sure it doesn't happen again. The "customers" often go from pleading, crying, sometimes screaming to thanking her.

Some even say that the money — often just a few hundred dollars — is a small price to pay for recovering their files and making sure it never happens again.

René soon learns that all the tech start-ups on General Maleur specialize in ransomware or similar work. Above the Korean tea shop is a company that hacks into the databases of American retailers and steals credit card numbers.

Next to Cafe Americain, another company buys those credit card numbers and manufactures fake credit cards that work like the real thing. They hire mules to go out and purchase goods that can easily be turned around and sold, thereby creating "clean" cash from the illegal credit card transactions.

Sig was wrong when he said he would triple her pay from City Italia. In fact, she makes four times what she had been making at the restaurant. She quits community college but uses what she'd learned in class to make TechSolu's PowerPoint approach to hacked customers more businesslike, almost presentable.

Soon, René is optimizing TechSolu's ransomware racket. But she doesn't realize that Sig may not appreciate her ambition, and has alternative plans.

WATCH: Expect more IoT-related security threats in 2019

Expect more IoT-related security threats in 2019: Splunk
VIDEO2:3602:36
Expect more IoT-related security threats in 2019: Splunk