In its court filing in a Pennsylvania federal court on Thursday, the Justice Department said the suspects, from Russia, Ukraine, Bulgaria, and other European countries, used malware called GozNym to access the online banking credentials of their victims.

The hackers were said to have targeted 13 companies or organizations since 2016, including several U.S. law firms, a casino in Mississippi, and a church in Texas.

Gone Phishing

According to the indictment, the hackers sent phishing emails to employees at 13 businesses including an unidentified asphalt and paving company. In that case, an employee clicked on an e-mail attachment that looked like an invoice, but that instead linked to a page that the hackers used to download the malware onto a computer. Days later, the hackers started transferring more than $100,000 from the company’s bank account.

With most victims, the alleged hackers stole around $100,000 through multiple transfers. But in some cases, they siphoned off even larger amounts, like with a church in Texas that lost $217,440 in a single transfer, according to the Justice Department.

Counting the Losses?

Although the suspects tried to steal $100 million, some of the banks involved were able to stop the transfers before the money vanished or refunded the lost money. Still, the investigators said the hackers made off with millions of dollars, without providing an exact amount.

Five of the suspects indicted on Thursday have been arrested, the Justice Department said. The other five, all Russian citizens, remain at large.