据404 Media报道：中国犯罪集团入侵 Staples 客服系统伪造逾500万美元礼品卡 司法部称其网络涉逾1亿美元礼品卡
据科技媒体 404 Media 10月19日报道，一份近日解封的美国国土安全调查局（HSI）搜查令申请书披露，一个中国有组织犯罪集团曾入侵办公用品零售商 Staples 的内部客服系统，伪造签发逾1.5万张礼品卡、总面值超过500万美元，再用这些礼品卡在全美多家零售商处购买电子产品等商品，许多赃物其后被运回中国。法庭文件本身没有点名这家零售商，404 Media 依据其马萨诸塞州总部所在地、礼品卡由 Blackhawk Network 履约以及内部客服系统名称 Nexus 等线索，认定该公司为 Staples；Staples 未回应 404 Media 的置评请求。
文件称，HSI 于2023年10月获悉这一手法：入侵者从公司外部访问了本以为只能在内部电脑上使用的 Nexus 客服系统，通过多次堆转储（heap dump）请求取得系统内存数据，劫持已登录客服人员的会话，再以这些会话签发礼品卡并发送到自己控制的电子邮箱。调查人员统计，该集团共兑付了4,630张源自这次入侵的礼品卡、约42.5万美元：其中3,850张、约14.1万美元在两天内于18个州的85家 Target 门店被使用；Sephora 报告约330张、58,600美元经约1,500笔线上交易兑付；Lowe's 报告约450张、22.6万美元在线上与22个以上门店被兑付。
司法部新罕布什尔区联邦检察官办公室此前发布的案件材料显示，这只是该网络的一部分：位于中国的犯罪分子通过入侵美国公司系统、篡改实体礼品卡以及针对美国民众的婚恋与长者诈骗等多种手段，获取了总面值逾1亿美元的礼品卡，再经一个中国即时通讯平台把礼品卡数据以加密货币对价发给在美国的多个小组；这些小组用礼品卡购买以苹果产品为主的高价值电子产品，集中存入仓库后运往中国、香港或东南亚国家，并专挑新罕布什尔州等无销售税的州作案以抬高利润。
该办公室宣布，三名中国籍男子已因此在联邦法院被判刑：26岁、非法居住在 Nashua 的 Naxin Wu 被判33个月监禁，34岁、居住在 Nashua 的 Mengying Jiang 被判60个月监禁，28岁、非法居住在纽约 Brooklyn 的 Mingdong Chen 被判24个月监禁，三人另各判一年监督释放，此前均已承认一项合谋电汇欺诈罪，刑满后均面临被遣返回中国。检方称三人经手的欺诈礼品卡金额分别为140万美元、300万美元与40万美元。代理联邦检察官 Jay McCormack 表示，三人在把诈骗所得变现的环节中起了关键作用。此案由国土安全调查局、国税局刑事调查局、美国邮政检查局与 Concord 警察局调查，助理联邦检察官 Alexander S. Chen 起诉。
404 Media: Chinese Crime Ring Hacked Staples Support System to Mint Over $5M in Gift Cards; DOJ Says Wider Network Topped $100M in Gift Cards
A Chinese organized crime group hacked into office-supply retailer Staples' internal customer-service system and fraudulently issued more than 15,000 gift cards worth over $5 million, then used the cards to buy electronics and other goods at retailers across the United States, shipping much of the merchandise back to China, according to an October 19 report by technology outlet 404 Media based on a recently unsealed Homeland Security Investigations (HSI) search warrant application. The court filing does not name the retailer; 404 Media identified it as Staples through its Massachusetts headquarters, gift-card fulfillment by Blackhawk Network, and the name of its internal support system, Nexus. Staples did not respond to 404 Media's requests for comment.
According to the filing, HSI first learned of the scheme in October 2023. The intruders reached the Nexus support system from outside the company, although Staples believed it was accessible only from internal computers. Through repeated heap-dump requests, which capture the data held in an application's memory, they hijacked the logged-in sessions of customer-service representatives and used those sessions to issue gift cards to email accounts they controlled. Investigators counted 4,630 of the cards redeemed, worth about $425,000: some 3,850 cards worth about $141,000 were used at 85 Target stores in 18 states in just two days; Sephora reported about 330 cards worth $58,600 redeemed across roughly 1,500 online transactions; and Lowe's reported about 450 cards worth $226,000 redeemed online and at more than 22 locations.
Case materials previously released by the U.S. Attorney's Office for the District of New Hampshire show the Staples intrusion was one part of a much larger operation. Organized criminal elements in China acquired well over $100 million in gift cards by hacking U.S. companies, tampering with physical gift cards, and running romance and elder fraud schemes targeting U.S. citizens, prosecutors said. The card data was sent through a Chinese messaging platform, in exchange for cryptocurrency, to cells of Chinese nationals in the United States, who spent the cards mainly on Apple products and other high-value electronics, consolidated the goods in warehouses, and shipped them to China, Hong Kong, or countries in Southeast Asia. The cells favored states with no sales tax, such as New Hampshire, to maximize profits.
Three Chinese nationals have been sentenced in federal court in connection with the conspiracy, the U.S. Attorney's Office said. Naxin Wu, 26, unlawfully residing in Nashua, received 33 months in prison; Mengying Jiang, 34, of Nashua, received 60 months; and Mingdong Chen, 28, unlawfully residing in Brooklyn, New York, received 24 months. Each also received one year of supervised release, each had pleaded guilty to conspiracy to commit wire fraud, and each faces deportation to China after completing the sentence. Prosecutors put the fraudulent gift-card amounts handled by the three at $1.4 million, $3 million, and $400,000, respectively. Acting U.S. Attorney Jay McCormack said the defendants played a critical role in laundering the proceeds of romance and other online scams. The investigation was led by HSI, IRS Criminal Investigation, the U.S. Postal Inspection Service, and the Concord Police Department, and the case was prosecuted by Assistant U.S. Attorney Alexander S. Chen.
发布：GSM·美国（发布链接）
图片来源：美国一家 Staples 办公用品门店外景资料图。照片：Harrison Keely 摄，CC BY 4.0，经 Wikimedia Commons。 / A Staples office-supply store in the United States (file photo). Photo: Harrison Keely, CC BY 4.0, via Wikimedia Commons
GSM Global · 本篇英文版 English edition of this story
