Police in Russia have reportedly arrested two cybercriminals accused of being behind an Android malware campaign that lifted funds from bank accounts used to top up smartphones.
News of the arrests comes from a blog post by Russian security firm Group-IB, which said it had aided Russian bank Sberbank, which first detected the fraud against its customers in late 2013.
According to the firm, two men in their twenties were earlier this year arrested in the city of Archangel by officers from the Russian Ministry of Internal Affairs. One suspect was placed under house arrest while the other was detained for two months, it said.
The attack seems to have been a variant on a common Russian scam in which the criminals send spam SMS messages promising a 'romantic gift' to mobiles with an embedded link that downloads a Trojan.
Normally in this type of scam the malware would simply send multiple premium-rate texts but the campaign described by Group-IB seems to have "recharged" the mobile from the linked bank account before attempting to transfer the money to other accounts or payment systems.
"At a request by Sberbank, Group-IB provided support to the investigations in all the stages. Our security incident response center CERT-GIB closely monitored and promptly blocked new malicious resources," said Group-IB CEO Ilya Sachkov.
"Computer hardware seized from the criminals during the arrest was sent to Group-IB's forensic lab for investigation and additional evidence."
The ringleader - nickname 'ItBill' or 'tripfon' - had started developing mobile malware in 2010, eventually building a mobile botnet, he added.
Despite the perception that the Russian authorities turn a blind eye to cybercrime, arrests are relatively common in the country, especially for suspects accused of attacking fellow Russians.
Police recently arrested two people apparently accused of being connected to the 'Oleg Pliss' attack on Apple iCloud accounts earlier this year. In October last year the hacker behind the infamous Blackhole Exploit Kit was also picked up by police, fate still unknown.