Banking: Guilty plea in $3 million global bank fraud scheme that used Zeus Trojan

U.S. Attorney’s Office
Southern District of New York

PREET BHARARA, the United States Attorney for the Southern District of New York, announced that NIKOLAY GARIFULIN pled guilty today in Manhattan federal court to conspiracy to commit bank fraud and possess false identification documents for his role in a global bank fraud scheme that used hundreds of phony bank accounts to steal over $3 million from dozens of U.S. accounts that were compromised by malware attacks. GARIFULIN entered his guilty plea before United States Magistrate Judge FRANK MAAS.

GARIFULIN is the last of the 27 defendants arrested on federal charges over the course of the investigation to plead guilty to participating in this global bank fraud scheme. The investigation was conducted by the United States Attorney’s Office for the Southern District of New York, the New York County District Attorney’s Office, the Federal Bureau of Investigation, the New York City Police Department, the Department of State Diplomatic Security Service, the U.S. Immigrations and Customs Enforcement’s Homeland Security Investigations, and the United States Secret Service.

Manhattan U.S. Attorney PREET BHARARA said: “Computer hackers and bank fraudsters like those who authored and disseminated the ‘Zeus Trojan’ depend on criminal organizations such as the one dismantled in this investigation to move their ill-gotten gains from the United States to other countries. Today’s guilty plea, the 27th and final one, demonstrates that those who participate in these schemes will be caught, prosecuted, and punished for their crimes. I extend my deep appreciation to all of our law enforcement partners for their assistance in this unprecedented law enforcement action.”

According to the indictment, statements made in connection with the guilty plea, and other documents filed in Manhattan federal court:

The cyber-attacks involved in this bank fraud scheme began in Eastern Europe, and included the use of a malware known as the “Zeus Trojan.” It was typically sent as seemingly benign e-mail to computers at small businesses and municipalities in the United States. Once the e-mail was opened, the malware embedded itself in the victims' computers, and recorded their keystrokes—including their account numbers, passwords, and other vital security codes—as they logged into their bank accounts online. The hackers responsible for the malware then used the stolen account information to take over the victims' bank accounts, and made unauthorized transfers of thousands of dollars at a time to receiving accounts controlled by the co-conspirators.

These receiving accounts were set up by a “money mule organization” responsible for retrieving the proceeds of the malware attacks and transporting or transferring the stolen money overseas. To carry out the scheme, the money mule organization recruited individuals who had entered the United States on student visas, providing them with fake foreign passports, and instructing them to open false-name accounts at U.S. banks. Once these false-name accounts were successfully opened and received the stolen funds from the accounts compromised by the malware attacks, the “mules” were instructed to transfer the proceeds to other accounts, most of which were overseas, or to withdraw the proceeds and transport them overseas as smuggled bulk cash.

As part of the money mule organization, GARIFULIN collected fraudulently obtained proceeds that had been withdrawn by money mules from the phony accounts in the United States, and distributed them at the direction of the organization’s leader, including by transporting the proceeds back to Eastern Europe. GARIFULIN also arranged for fake passports to be transferred to mules in the United States from Eastern Europe.

GARIFULIN, 22, of Volgograd, Russia, will be sentenced by United States District Judge VICTOR MARRERO on January 13, 2012, at 4:00 p.m.. He faces a total maximum penalty of 45 years in prison on the conspiracy to commit bank fraud and conspiracy to possess false identification documents charges.

As a result of this investigation, charges were unveiled against 37 defendants in September 2010. Including Garifulin, 27 defendants have now pled guilty in the Southern District of New York, two defendants have entered into deferred prosecution agreements, and eight defendants are fugitives and are being sought in the United States and abroad.

In addition to GARIFULIN, two leaders of the mule organization have pled guilty and been sentenced:

• KASUM ADIGYUZELOV was sentenced on May 13, 2011, to 48 months in prison.
• DORIN CODREANU was sentenced on July 8, 2011, to 20 months in prison. Eighteen money mules have also pled guilty and been sentenced to date:
• LILIAN ADAM was sentenced on April 28, 2011, to time served after five months and 24 days in prison.
• KONSTANTIN AKOBIROV was sentenced on March 3, 2011, to eight months in prison.
• JAMAL BEYROUTI was sentenced on August 4, 2011, to 36 months in prison.
• NATALIA DEMINA was sentenced on December 23, 2010, to time served after four months and 12 days in prison.
• ALEXANDER FEDOROV was sentenced on January 5, 2011, to 10 months in prison.
• ADEL GATAULLIN was sentenced on February 16, 2011, to 15 months in prison.
• ILYA KARASEV was sentenced on June 24, 2011, to 10 months in prison.
• ALEXANDER KIREEV was sentenced on February 14, 2011, to 12 months and one day in prison.
• YULIA KLEPIKOVA was sentenced on March 17, 2011, to seven months in prison.
• MAXIM MIROSHNICHENKO was sentenced on February 28, 2011, to time served after four months and 29 days in prison.
• MARINA MISYURA was sentenced on May 25, 2011, to time served after seven months and 25 days in prison.
• VICTORIA OPINCA was sentenced on January 25, 2011, to time served after three months and 26 days in prison.
• MARGARITA PAKHMOVA was sentenced on April 5, 2011, to time served after six months and nine days in prison.
• STANISLAV RASTORGUEV was sentenced on July 11, 2011, to 12 months and one day in prison.
• DMITRY SAPRUNOV was sentenced on April 6, 2011, to time served after six months and two days in prison.
• JULIA SIDORENKO was sentenced on December 9, 2010, to time served after two months and nine days in prison.
• ALINA TURUTA was sentenced on February 25, 2011, to time served after four months and 26 days in prison.
• ANTON YUFERITSYN was sentenced on June 28, 2010, to 11 months in prison. Six other defendants have pled guilty and are awaiting sentencing:
• RUSLAN KOVTANYUK pled guilty January 7, 2011.
• SABINA RAFIKOVA pled guilty January 3, 2011.
• ALMIRA RAKHMATULINA pled guilty on September 25, 2011.
• ALEXANDER SOROKIN pled guilty on May 19, 2010.
• JULIA SHPIRKO pled guilty August 19, 2011.
• KRISTINA SVECHINSKAYA pled guilty November 19, 2010.

Mr. BHARARA thanked all of the law enforcement agencies involved in the investigation for their outstanding work. He also thanked Bank of America, TD Bank, JPMorgan Chase Bank, Wachovia, and HSBC Bank for their assistance in the investigation.

The investigation and prosecution of these cases is being overseen by the Office’s Complex Frauds Unit, which handles the Office’s cybercrime enforcement efforts. The cases are being prosecuted by Assistant U.S. Attorneys JOSEPH P. FACCIPONTI, ALEXANDER J. WILSON, SARAH LAI, JUSTIN ANDERSON, and ANDREW BAUER.