DOJ shuts down transnational cybercrime ring credited with over $530 million in losses

A federal indictment was unsealed today charging 36 individuals for their alleged roles in the Infraud Organization, an Internet-based cybercriminal enterprise engaged in the large-scale acquisition, sale, and dissemination of stolen identities, compromised debit and credit cards, personally identifiable information, financial and banking information, computer malware, and other contraband.

Following the return of a nine-count superseding indictment by a Las Vegas, Nevada, grand jury alleging racketeering conspiracy and other crimes, federal, state, local, and international law enforcement authorities arrested 13 defendants from the United States and six countries: Australia, the United Kingdom, France, Italy, Kosovo and Serbia.

Acting Assistant Attorney General John P. Cronan of the Justice Department’s Criminal Division, U.S. Attorney Dayle Elieson of the District of Nevada, and Acting Executive Associate Director Derek N. Benner of U.S. Immigration and Customs Enforcement’s Homeland Security Investigations (HSI) made the announcement.

“Today’s indictment and arrests mark one of the largest cyber fraud enterprise prosecutions ever undertaken by the Department of Justice,” said Acting Assistant Attorney General Cronan.  “As alleged in the indictment, Infraud operated like a business to facilitate cyberfraud on a global scale.  Its members allegedly caused more than $530 million in actual losses to consumers, businesses, and financial institutions alike—and it is alleged that the losses they intended to cause amounted to more than $2.2 billion.  The Department of Justice refuses to allow these cybercriminals to use the perceived anonymity of the Internet as a shield for their crimes.  We are committed to working closely with our international counterparts to identify, investigate, and bring to justice the perpetrators of these crimes, wherever in the world they operate.”

“The U.S. Attorney’s Office is steadfastly committed to protecting America’s national and economic security,” said U.S. Attorney Elieson. “Criminals cannot hide behind their computer screens. We are working vigilantly with American and international law enforcement partners to identify and disrupt transnational cybercrime organizations, such as the Infraud Organization.”

“Criminal cyber organizations like Infraud threaten not just U.S. citizens but people in every corner of the globe,” said HSI Acting Executive Associate Director Benner. “The actions of computer hackers and identity thieves not only harm countless innocent Americans, but the threat they pose to our financial system and global commerce cannot be overstated.  The criminals involved in such schemes may think they can escape detection by hiding behind their computer screens here and overseas, but as this case shows, cyberspace is not a refuge from justice.  HSI will continue working with our law enforcement partners in this country and around the world to aggressively target cyber thieves to ensure the perpetrators face the full weight of the law.”

According to the indictment, the Infraud Organization was created in October 2010 by Svyatoslav Bondarenko aka “Obnon,” aka “Rector,” aka “Helkern,” 34, of Ukraine, to promote and grow interest in the Infraud Organization as the premier destination for carding—purchasing retail items with counterfeit or stolen credit card information—on the Internet.  Under the slogan, “In Fraud We Trust,” the organization directed traffic and potential purchasers to the automated vending sites of its members, which served as online conduits to traffic in stolen means of identification, stolen financial and banking information, malware, and other illicit goods.  It also provided an escrow service to facilitate illicit digital currency transactions among its members and employed screening protocols that purported to ensure only high-quality vendors of stolen cards, personally identifiable information, and other contraband were permitted to advertise to members. 

According to the indictment, Infraud members held defined roles within the organization’s hierarchy.  “Administrators” managed day-to-day operation of and strategic planning for the organization, approved and monitored membership, and meted out punishments and rewards to members.  “Super Moderators” oversaw and administered specific subject-matter areas within their expertise.  “Moderators” moderated one or two specific sub-forums within their areas of subject-matter expertise.  “Vendors” sold illicit products and services to Infraud members.  Finally, “VIP Members” and “Members” used the Infraud forum to gather information and to facilitate their criminal activities.  As of March 2017, there were 10,901 registered members of the Infraud Organization. 

During the course of its seven-year history, the Infraud Organization inflicted approximately $2.2 billion in intended losses, and more than $530 million in actual losses, on a wide swath of financial institutions, merchants, and private individuals, and would have continued to do so for the foreseeable future if left unchecked. 

The defendants indicted for their alleged roles in the Infraud Organization’s transnational racketeering conspiracy include:

• Svyatoslav Bondarkeno of Ukraine;
• Amjad Ali aka “Amjad Ali Chaudary,” aka “RedruMZ,” aka “Amjad Chaudary,” 35, of Pakistan;
• Roland Patrick N’Djimbi Tchikaya aka “Darker,” aka “dark3r.cvv,” 37, of France;
• Miroslav Kovacevic aka “Goldjunge,” 32, of Serbia;
• Frederick Thomas aka “Mosto,” aka “1stunna,” aka “Bestssn,” 37, of Alabama;
• Osama Abdelhamed aka “MrShrnofr,” aka “DrOsama,” aka “DrOsama1,” 27, of Egypt;
• Besart Hoxha aka “Pizza,” 25, of Kosovo;
• Raihan Ahmed aka “Chan,” aka “Cyber Hacker,” aka “Mae Tony,” aka “Tony,” 26, of Bangladesh;
• Andrey Sergeevich Novak aka “Unicc,” aka “Faaxxx,” aka “Faxtrod” of the Russian Federation;
• Valerian Chiochiu aka “Onassis,” aka “Flagler,” aka “Socrate,” aka “Eclessiastes,” 28, of Moldova;
• John Doe #8 aka “Aimless88;”
• Gennaro Fioretti aka “DannyLogort,” aka “Genny Fioretti,” 56, of Italy;
• Edgar Rojas aka “Edgar Andres Viloria Rojas,” aka “Guapo,” aka “Guapo1988,” aka “Onlyshop,” 27, of Australia;
• John Telusma aka “John Westley Telusma,” aka “Peterelliot,” aka “Pete,” aka “Pette,” 33, of Brooklyn, New York;
• Rami Fawaz aka “Rami Imad Fawaz,” aka “Validshop,” aka “Th3d,” aka “Zatcher,” aka “Darkeyes,” 26, of Ivory Coast;
• Muhammad Shiraz aka “Moviestar,” aka “Leslie” of Pakistan;
• Jose Gamboa aka “Jose Gamboa-Soto,” aka “Rafael Garcia,” aka “Rafael101,” aka “Memberplex2006” aka “Knowledge,” 29, of Los Angeles, California;
• Alexey Klimenko aka “Grandhost,” 34, of Ukraine;
• Edward Lavoile aka “Eddie Lavoie,” aka “Skizo,” aka “Eddy Lavoile,” 29, of Canada;
• Anthony Nnamdi Okeakpu aka “Aslike1,” aka “Aslike,” aka “Moneymafia,” aka “Shilonng,” 29, of the United Kingdom;
• Pius Sushil Wilson aka “FDIC,” aka “TheRealGuru,” aka “TheRealGuruNYC,” aka “RealGuru,” aka “Po1son,” aka “1nfection,” aka “1nfected,” 31, of Flushing, New York;
• Muhammad Khan aka “CoolJ2,” aka “CoolJ,” aka “Secureroot,” aka “Secureroot1,” aka “Secureroot2,” aka “Mohammed Khan,” 41, of Pakistan;
• John Doe #7 aka “Muad’Dib;”
• John Doe #1 aka “Carlitos,” aka “TonyMontana;”
• David Jonathan Vargas aka “Cashmoneyinc,” aka “Avb,” aka “Poony,” aka “Renegade11,” aka “DvdSVrgs,” 33, of San Diego, California;
• John Doe #2;
• Marko Leopard aka “Leopardmk,” 28, of Macedonia;
• John Doe #4 aka “Best4Best,” aka “Wazo,” aka “Modmod,” aka “Alone1,” aka“Shadow,” aka “Banderas,” aka “Banadoura;”
• Liridon Musliu aka “Ccstore,” aka “Bowl,” aka “Hulk,” 26, of Kosovo;
• John Doe #5 aka “Deputat,” aka “Zo0mer;”
• Mena Mouries Abd El-Malak aka “Mina Morris,” aka “Source,” aka “Mena2341,” aka “MenaSex,” 34, of Egypt; and
• John Doe #6 aka “Goldenshop,”aka “Malov.”

In addition, Novak and “Goldenshop” are charged with three counts each and “Deputat” and Musliu one count each of possession of 15 or more counterfeit and unauthorized access devices.

The superseding indictment is the result of an investigation conducted by the Las Vegas Office of Homeland Security Investigations; the Henderson, Nevada, Police Department; the Criminal Division’s Organized Crime and Gang Section; and the U.S. Attorney’s Office for the District of Nevada.

The international operation to dismantle the Infraud Organization would have been impossible without the significant efforts and timely cooperation of the Justice Department’s Office of International Affairs and International Organized Crime Intelligence and Operations Center; Interpol Rome; Interpol Tirana; the Italian National Police (Postal and Communications Police); the Australian Federal Police  and the International Crime Cooperation Central Authority, Australian Government Attorney-General’s Department; the U.S. Diplomatic Security Service, Regional Security Office at U.S. Embassy Tirana, Albania; the City of London Police, DCPCU; the French Ministry of Justice, the Paris Prosecutor, L’Office Central de Lutte contre la Criminalité liée aux Technologies de l’Information et de la Communication; the judicial and police authorities of the Grand Duchy of Luxembourg; the Directorate for Organized Crime Investigation, Sector for Cyber Crime Investigation; the Basic Prosecution Office Pristina, Kosovo; and the Ministry of Justice of the Republic of Kosova, Department for International Legal Cooperation and the Special Prosecution Office for High-Tech Crime of the Republic of Serbia. 

The charges in the indictment are merely allegations, and the defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

Trial Attorneys Kelly Pearson and Chimaobim Nwachukwu of the Criminal Division’s Organized Crime and Gang Section and Assistant U.S. Attorney Chad W. McHenry of the District of Nevada are prosecuting the case.