KUALA LUMPUR - The founder and a partner of Perak-based SEA Gamer Mall, a digital game store, have been detained in Malaysia after being accused by the US Department of Justice (DOJ) for involvement in international hacking group APT-41.
They were arrested by a Malaysian police team at 8.45am on Monday (Sept 14) in the coastal Perak town of Sitiawan, after an extradition request from the US "for suspected money laundering activities and cyber crimes", a Malaysian police statement said on Thursday (Sept 17).
The extradition request was submitted by the US on Sept 3 and Malaysia's Attorney-General Chambers approved it in accordance with the Extradition Act 1992 between Malaysia and the US, the police statement said.
The police said the men were found "to be selling unauthorised/illegal gaming artefacts like credits. The forensics team has seized evidence and documents in relation to their company".
SEA Gamer Mall in a separate statement said the two men have been put on temporary leave, and that the company has been offering the authorities full cooperation in the matter.
The DOJ named the two Malaysian as Wong Ong Hua and Ling Yang Ching.
Malaysia's police chief Abdul Hamid Bador, earlier told The Straits Times that the arrests in Sitiawan were conducted under the Mutual Legal Assistance Treaty (MLAT).
He said: "The arrests are at the request of the US which uses the MLAT allocation to detect, arrest and extradite the suspects."
The treaty allows for law enforcement cooperation and assistance in a criminal investigation or proceeding.
"The two Malaysians are suspected of being involved in cyber espionage with the intention of 'stealing important data belonging to certain US companies'. They will undergo the court process to be extradited to the US," Tan Sri Abdul Hamid said.
The SEA Gamer Mall statement said: "We have been made aware of the American allegations against 2 employees of the company recently. The 2 employees concerned are temporarily on leave pending the resolution of the matter."
"As a responsible company serving millions of customers around the world we are committed to and have been offering full cooperation and assistance to the authorities," the statement added.
"Without compromising the integrity of any ongoing legal process, suffice to say that the company has never engaged in any illegal activity as we are a home-grown Malaysian company with hundreds of employees and millions of customers all around the world.
"SEA Gamer Mall will continue to take significant steps to manage the claims. Rest assured that the management of the company has the best interests of each and every customer at heart and we will continue giving our best services to our customers," it added.
The US DOJ report states that Wong, 46, and Ling, 32, were arrested on Sept 14 through cooperation with local enforcement authorities and are now facing extradition proceedings, along with five Chinese nationals.
They were alleged to be running global hacking operations for at least six years to steal identities and video game technology, plant ransomware, and spy on Hong Kong activists.
Three of the Chinese suspects operated out of Chengdu 404, a Sichuan-based company that purported to offer network security services for other businesses, AFP reported.
They hacked the computers of hundreds of companies and organisers around the world to collect identities, hijack systems for ransom, and remotely use thousands of computers to mine for cryptocurrency like bitcoin, AFP said.
The DOJ, in a second indictment in August, the DOJ charged Wong and Ling with 23 counts of racketeering, conspiracy, identity theft, aggravated identity theft, access device fraud, money laundering, violations of the Computer Fraud and Abuse Act, and falsely registering domain names, Malaysia's The Star online news reported.
Wong is the founder and chief executive office of SEA Gamer Mall, while Ling is listed as a partner and chief product officer, according to the company website.
"First, as the core of APT-41's computer hacking, the Chinese defendants targeted well over 100 victims worldwide in a variety of industries and sectors that are, sadly, part of the standard target list for Chinese hackers," said US Deputy Attorney-General Jeffrey Rosen in a statement.
"These criminal acts were turbo-charged by a sophisticated technique referred to as a 'supply chain attack', in which the Chinese hackers compromised software providers around the world, and modified the providers' code to install backdoors that enabled further hacks against the software providers' customers.
"Second, and as an additional method of making money, several of the Chinese defendants compromised the networks of video game companies worldwide (a billion-dollar industry) and defrauded them of in-game resources.
"Two of the Chinese defendants stand accused, with two Malaysian defendants, of selling those resources on the black market through their illicit website."
Gaming analytics company Newzoo reported that 20.1 million gamers in Malaysia spent US$673 million (S$917 million) on games in 2019, making it one of the biggest gaming markets in South-east Asia.
It stated that the majority of gamers spent money on in-game items or virtual goods, with the most common being power-ups or additional abilities for a game avatar.
SEA Gamer Mall was established in 2007 with offices in China, Thailand and Indonesia.
On its website, the company claimed that it has 1.9 million registered users and, in a 2017 news article, Wong was quoted as saying most of the website's sales came from prepaid top-up cards and online game virtual items.
