gameover zeus - pittsburgh indictment

8/12/2019 GameOver Zeus - Pittsburgh Indictment

1/25

Case 2:14-cr-00127-AJS Document 1 Filed 05/19/14 Page 1 of 25

IN THE UNITED STATES DSTRICT COURT

FOR THE WESTERN DSTRCT OF PENNSYLVANA

UNITED STATES OF AMERCA Crmna No /'-( zv

(8 U S C 37 343

030 (a) (2) , 030 (c) (2) (B)

EVGENY BOGACHEV344 57 (a) an 5 6 () (1) (B) )UER SEAL

IICTMENT

Th gran ury chargs

ntroucton

FILED

MAY 1 204

CLERK U.S DIRT OUR

WEST. DIS OF PENNSYLVAN

At a tms matra to ths Inctmnt unss

othrws ag

program

) Macous softwar

sgn to srupt

( "mawar ) s a softwar

computr opratons gathr

snstv nformaton gan accss to prvat computr systms

or o othr unwant acton on a computr systm Common

xamps of mawar ncu vruss worms Trojan horss

rootkts kyoggrs spywar an othrs

2) Kystrok oggng s th acton of rcorng (or

oggng) th kys struck on a kyboar Ths acton s usuay

on surrpttousy by a computr program ( kyoggr) to

captur th kys typ on a computr wthout th typsts

knowgMawar that uss kystrok oggng oftn w

prov th captur kystroks to th nvua who caus th

ma war to b nsta or to a pac sgnat by th

nvua Through kystrok oggng nvuas ar ab to

obtan onn bankng crntas as soon as th usr of th


2/25


nfct computr ogs nto thr account Aftr obtanng ths

nformaton ths nvuas can accss th vctms onn

bank account an xcut unauthorz ctronc funs transfrs

( "EFT ) such as Automat Carng Hous ( "ACH ) paymnts or

wr transfrs to accounts that thy contro

3) Wb njcts ntrouc (or njct) macous

computr co nto a vctms wb browsr wh th vctm

browss

ssson

th Intrnt an "hjacks th vctms Intrnt

Dffrnt njcts ar us for ffrnt purposs

Som wb njcts ar us to spay fas onn bankng pags

nto th vctms wb browsr to trck th vctm nto ntrng

onn bankng nformaton whch s thn captur by th

nvua mpoyng th wb njct

4) "Bot whch s short for "robot s a computr

that has bn nfct by mawar an os tasks at th

mawars rcton

1 Ectronc funs transfrs ( "EFT) ar th xchang an

transfr of mony through computr-bas systms usng thIntrnt ACH paymnts aow th ctronc transfrrng offuns from on bank account to anothr bank account wthn th

ACH ntwork wthout any papr mony changng hans Th ACH

ntwork s a ntwork of partcpatng postory fnanca

nsttutons across th Unt Stats an th ntwork provs

for ntrbankng carng of ctronc paymnts Bcaus ACH

paymnts rqur th ntwork to car th transacton th funs

ar not mmaty avaab Wr transfrs aso aow

ctronc transfrrng of funs from on bank account to

anothr bank account wthout any papr mony changng hans i

howvr unk ACH paymnts w transfrr funs armmaty avaab

2


3/25


) A "botnt is a ntwork of bots It is a

coction of bots that ar connct to ach othr an that can

communicat with ach othr through som ntwork architctur

6) Prtopr ntworking is an avanc

cntraiz ntworking architctur n comman an contro

ntworks computrs in th ntwork ar connct to a cntra

srvr Whn a computr wants to communicat with anothr

vic in th ntwork, it communicats with th cntra srvr

an th cntra srvr thn communicats with th othr vic

n pr-to-pr ntworks th computrs ar connct ircty

to othr computrs in th ntwork omputrs can communicat

with othr computrs in th ntwork without th us of a

cntraiz srvr.

7) Zus is mawar spcificay sign to automat

th thft of confintia prsona an financia information

such as onin banking crntias from infct computrs

through th us of kystrok ogging an wb incts.

8) Pr-toPr Zus aso known as GamOvr Zus

is a mor sophisticat variant of th Zus mawar that

utiizs prto-pr ntworking for its botnt. Pr-toPr

Zus was vop bas on th origina Zus co. Lik Zus

Prto-Pr Zus is spcificay sign to automat th thft

of confintia prsona an financia information through th

us of kystrok ogging an wb injcts

3


4/25


) "hhng a fraud technque ued by coputer

attacker n an attept to acqure entve nforaton uch a

uernae paword and other account credenta by endng

electronc a (eal) or other electronc councaton

whch faley ca to be fro an etabhed egtate entty

One type of phhng ea drect the uer to cck on a

hypernk n the ea By clckng th nk the vct

caue the ntaaton of aware wthout the vct' conent

or knowedge

0) The Natona Autoated Clearng Houe Aocaton

( "NACHA) anaged the deveopent adntraton and

governance of the ACH network Although NACHA not drectly

nvoved n ACH payent t provde the operatng rue of the

ACH network and overee the ACH network

) A "ue or "oney ue a peron who receved

toen fund nto ther bank account and then oved the oney

to other account or wthdrew the fund and tranported the

fund overea a ugged bulk cah

12) NC Bank wa a fnancal nttuton nured by

the Federa Depot Inurance Corporaton It wa engaged n

the bune of provdng the ean to do eectronc fund

tranfer

ennyvana

It wa headquartered n the Wetern Dtrct of

and offered onlne bankng ervce through

4


5/25


coputer erver ocated n the Wetern Dtrct of

ennyvana

3) Hayte Renforced atc wa a bune

ocated n the Wetern Dtrct of ennyvana

4) The defendant EVGENY BOGACHEV wa a redent

of Rua He wa an adntrator of the eertoeer Zeu

botnet

SCHEME AND ARTIFICE

5) Fro n and around Septeber 20 the exact date

beng unknown to the grand ury and contnung to the preent

n the Wetern Dtrct of ennyvana and eewhere the

defendant EVGENY BOGACHEV and coconprator known and

unknown to the grand ury dd deve and ntend to deve a

chee and artfce to defraud and to obtan oney and property

by ean of atera fae and frauduent pretene

repreentaton and proe by ung the unauthorzed

ntaaton of aware on vct coputer to tea or attept

to tea on of doar fro nuerou bank account n the

Unted State and eewhere and to tranfer the toen fund

overea

defendant

16) It wa a part of the chee and artfce that the

EVGENIY BOGACHEV and coconprator known and

unknown to the grand ury ent phhng ea through the

5


6/25


Internet that faey repreented to be egtate ea fro

egtate copane aocaton and organzaton

1) It wa further a part of the chee and artfce

that the defendant EVGENY BOGACHEV and coconprator known

and unknown to the grand jury created the phhng ea to

frauduenty nduce recpent to cck on a hypernk faey

repreented to be a egtate nk contanng bune or

perona nforaton when n truth and fact t ntaed

aware wthout the ea recpent' conent or knowedge


that the defendant EVGENIY BOGACHEV and coconprator known

and unknown to the grand jury wthout authorzaton ntaed

and caued the ntaaton of the eer-toeer Zeu aware on

Internet-connected vct coputer

) t wa further a part of the chee and artfce

that the eer-toeer Zeu aware wa degned to autoate the

theft of confdenta perona and fnanca nforaton uch

a onne bankng credenta The eer-toeer Zeu aware

factated the theft of confdenta perona and fnanca

nforaton by a nuber of ethod For exape the eerto-

eer Zeu aware ay obtan uch nforaton through keytroke

oggng Aternatvey the eertoeer Zeu aware ay aow

coputer ntruder to hjack a coputer eon and ue web

6


7/25


nect to preent a fake onne bankng webpage to trck a uer

nto enterng perona and fnanca nforaton



and unknown to the grand ury ued the eertoeer Zeu

aware on nfected coputer to capture the uer' confdenta

perona and fnanca nforaton uch a onne bankng

credenta by keytroke oggng or by h ackng the coputer

e on and preentng a web nect e fake onne bankng

webpage



and unknown to the grand ury ued the captured nforaton

wthout authorzaton to faey repreent to bank that the

Defendant and coconprator were vct or epoyee of

vct who have authorzaton to acce the vct' bank

account and to ake eectronc fund tranfer fro the

vct' bank account



and unknown to the grand ury ued the captured bankng

credenta to caue bank to ake unauthorzed wre tranfer

ACH payent or other eectronc fund tranfer fro the


8/25


victi' bank account without the knowedge or conent of the

account hoder

23) It wa further a part of the chee and artifice

that the defendant EVGENIY BOGACHEV and coconpirator known

and unknown to the grand ury ued oney ue to receive the

wire tranfer the ACH payent or other eectronic fund

tranfer fro the victi' bank account


that the defendant EVGENIY BOGACHEV and coconpirator known

and unknown to the grand ury ued the oney ue to further

tranfer the toen fund to utiatey reach the contro of the

Defendant and hi coconpirator overea


that on or about October 8 20, the defendant EVGENIY

BOGACHEV and coconpirator known and unknown to the grand

ury engaged in intertate and foreign wire counication over

the Internet by ending to an epoyee at Hayite Reinforced

Patic who wa ocated in the Wetern Ditrict of

Pennyvania a phihing eai which faey aeged that aid

counication originated fro NACHA and which frauduenty

induced the epoyee to cick on a aiciou hyperink faey

repreented to be a egitiate ink containing inforation

concerning a canceed ACH payent when in truth and fact it

intaed aware without the epoyee' conent or knowedge

8


9/25


26) t wa furter a part of te cee and artfce

tat on or about October 8 20 n te Wetern Dtrct of

ennylvana te defendant EVGENIY BOGAHEV and co

conprator known and unknown to te grand ury caued aware

to be ntaed wtout autorzaton on an Internet-connected

coputer ued by Hayte Renforced latc


tat on or about October 20 20 n te Wetern Dtrct of

ennylvana te defendant EVGENIY BOGAHEV and co-

conprator known and unknown to te grand ury ued te

ntalled aware to ack wtout autorzaton a coputer

eon of an epoyee at Hayte Renforced atc and to

nert wtout autorzaton a web nect e a fake onne

bankng webte n order to obtan te onne bankng

credenta of tree Hayte Renforced latc epoyee known

to te grand ury a NK S and AE


tat on or about October 20 20 te defendant VGENIY

BOGAHEV and coconprator known and unknown to te grand

ury ued te frauduenty obtaned onne bankng credenta

to faley repreent to N Bank tat Defendant and co

conprator were peron autorzed to acce te onlne

bankng account of Hayte Renforced atc and to caue or

9


10/25


attept to caue the tranfer of fund out of Hayte

Renforced atc' bank account antaned wth NC Bank


that on or about October 20 2011, n the Wetern Dtrct of

ennyvana the defendant EVGENIY BOGACHEV and co

conprator known and unknown to the grand jury frauduenty

caued the eectronc tranfer of $18234.3 fro a NC Bank

account beongng to Hayte Renforced atc to a oney

ue' bank account under the nae of Lynch Enterpre LLC and

antaned at SunTrut Bank n Atanta Georga


that on or about October 21 20 the defendant EVGENIY

BOGACHEV and coconprator known and unknown to the grand

jury ued the oney ue aocated wth Lynch Enterpre LLC

to execute the eectronc tranfer of the toen fund to bank

account ocated n Great Brtan

0


11/25


..

_ _ _ _. -

COU ONE

(Conspiracy)

The grad jury further charge:

31) aragraph 1 through 30 above of the troducto

ad Scheme ad Artfce are hereby reaeged ad corporated by

referece here a f fuy tated

32) From ad aroud September 2011, the exact date

beg ukow to the grad jury ad cotug to the preet

the Weter Dtrct of eyvaa ad eewhere the

defedat EVGENIY BOGACHEV kowgy ad wfuy dd

copre combe cofederate ad agree wth other pero

kow ad ukow to the grad jury to commt the foowg

offee agat the Uted State:

a) to tetoay acce a computer wthout

authorzato ad exceedg authorzato ad thereby obta

or attempt to obta formato from a protected computer

whch offee wa commtted furtherace of a crma act

voato of Tte 18 Uted State Code Secto 1343 ad

1344 ad wa commtted for the purpoe of prvate faca

ga voato of Tte 8 Uted State Code Secto

1030 a) (2) C) ad 103 0 c) (2) B) ;

b) to kowgy caue the tramo of a program

formato code ad commad ad a a reut of uch

coduct tetoay caue damage ad attempted to caue

damage wthout authorzato to a protected computer ad the

offee dd caue ad f competed woud have caued damage

1


12/25


affectng 0 or ore protected coputer durng a oneyear

perod n voaton of Tte 8 Unted State Code Secton

030 (a) (5) (A) and 030 (c) (4) (B) ;

(c)to deve and ntend to deve a chee and

artf ce to defraud bunee and ndvdual and to obtan

oney fro thee bune e' and ndvdual' bank account and

property that confdental peronal and fnancal

nforaton by ean of atera fale and fraudulent

pretene repreentaton and proe and for purpoe of

executng uch chee and artfce to trant and caue to be

trantted by ean of wre councaton n ntertate and

foregn coerce certan wrtng gn gnal and

pcture whch affected fnanca nttuton n volaton of

Ttle 8 Unted State Code Secton 343;

(d) to knowngy execute and attept to execute a

chee and artfce to defraud a fnanca nttuton and to

obtan any of the oney fund credt aet ecurte

and other property owned by and under the cutody and contro

of a fnancal nttuton by ean of ateral fae or

fraudulent pretene repreentaton and proe n volaton

of Tte 8 Unted State Code Secton 344; and

(e) to knowngly engage and attept to engage n

onetary tranacton affectng ntertate and foregn coerce

by and through a fnanca nttuton n crnaly derved

property of a value greater than $0000 ad property beng

12


13/25


derived from a specific unlawful activity that is an act that

is indictable under Title 18 United States Code Sections 1343

and 1344 as more particularly described in paragraphs 1 through

23 and paragraphs 25 through 29 knowing that the property

involved in the financial transactions represented the proceeds

of some form of unlawful activity in violation of Title 18

United States Code Section 1957 (a)

OVERT ACTS

33) In furtherance of the conspiracy and to effect

the objects of the conspiracy the defendant EVGENY BOGACHEV

and other persons both known and unknown to the grand jury did

commit and cause to be committed the following overt acts

among others

elsewhere:

in the Western District of Pennsylvania and

(a) On or about October 18 2011 the defendant and

co-conspirators sent to an employee at Haysite Reinforced

Plastics a phishing email purporting to be from NACHA and

fraudulently inducing the employee to click on a malicious

hyperlink which was falsely represented as a legitimate link

(b) On or about October 18 2011 the defendant and

co-conspirators

authorization

Plastics

caused

on a

malware to be installed without

computer used by Haysite Reinforced

13


14/25


c On or about October 20 2011 the defendant and

coconspirators used the maware to hijack a computer session of

an empoyee at Haysite Reinforced Pastics and inserted a fake

onine banking website

d On or about October 20 2011 the defendant and

coconspirators used the maware and the fake onine banking

website to request different empoyees at Haysite Reinforced

Pastics to enter their onine banking credentias

e On or about October 20 2011 the defendant and

coconspirators used the instaed maware to obtain the onine

banking credentias of three Haysite Reinforced Pastics

empoyees known to the grand jury as NK SC and A

f On or about October 20 2011 the defendant and

coconspirators used the frauduenty obtained onine banking

credentias to fasey represent to PNC Bank that defendant and

his coconspirators were authorized to access onine banking

accounts of Haysite Reinforced Pastics

g On or about October 20 2011 the defendant and

coconspirators caused or attempted to cause the transfer of

funds out of the Haysite Reinforced Pasics' bank accounts

maintained with PNC Bank

h On or about October 20 2011 the defendant and

coconspirators caused the transfer of $19 8234 93 from a PNC

Bank account beonging to Haysite Reinforced Pastics to a money

14


15/25


mues bank account under the name of Lynch Enterprises LLC that

was maintained at Sunrust Bank in Atanta Georgia

() On or about October 0 011 the defendant and

co-consprators caused the transfer of $175756 1 from a PNC

Bank account beongng to Hayste Reinforced Plastcs to a bank

account for a ewery store that was mantaned at Herad

Natona Bank n New York New York

() On or about October 1 011 the defendant and

co-consprators used a money mue to cause the transfer of

$8.00 whch was fraudulently obtaned from Hayste

Reinforced Pastcs and PNC Bank from a Sunrust Bank account

belongng to Lynch Enterprises LLC to a bank account located n

Great Brtain

(k) On or about October 1 011 the defendant and

co-conspirators used a money mule to cause the transfer

$88550 00 whch was frauduently obtaned from Haysite

Reinforced Plastcs and PNC Bank from a Sunrust Bank account

beonging to Lynch Enterprses LLC to a bank account located in

Great Britan.

n iolaton of itle 18 United States Code Secton

371

15


16/25


COU TO

(Wire Fraud)

he grand ury further charges:

34) aragraphs 1 through 33 aboe are hereby

realleged and incorporated by reference herein as if fully

stated

3) On or about October 18, 2011, in the estern

District of ennsylania and elsewhere the defendant EVGENIY

BOGACHEV for the purpose of executing and attempting to

execute the scheme and artifice to deraud and to obtain

property from others that is control of a computer and banking

credentials by means of material false and fraudulent

pretenses representations and promises well knowing at the

time that the pretenses representations and promises were

false and fraudulent when made as set orth aboe in aragraphs

1 through 1 and paragraphs 2 through 26 knowingly did

transmit and cause to be transmitted in interstate and foreign

commerce by means of a wire communication from the I address

188 121 144 240, which was then located in the Islamic Republic

of Iran to the I address 12 168 010, which was then located

in Erie ennsylania and belonged to Haysite Reinforced

lastics certain writings signs signals and pictures that

is a phishing email that falsely purported to be from NACHA

that falsely represented that an ACH paent had been canceled

and that falsely represented that a hyperlink within the email

16


17/25


wa a egiimae ink conaining informaion concerning a

canceed ACH paymen

n vioaion of Tie 18 Unied Sae Code, Secion

343


18/25


CO THREE

(Cmputer Frud)

The grand jury further charges:

36) Paragraphs 1 through 33 above are hereby

reaeged and incorporated by reference herein as if fuy

stated

37) On or about October 0 011 within the Western

District of Pennsyvania the defendant EVGENY BOGACHEV

intentionay accessed a computer beonging to Haysite

Reinforced Pastics without authorization and thereby obtained

information that is onine banking credentias of Haysite

Reinforced Pastics from empoyees known to the grand jury as

NK SC and AE from a protected computer and the offense was

committed for purpose of private financia gain and was

committed in furtherance of a crimina act in vioation of the

aws of the United States that is Tite 18 United States

Code Sections 1343 and 1344

n vioation of Tite 18 United States Code Sections

103 0 a) ) and 1 030 c) ) B) .

18


19/25


COTS FOUR THROUGH TWELVE

(Bank Fraud)

he grand ry frther charges:

38) aragraphs 1 throgh 33 above are hereby

reaeged and incorporated by reference heren as if fy

stated

39) n or abot the dates set forth beow in the

District of Western ennsyvania and esewhere the defendant

EVGENY BGACHEV having devised and intended to devise the

scheme and artfce to defrad NC Bank and to obtan moneys and

fnds owned by and nder the cstody and contro of NC Bank by

means of matera fase and fradent pretenses

representatons and promses we knowng at the tme that the

pretenses representatons and promises wod be and were fase

and fradent when made dd knowngy execte and attempt to

execte the foregong scheme and artifice by casng and

attemptng to case the transfer of fnds with each transfer

and attempted transfer being a separate cont of ths

ndictment as described beow

Count On or about Date Execution

he transfer of $98, 23493 ot of aNC Bank accont beonging to Hayste

Renforced astcs to an accont4 ctober 20, 2011 elonging to Lynch Enterprises LLC

he transfer of $175, 756 91 ot of a

NC Bank accont beongng to Haysite

ctober 20, 2011 Renforced astcs to an accont5 elongng to R&R Jeweers

ctober 20, 20 he attempted transfer of $39, 84 27

6 ot of a NC Bank accont beongng

19


20/25


to ayste Refored Pasts

Te attempted trasfer of $494 58

Otober 20 20 out of a PNC Bak aout beogg

7 to ayste Refored Pasts


out of a PNC Bak aout beogg

Otober 20 20 to ayste Refored Pasts8 Pasts




Te attempted trasfer of $4924



Te attempted trasfer of $4 975 2


to ayste Refored Pasts

Te attempted trasfer of $75 50Otober 20 20 out of a PNC Bak aout beogg


I voato of Tte 8 Uted States Code Seto

44

20


21/25


22/25


COT FOURTEEN

(Money Laundering)

Te grand ury furter carges

42) Paragraps troug 33 and paragraps 38 troug

3 above are ereby reaeged and incorporated by reference

erein as if fuy stated

43) On or about October 2 20 in te Western

District of Pennsyvania and esewere te defendant EVGENIY

BOGACHEV did knowingy engage in a monetary transaction

affecting interstate and foreign commerce in criminay derived

property wit a vaue greater tan $0000 wic property was

derived from specified unawfu activity in tat te defendant

EVGENIY BOGACHEV caused funds frauduenty obtained from

Haysite Reinforced Pastics and PNC Bank as carged in Count

Four in te amount of $88550 00 to be witdrawn and

transferred by wire from an account in te name of ync

Enterprises LLC maintained at SunTrust Bank to an account in

te name of an individua known to te grand ury as G A P

maintained at Nationa Westminster Bank PLC in London Great

Britain knowing tat te transaction invoved funds tat were

derived from a crimina offense wen in fact said funds were

derived from vioations of Tite 8 nited States Code Section

344

In vioation of Tite 8 nited States Code Sections

5 (a) and 5 6 (i) () (B)

22


23/25


.FORFEITURE ALLEGATIONS

44) The grand jury reaeges and incorporates y

reference the aegations contained in Counts One through

Fourteen of this ndictment for the purpose of aeging criminal

forfeiture pursuant to Tite 8 United States Code Sections

982 (a) () 982 (a) (2) (A) 982 (a) (2) (B) 982 (a) (4) and

98 (a) () (C) Tite 28 United States Code Section 24 (c) and

Tite 2 United States Code Section 853 (p)

45) As a resut of the commission of the vioations

charged in Counts One and Three the defendant EVGENY

BOGACHEV did acquire property that constitutes and is derived

from the proceeds otained directly and indirecty from such

vioation therey sujecting said property to forfeiture to the

United States of America pursuant to Tite 8 United States

Code Section 982 (a) (2) (B)


charged in Counts Four through Teve the defendant EVGENY

BOGACHEV did acquire property that constitutes and is derived

from the proceeds otained directly and indirectly from such

vioation therey sujecting said property to forfeiture to the

United States of America pursuant to Title 8 United States

Code Section 982 (a) (2) (A)


charged in Counts Thirteen through Fouteen the defendant

23


24/25


EVGENIY BOGACHEV did acquire property rea or persona that

was inoled in such iolation or was traceabe to such property

thereby sub ecting said property to forfeiture to the nited

States of America pursuant to Tite 18 nited States Code

Section 82 (a) (1)

48) As a result of the commission of the ioations

charged in Counts One and wo the defendant EVGENIY BOGACHEV

did acquire property that constitutes and is deried from the

proceeds obtained directy and indirectly from such ioation

thereby sub ecting said property to forfeiture to the nited

States of America pursuant to itle 18 nited States Code

Section 81 (a) (1) (C) and itle 28 nited States Code Section

2461 (c) .

4) If through any acts or omission by the defendant

EVGENIY BOGACHEV any or a of the property described in

paragraphs 44 to 48 aboe (hereinafter the "Subect Properties)

(a) Cannot be located upon the eercise of duediligence

(b) Has been transferred sold to or deposited with

a third person

(c) Has been paced beyond the urisdiction of the

Court

(d) Has been substantially diminished in alue or

(e) Has been comminged with other property whichcannot be subdiided without difficulty

24


25/25

States AttorneyNO 34524


the nted States ntends to seek forfeture of any other

property of the defendant up to the vaue of the Subect

Propertes forfetabe above pursuant to 28 S C Secton

2461 (c) whch ncorporates Tte 21 nted States Code

Secton 853 (p)

A True B

25

gameover zeus - pittsburgh indictment

Documents