Case Document 20-2 Filed 07/27/18 Page 1 of 32

Exhibit 4

Superseding Indictment (Dkt. United States v. edorov, CR1 

 





 

 

Case Document 20-2 Eiiled 07/27/18 A Page :2 01:32

Presented to the Court by the for?rnan of the
Grand Jury In open Court,1n the presence of ?1
the: Grand Jury and FILED in the U. S. .

DISTRICT COURT at Seattle, Washington 2 .
Jaguar? .25" 20 

 

UNITED STATES DISTRICT COURT FOR THE
WESTERN DISTRICT OF WASHINGTON
AT SEATTLE -

UNITED STATES OF AMERICA, . I 

Pla?n?ff 2 SUPERSEDING INDICTMENT 1
V.

VALERIEVICH FEDOROV,
aka ?hOtdIIna, 

 

Defendant. .

 

The Grand Jury charges that:
DEFINITIONS .
. 1. IP Address: An Internet Protecol address (or simply address?) 15 a

unique numeric. address uSed by devices, such as computers, on the Internet. An IP

address Is a series of four numbers, each In the range 0-255, separated by- periods gf ., 
. I104.250. 138. 210). Every device attached to the Internet must be assigned an IP address
. so that Internet traf?c sent from and directed togthat deyice may bee-directed properly

from its sourcelto its destination, Most Internet service providers control arrange of IP

addresses. 
Superseding Indictment/ United States Fedorov 5 UNITED STATES Arrow 7
No. 1 - 2700 STEWART 5220

- WASHINGTON 98101
. (206) 553-7970

 

 



 

 

Case Document 20-2 Filed 07/27/18 . Page 3 of 327 

2. Server: A server is a cemputer that provides services for other'computers 
connected to it via a network or the Internet. The Computers that use the server? services

are sometimes called ?clients. Servers can be physically located anvahere with a .

network connection that may be reached by the clients; for example, it is not uncommon .

for a server to be located hundreds (or even thousands) of miles away from the client
computers. A serVer may be either a physical or virtual machine. A physiCal server is a

piece of computer hardware con?gured as a server with its own power Source, central

7 processing unit/s and assoCiated software. A virtual server is typically one Of many

servers that Operate on a single physical server. Each virtual server shares the hardware 7
resources of the physical server but the data residing on each virtual server is Segregated .
from the data 011 Other Virtual servers that reside on the same physical machine

3. Malware: Malware IS malicious cemputer code running on a computer.
Relative to the owner/authorized user of that computer, malware 13 computer code that is
running 011 the system that 18 unauthorized and present on the system Without the user?- 
consent. MalvVare can be designed to do a variety of things, including logging every -

keystroke on a computer, stealing ?nancial information or ?user credentials? (passtOrds 

or commanding that cemputer to becomejpart of a network of ?rebot? or

?bot? computers known as a ?botnet. In addition, malware can be used to transmit data

from the infected computer to another destinatiOn on the Internet, as identi?ed by. an IP
address. Often times, these destination IP addresses are computers controlled by cyber
criminals. i A

The Carbanakmalware; "?Carbanak? is the name giVen by Computer

security researchers to a particular malicious software (malware) program Carbanak has . A

been uSed to remotely access computers without authorization. The Carbanak malware
allows an attacker to spy on another person?s computer and remotely control the 
computer. Carbanak can record .v1-deos of the victim? 3 computer screen and send the

recordings back to the attacker. It can also letthe attacker use the victim computer to

Superseding Indictment/ United States Fedorov 7 1 - i - - UNITED STATES ATTORNEY

No. CR18-OO4RSM700 STEWART STREET, SUITE 5220 

98101
(206)553-7970

 

 

\o GIL): 1? 

 

 

Case Document 20-2 Filed 07/27/18 Page4of32f

attack other computers, and to. steal ?les from the _victim'computer, and-install other
malware. All of thisacan'be done without the legitimate user?s knewledge or 'permiSSion

5. 7 Bot: A ?hot? computer is a computer that has been infected with some kind
of malicious software or code and 1s thereafter subject to control by someone other than
the true owner. The true owner of- the infected computer usually remains able to use the 
computer as he did before it was infected, although speed or performance may be 
compromised.? .. . 

. Botnet: A ?homet? 1s a network of comprOmised computers knoWn as
?bots? that are under the. control of a cybercriminal or ?bot herder. The bots are II
harnessed by the bot herder through the surreptitious installation of malware that provides
the bot herder with remote access to, and centrol of, the compromised computers. A
botnet may be used en maSSe, in a Coordinated fashion, to deliver a variety of Internet-

based attacks, including attacks, brute force password attacks, the transmission of i'

spam emails, the transmission cf phishing emails, and hosting communication networks

for cybercriminals g, acting as a proxy server fer email communications)

7. . Phishing: Phishing IS a criminal scheme in which the perpetrators use

mass email messages and/or fake websites to trick peOple into providing information such

as network credentials usernames and passwords) that may later be used to gain
access to a Vietim? systems. PhisIhing schemes often utilize social engineering 7.

techniques similar to traditional con-artist techniques 1n order to trick Victims into

believing they are providing their information to a trusted vendor, customer, or other

acquaintance. Phishing emails are also often used to trick a victim into clicking on 
documents or links that contain malicious software that will compromise the victim?s
computer System 

- 8. Spear Phishing: Spear phIishing IS a targeted form of phiShIing directed
towards a speCi?c individual, organization or business. Although often intended to steal
data for maliciOus purposes, cybercriminals may also use spear phishing schemes to I

install malware on a targeted uSer? 3 computer.

Superseding Indictment/ United States v. Fedora); ?i A I 715??me ?$011123; 
. . ART .
No CRIS 004RSM- 3 I . I I 
(206) 553-7970

 

KO- col-q as will: 




 

 

Case Document 20-2 Filed 07/27/18. Page 5 of 32

9. -. social Engineering: Sociallengineering is .a skill developed over time by? 
people who seek to acquire protected information through manipulation of social 1 .
relationships. People who are skilled in Social engineering can convince key individuals
to divulge protected information or access Credentials that the social engineer deems
valuable to the aChievement of his or her aims. I I

'10. PenuTesting: Penetration testing, or pen?testing, is the practice of testing a

7 computer system, network or computer application to ?nd vulnerabilities that an attacker I 

may exploit

COUNT 1_ 7
. (Conspiracy to Commit Wire and Bank Fraud)
1. -. OFFENSE 
11. The allegations set forth 1n Paragraphs 1 through 10 of this oSuper?seding-
Indictment ?are re-alleged and incorporated as if fully set forth herein. 
12. Beginning at a time unknown, but no later than september 2015, and

continuingithrough on or after January 17, 201-8, at Seattle, within the Western DistriCt of '1

Washington, and elsewhere, VALERIEVICH FEDOROV, aka- ?hotdima, 

- and others known and unknOwn to the Grand Jury, did knowingly and willfully combine,- - - .

conSpire, confederate and agree together to commit offenses against the United States, to
wit: . I I

I to knowingly and willfully devise and execute and attempt to I
execute, a Scheme. and arti?ce to defraud, and for obtaining money and property by

means of materially falSe and fraudulent pretenses, representation,s and promises; and in

executing and attempting to execute this scheme and arti?ce, to knowingly cause to be

transmitted in interstateand'fOreign commerce, by'means of Wire communication, certain

signs, signals and sounds as further described below, in violation of Title 18, United I
States Code, Section 1343knowingly and willfully devise and execute and attempt- to
execute, a scheme and arti?ce to defraud ?nancial institutions, as de?ned by Title 18

Superseding Indictment/ United States v. Federov 73313131) STASTES 
NoTEWART TREET, 1111's 
-8 OMRSM 4 . - . 98101
(206) 553-7970

 

 






 

 

Case Document20-2 Filed 07/27/18 Page '6 of 32

United States Code, Section 20, and to obtain moneys, funds, and credits under the
custody and control of the ?nancial institutions by means of materially false and 3
fraudulent pretenses, representations, and premises, in Violation of Title 18, United States 8
Code, Section 1344(1) and (2) 
II. OBJECTIVES OF THE CONSPIRACY

l3, Defendant VALERIEVICH EDOROV and others known and
unknown to the Grand Jury, were part of a ?nancially motivated cybercriminal I
conspiracy known variously as IN 7 the Carbanak Group, and the Navigator Group I
(referred to herein as FIN7 consists of a group of criminal actors engaged 111 a
sophisticated malware campaign targeting the computer Systems of busineSSes, primarily
in the restaurant, gaming, and hespitality industries, among others. - 1'

14. The objectives of the conspiracy included hacking- into protected computer
networks Using malicious software (hereinafter, ?malware?) designed to provide the
conspiratorswith unauthorized access to, and control of, Iv10t1m computer systems. The
objectives of the conspiracy further included conducting surveillance of victim computer 

networks and installing additional malwar?e on victim computer for the purpose

. of establishing perSistencIe, stealing meney and property, including payment card 

credit and debit) track data, ?nancial information, and proprietary and non-public 
information, The objectives of the conSpiracy further included using and selling the

stolen data and information for ?nancial gain in Ia variety of ways, including, but not

I limited to, using stolen payment card data to cenduct fraudulent transactions across the

United States and 1n foreign countries.

In. MANNER AND MEANS OF THE CONSPIRACY

15. The manner and means used to accomplish the conspiracy included the
following: I

Ia; IN 7 developed and employed various malware designed to

in?ltrate, comprOmise, and gain control of the computer systems of victim companies

7 operating in the United States and elsewhere, including within the Western of

Superseding Indictment] United States Peder-0v . - I UNTTED STATES ATTORNEY
I I I - 700 STEWART STREET, SUITE 5220 .

- 

(206) 553-7970

 

 




 

 

Case Document 20-2 Filed 07/27/18 Page 7 of 32 .

WashingtOn, FIN 7 established and operated an? infrastructure cf servers, 10cated in. 
various countries, through WhiCh FIN7 members coordinated-activity to further the

scheme. This infrastruCture included, but was not limited to, the use of command and

control servers, accessed through Custom botnet Control panels, that communiCated-With I 

and controlled compromiSed computer systems of victim companies

b. FIN7 created a front cOmpany doing business as Combi Security to 

legitimate. COmbi Security purports to operate as a computer security pen-testing .

cempany based in Moscow, Russia and Haifa, Israel. As part of advertisements and it

public internet pages for Gombi Security, IN7 portrayed Combi Security as a legitimate . 
penetration testing enterprise that hired itself out to businesses for the purpose of testing 

their computer security systems.

c. Under the guise of a legitimate computer security company, FIN 7

. doing business as Combi Security, recruited individuals With computer programming

skills, falsely claiming that the prospective employees would be engaged in legitimate - 
pen-testing of client computer networks. In truth and in fact, as Defendant and his FIN7

co-conspirators well knew, Combi Security was a front company used to hire and deploy

hackers who were given tasks in furtherance of the FIN7 conspiracy._

d. . FIN7 targeted victims in the Western District of Washington and
elsewhere, using phiShing techniques to distribute malware designed to gain unauthorized
access to, take control of, and exI?ltr?a?te data from the computer systems of variOus' I
businesses. FIN 7 targeted Victims include more than 120 identi?ed companies, With 

thousands 0f individual lecations' of operation throughout the United States, including,

- but not limited to, the folloWing representative Victim companies:

i. ?Victim- 1? referenced herein is the Emerald Queen Hotel and

Casino (EQC), a hotel and casino owned and operated by a federally recognized Native 7

American Tribe with locations in Pierce County, within the Western District of 

_Washington. 
Supersediug Indictment! United States v. Fedorov . 1: UNITED STATES ATTORNEY
No. CR18-OO4RSM 6 7 I - 700 STEWART STREET, SUITE 5220

Same, WASHINGTON 98101 

(206) 55347970

 

 

boosioxm-awmi?e



 

 

Case Document 20-2 FiledWO7/2-7/18 Pages-0132? 

ii. - ?Victim-2? referenced herein is? a,

public corporation headquartered 1n Seattle, within the Western District of Wasbiogton, ., I

with operations throughout the United States and elsewhere?I?Victim- 3? referenced herein 1s Chipotle Mexican Grill, 3

U. S. ~based restaurant chain with thousands of locations 1n the United States, ineluding 1n 1

the Western District of Washington, and 1n Canada and multiple European countries.

iv- I ?V1ct1m 4? referenced herein is? a U. S. i 
based pizza parlor chain with hundreds of locations predominantly 1n the Western United
States, including 1n the Western District of Washington?Victim?5? referenced herein 1s a S. -based
federally insured credit union headquartered in the Western District of washingtoo.
vi. ?Victim- 6? referenced herein 1s Jason.? Deli, a U. S. ~based
casual delicatessen restaurant chain with hundreds of locations 111 the United States. I
I vii. ?Victim- 7? referenced herein is- an autOmotive 
retail and repair chain with hundreds of locations 1n the United States, including 111 the
Western District of Washington i . I
- ?Victiin? 8? referenced herein 1s Red Robin Gourmet Burgers I I:
and Brews (Red Robin), a U. S. ~based casual dining restaurant chain, founded in the I
Western District of Washington, with hundreds of locations 1n the United States, 
including 1n the Western District of washington.
ix. . ?Victini- 9? referenced herein IS Sonic Drive-in (Sonic), a
U. S. -based drive?in- fast-food chain with thousands of locations 1n the United States,
including in the Western District of Washington. I
x. I ?Victim- 10? referenced herein is Taco John?s, a U. S. -based
fast-food restaurant chain with hundreds (if locations 1n the United States, 1nclud1ng 1n the
Western District of Washington. . A.
e. FIN 7 typically initiated its attacks by delivering, directly and

. through intermediaries, a phishing email with an attached malicious ?le, using wires 1n

Superseding Indictment/ United States v. Fedorov . . aI: UNITED STATES -

No. CR18-004RSM - 7 . 700 STEWART STREET, SUITE 5220 I

98101 
(206) 553-7970 -

 

 



 

 

ICaIse Document 20-2 Filed 07/27/18 Page 9 of 32

interstate and foreign commerce, toan employee of the targeted victimcompany. The

attached malicious ?le usually was a Micrdsoft Word (,doc or .d'ocx) or Rich Text File .- i

(. rtf) doCUment with embedded malware. FIN7 useda variety of malware deliyeryj
mechanisms in its phishing attacMentIs including, but not limited to, Weaponized

Microsoft Word macros, malicious Object Linking and Embedding (OLE) objects,-

malicious visual basic scripts I0r avaScript, and malicious embedded shortcut 
?les). In Some instances, the phishing email or attached ?le contained a link to malware . 
hosted on servers controlled by FIN7, - The phishing .,email through false representations"
and pretenses, fraudulently induced the victim company employee to open the attachment

or click on the link to' activate the malware. For example, when targeting a hotel chain,

the purported sender of the phishing email might falsely claimto be interested in making -
a hotel reservation Byway of ?irther eitample, when targeting a restaurant chain, the

purported sender of the phishing email might falsely claim to be interested in placing a

catering order or making a complaint about prior food service at the restaurant.

f. In certain phishing attacks, FIN7, directly and through 
intermediaries, sent phishing emails to personnel at victim companies who had unique 

access to internal proprietary and hen?public company informatiOn, includinglimited to, employees inVolveId with making ?lings with the United and 7

Exchange Commis'sion These emails used an email address that spoofed an
email address associated with the 3 electronic ?ling System, and. induced the
recipients to activate the maIWare contained in the emails attachmentsmany of the FIN7 attacks, a FIN7 member, or someone hired by
FIN7 speci?cally for such purpose, would also call the victim company, using Wires in 
interstate or foreign commerce, to legitimize the phishing email and convince the victim
company employee to open the attached document using social?engineering techriidues. I -
For example,- when targeting a hotel chain or a restaurant chain, a conspirator Would
make a follow-up call falsely claiming that the details of a reservation request, catering-I
order, er customer Complaint could be found in the ?le attached to the previously ?3

Indictment United States v. Fedorov UNIT-ED STATES ATTORNEY

No. 004RSM- 8 i . I 70.0 STEWART Smear, Suns 5220 - 7

SEATTLE, WASHINGTON 98101
(206) 553-7970

 

 

 co \1 <31- 1?







 

 

Case Document 202 Filed 07/27/18 Page-1010f: 32

delivered email, to induce the employee at the victim company to read the phishing
email, open the attached ?le, and activate the malware. . I
I If the recipient activated the phishing email attachment or clicked on
the link, the recipient wouldIunWittingly activate. the malware, and the computer on 
which it was opened would become infected and connect to one or more command and II
control servers contrOlle'd by FIN 7 to report details of the newly infected computer, and I
doWnload additional malware. The command andcontrol infrastructure relied upon -
variOus servers in multiple countries, including, but not limited to, the United States,
typically leased using false information, such as alias names and fictitious information.

IN7 typically would install additional malware, including the

CarbanakI malware, to connect to additional FIN 7 Command and control servers to

establish remote control of the victim computer.

j. I Once a victim?s computer was compromised, FIN7 would

incorporate the compromised machine or ?_I?bot? into. a botnet.
FIN7 designed and used a custom botnet control panel to manage 

and issue commands to the compromised machines. 1 I

l. Once a victim company?s computers were incorporated into the
FIN7 botnet and remotely controlled by malware, the group used this remote .
control and access to, among other things, install and manage additiOnal malware,II_
conduct surveillance, map and navigate the compromised computer netWOrk, compromise
additional computers, ex?ltrate ?les, and send and receive data. For instance, FIN7 often
conducted surveillance on the victim? 3 computer network by, among other things,

capturing screen shots and videos of victim computer Workstations that provided the

conspirators with additional information about the victim company computer network

and non-public credentials for both generic company IacCounts and for actual company 

empIOyees.

- 1n. FIN7 used its access tothe victim?s computer network and

information gleaned from surveillance of the victim?s computer systems to install -

Superseding Indictment/ United States v. Fedorov - I 1 UNITED ISTATEIS ATTORNEY
No. CR18-OO4RSM 9 . 1 700 STEWART STREET, 3011155220

SEATTLE, WASHINGTON 98101 
(206) 553-7970

 

 



including ?nancial inStitutions as de?ned in Title 18, United States Code, Section 20.

 

 

Case Document 20-2 Filed 07/27/18 Page 11 of 32

I additional malware designed to target and extract particular information and property of

value, including payment Card data and proprietary and lien-public information. For
instance, FIN 7 often utilized various ?off-the-shelt? software and custom malware, and a 
combination thereof, to extract and transfer data to a ?loot? folder on one or mere servers
controlled by FIN7. 7' i 7

n. FIN7 frequently targeted victim companies With customers who use
payment cards while making legitimate point-'ofesale purchases, such as victim 
companies in the restaurant, gaming, and hospitality industries. In those. cases, FIN-7 
Con?gured malware to extract, copy, and compile the payment card data, and then to
transmit the data from the victim Computer systems to servers controlled by FIN7.

7 o. i For example, between approximately March 24, 2017, and April 18,
2017, FIN7 harvested payment card data from point?of?sale devices at certain Victim-3
restaurant locations, including dozens of locations 1n the Western District of Washington.

- p. FIN 7 stole millions of payment card numbers, many of which have
been offered for sale through vending sites, including, but not limited to, Jokers StaSh,i
thereby attempting to generate millions of dollars of illicit pro?ts.

q. . The payment Card data were offered for sale to alloW purchasers to
falsely represent themselves as authorized users of the stolen payment cards and to use
the stolen payment card information to purchase goods and services in fraudulent -.
transactions throughout the United States and the world, including over the Internet,

reSulting in milliOns of dollars 1n losses to, and thereby affecting, merchants and banks,

For example, on or abOut March 10,2017, stolen payment card data related to accounts . i

1 held at Victim-5, a ?nancial institution headquartered 1n the Western District of

Washington, compromised through the computer network intruSion of a victim cempany,

Was used to make unauthorized purchases at a merchant in Puyallup, Washington. 

Superseding Indictment] United States v. Fedorov -- . . - . UNTFED STATES ATTORNEY I
No. 004RSM700375me STREET, $0112 5220

SEATTLE, wxsmeros 98101 
(206) 553-7970

 

 






 

 

Case Document 20-2. Page'12 of 32 I,

.. r. FIN7. members employed varioustechniques to Conceal their 
identities, including simu'ltaneouSly utilizing various leased Servers, ii that had been leased .-
using false subscriber information, in multiple countries. 
s. . FIN7 member, co?conspirator F. H., served as a high-level systems

administratOr for FIN 7 who maintained servers and communication channels used by the

organization. For example, FIN7 members requested co?-Conspirator F. H. to grant them -- ?1

access to servers used by FIN7 to facilitate the malware scheme. Co conspirator F. 
also played a management role in the scheme by delegating tasks and by providing
instruction to other members of the scheme. .

FIN7 members typically communicated With one another and others

through private communication channels to further their malicious activity. Mong other

channels, 1N7 conspirators communicated using Jabber, an instant messaging service

that allows members to cominunicate across multiple platforms and that supports end-Ito-

end 

11. For example, in Jabber communicatiOns With other FIN 7 members,

VALERIEVICH FEDOROV, using his alias ?hotdima,? referenced using - I

malware 1n connection With seVeral speci?c victim companies, discussed using the 
administratiVe control panels to receive data from compromised computers, and 
identi?ed several pen-testers working at his direction.- 7

v. I I FIN7 members often communicated through a private HipChatI
server. HipChat 1s a group chat, instant messaging, and ?le-sharing program. FIN 7 I
members used its HipChat server to collaborate on malware and victim business - 

intrusiOns, to interview potential recruits, and to upload and share ex?ltrated data,- such as 7

- stolen payment card data. As a syStemI administrator, co-conspirator F. H. created

- I HipChat user accounts for FIN7 members that allowed them to access the server.

W. Co?conspirator F. H. also created and participated 1n multiple

HipChat _?rooms? with other FIN7 members and partiCipated 1n the uploading and

organization of Stolen payment card data and malware. For example, on or about March

Superseding United States Fedorov 1 UNITED STATES ATTORNEY I - 13?.
No. 11 . I 700 STEWART STREET, SUITE 5220 2:

SEATTLE, WASHINGTON 98101 -
(206) 553-7970" . 

 

 

 

 

Case Document 20-2 Filed 07/27/18 Page 13?0f 32 I.

14, 2016, co-conspirator F. H. uploaded an archive that contained numerous data ?les -

created by malware designed to steal data from point-of-sale systems that process . 

. payment cards. The ?les contained payment card numbers stolen from a victim company-

that had publicly reported a secmity breach that reSulted 1n the compromise of tens of

thousands of payment cards. By way of further example, co-conspirator F. H. also set up
and used a HipChat room titled ?MyF11e?in which he was-the only participant, and to
which he Uploaded malware used by IN7 and stolen payment Card information. I

x. FIN7 conspirators used numerous email hosted by a varietyII . II
of providers 1n the United States Iand elsewhere, Which they often regiStered using false
subscriber information.

y. I, FIN 7' conspirators frequently. used the project management software 7 I
JIRA, hosted an private virtual servers in various countries, to coordinate their malicious -I

activity and to manage the assorted network intrusions. IN7 members'typieally-created - I.

a ?project? and then associated ?issues? with the project, each 1ssue akin to an. isSue 7

directory or folder, for a victim company, which they used to collaborate and share
details of the intrusion, to post victim company intelligence, such as network mapping
information, and Ito store and Share exfiltrated data. 7 I

2.- For example, on about September 7, 2016, co-conspirator F. 

created an ?issue? for Victim-6, to which FIN7 conspirators posted ?les containing

internal credentials for the victim company?s compUter network.

aa. By way (if further example, on multiple occasions in January 2017
VALERIEVICH FEDOROV and others posted to the FIN 7 ?issue? created
for Victim-7, information about the Victim company? 3 internal netWOrk and uploaded

ex?ltrated data, including stolen employee credentials. Similarly, on or about April 5,
2017, VALERIEVICH FEDORIOV created an ?issue? for another victim

company, Victim-9, and uploaded stolen user credentials from the Vietim company.

bb.? FIN7 censpirators knew that the scheme would involve the use of
wires in both interstate and foreign commerce Ito accomplish the objectives of the

Superseding Indictment/ United States v. Fedorov 1 UNITED STATES ATTORNEY

No. CR18-004RSML 12 I I I I I 700 STEWART STREET, Sons 5220 - -

Seams, WASHINGTON 98101
553- 7970

 






 

 

Case 1 Document 20-2 Filed 07/27/18 Page 14 of 32

scheme. For example, the Defendant and his FIN7 cO~Conspirators knew that execution
of the scheme necessarily caused the transmission cf wire communications between the
United States and one or more servers controlled by IN 7 located 1n fereign countries. I
All 1n violation of Title 18, United States Code, Section 1349. I I
COUNTS 2- 15
(Wire Fraud) . 
I 16. The allegations set forth 1n Paragraphs 1 through 15 of this Supersedmg

Indictment are re-allege'd and incorporated as if ?Jlly set forth herein. 9

- SCHEME AND ARTIFICE TO DEFRAUD
17. Beg-inning at a time unknown, but no later than September 2015, and 

continuing through on or after January 17,2018, at Seattle, within the Western 8' 
Washington, and elsewhere, VALERIEVICH FEDOROV, and others known 8'
and unknown to the Grand Jury, devised and intended to devise a scheme and arti?ce to I i
defraud and to obtain money and property by means of materially false and fraudulent
pretenses, representations and promises.- 1 i

18. The esseHCe cf the scheme and arti?ce to defraud was to obtain
unauthorized access into, and control cf, the cemputer networks of victims through deceit
and materially false and fraudulent pretenses and representations, through the installation

and use of malware designed to facilitate, among other things, the installation cf

. additional malware, the sending and receiving of data, and the surveillance of the

victims? computer networks. The object of the scheme and arti?ce to defraud was to

steal money and property of value, including payment card data and proprietary and non- -

public information, which was, and could have been, sold and used for ?nancial gain.

II. . MANNER AND MEANS OF SCHEME TO DEFRAUD

l9. The manner and meansof the sCheme and arti?ce to defraud are set forth in - i 

Paragraph 15 of :Count 1 of this 

superseding Indictment United States v. Fedorov I UNITED STATES ATTORNEY
N0.CR18- l3 700 STEWART STREET, SUITE 5220 
- Seam,- WASHINGTON 98101? -

(206) 553?7970"

 

 

\oeoqoa'cnnvumha

Ch -b U) h?i 


oeuoxm-th-Ho




 

 

Case Document 20-2 Filed 07/27/18 Page 15 of 32

EXECUTIONOFSCHEMETODEFRAUD ?i i i.

20. On or about the dates set forth below, within the Western District of 7
Washington, and elsewhere, VALERIEVICH FEDOROV, and others known i 
and unknown to the Grand Jury, having devised a scheme and arti?ce to defraud, and to

obtain money and property by means of materially false and fraudulent pretenses,

representations, and promises, did knowingly transmit and cause to be transmitted

writings, ?signs, signals, pictures, and sounds, for the purpose of executing such-Scheme,-

by means of wire communication in interstate and foreign Commerce, including the

following transmissions:

 

2 August .8, 2016

 

Victim-1 A

Pierce County

. i Emall from Just etravel@y oocom

which traveled through a server
located outside the State. of

Washington, to a Victim-l employee, i .

located within the State of
Washington

 

,3 - August 8, 20-16

Victim-1 
Pierce County

7 Email from frankj Ohnson@revital?_
travel. com, Which traveled through a .. 1

_Washington, to a Victim-1 employee,

serVer located outside the State of

located Within the State of
Washington

 

41 August 8, 92016

Victim-?1-

Pierce County 

Electronic communication between a

Server located outside the State of

Washington, and Victim-1? computer 7 7'
System, located within the State of 7?

Washington

 

 

 

- 5 February21, 2017

 

Victim-2
Seattle

through a server located outside the 

 

Email purporting to be from a_ 7 .
government account, which traveled

State of washington, to a Victim-2

employee, located Within the State of 

 

Washington

 

superseding Indictment! United States v. Fedorov

004RSM- 14

UNITED STATES ATTORNEY
. 700. STEWART STREET, Sums 5220
WASHINGTON 98101 
(206) 553-7970

 




ooqumnwquxeooqaaELTqEZE

Case Document 20-2 Filed 07/27/18 Page 16 of 32-.

 

 
 

Victim-2 .

 

server IOCated outside the State of

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

6 February 23, 2017 Seattle Washington, and Victim-2? 3 computer
9 - system, located within the State of
Washington 
- Electronic communication between a
I . Victim-3 - th 
I . 4120 196th St SW server, located outside State 0 
7 March 24, 2017. . Washington, and Victim-3? computer
1 Suite 150,
.. wood system, located Within the State ofI
Washington 7
- Electronic communication between a
. . Victim-3 server, located outside the State of
8 7 March 25, 2017 -.1415 Broadway, Washington, and Victim-3? 5 computer
Seattle system, located Within the State of
Washington
I 1 1 Electronic communication between a
I I . 1 - Victim-'3 server, located outside the State of
9? March 25, 2017 - 800 156th Ave NE, Washington, and Victim-3? 3 computer
- 'BelleVue system, located Within the State of
Washington 1
1 . Electronic communication between a-
I I Victim?3 I server, located outside the State of
10 March 25, 2017 4 Bellis Fair Pkwy, Washington, and Victim?3? 5 computer
Bellingham system, located within the State of
- washington
. . Electronic. communication between a
. Vlctim-3? 
I I 775 Gilman' server, lecat'ed Outside the State of
11 March 25, 2017 - 7 . Washington, and Victim-3? 3 computer --
. Blvd, Suite A, - --
Is?saquah system, located within the State of .-
. Washington 1 .
Vic 11111-3 1 Electronic communication between a I
I I 515 SE Everett . server, located outside the State of 
12 - March 27, 2017 7 7 . Washington, and Victim-3?s computer
. . MallIWay, Suite B,
1 - system, located Within the State of
verett
I .- . Washington
. - Electronic communication between a
,1 V1et1m-3
. .. I . I 22704 SE 4th 1 server, located outSide the State of 
13 IApnl 11-, 2017 .- I - Su1te210 Washington, and Victim-3? camputer I 
- IS system, located Within the State of
ammamiSh .
. .I Washington
Superseding Indictment-l United States v. FedorOVi A I UNITED STATES 

No. CR18-004RSM-15

700? STEWART STREET, SUITE 5220

Seam, WASHINGTON 9810.1 . . . 

(206) 55317970

 

 






 

 

Case Document 20-2 Filed 07/27/18 Page 17 of 32

    

Emal] from .

Victim-4 employee, located Within the
State of Washington 

Electronic communication between a

merchant, located within the State of-

 

 

 

 

 

 

 

15 7 March 10, 2017 E?g?ks i 7 A Washington, and a payment processor 
- - pup I - server, located outside the State of
Washington_
All 1n violation of Title 18, United States Code, Seetion 1343.
COUNT 16

(Conspiracy to Commit Computer Hacking)
21. . The allegations set forth in Paragraphs 1 through 20- of this Superseding
Indictment are re?alleged and incorpOrated. as if fully set forth herein. 7

I. OFFENSE

22. . Beginning at a time unknown, but no later than Septemher 2015, and
continuing through on or after January 17, 2018, at Seattle, Within the Western of
Washington, and elsewhere, VALERIEVICH FEDOROV, and others known
and unknown to the Grand Jury, did knoWingly and willfully combine, conspire, 

cOnfederate and agree together to commit offenses against the United States, to Wit:

. i Oliver_palmer@yahoo. com, which
- - - Victim-4 traveled through a server located 
14 - . 4 .
April 11? 2017 Renton - outside the State of Washington, toa - 

a. to knowingly and with intent to defraud, access a protected computer 

without authorization and exceed authorized access to a protected computer, and by. 

means of such conduct further the intended fraud and obtain anything of value exceeding

000. 00 111 any l-year period, in violation of Title 18, United States Code, Sections

1030(a)(4) and and

h. . to knowingly cause the transmission of a program, inforrnatiOn,

code, and com?rand, and as a result of such conduct, intentionally cause damage W1thout 

. authorization to a protected computer, and the offense Caused less to one or more persons

during a 1~year period aggregating at least 000.00 in value and damage affecting 10 or

Superseding Indictment/ United States Fedo?rbv 1- . UNITED STATES ATTORNEY 

WASHINGTON 98101 

No. CR18 16 .p . Sumaszzo -

(206) 55317910

 

 

sqoo \1 ex u. wax.) HI.

-


 

 

Document 20-2 Filed 07/27/18 IIPage 18 of 32

more protected computers during a l-year period, 111 violation of Title 18, United States

Code, Sections 1030(a)(5)(A) and 

II. OBJECTIVES OF THE CONSPIRACY . . 7
23. I The objectives of the conspiracy included hacking into protected computer

networks using malware designed to provide the conspirators With unauthorized access 

to and control of, victim computer systems. The objectives cf the conspiracy ?n'ther

included conducting surveillance of victim computer networks. and installing additional

malware' on the victim computer networks fer the purposes of establishing persistence,

and stealing payment card track data, ?nancial informatiOn, and proprietary, private and

. non-public information, with the intention of using and selling such stolen items, either

directly or indireCtly, for ?nancial gain. The obj eCtives of the Conspiracy ?lrther
included installing malware that would integrate victim computers into a botnet that 
allowed the conspiracy to control, alter, and damage compromised computers.
MANNER AND MEANS OF THE CONSPIRACY i

24. The manner and means used to accomplish the conspiracy are set forth 1n
Paragraph 15 of Count 1 Of this Superseding Indictment.-
IV. OVERT ACTS I

'25. In furtherance of the conspiracy, and to achieve the objects thereof,

VALERIEVTCH FEDQROV, and others known and unkn0wn to the Grand

- Jury,- did Commit and cause to be committed, the fOllowing overt acts, among others,- in

the Western cf Washington and elsewhere-: .
a. Co-conspirator F.H. served as a high?level syStems administrator for. I
1N7 who maintained servers and communication channels used by the organization,
including administrating HipChat rooms and the uploading and organization of stolen
payment card data and malWare. For exampleabout March 14, 2016, co?conspirator F. H. uploaded to 
a HipChat room shared with another IN 7 member an archive that contained numerous

data ?les containing payment card numbers stolen from a victim company that had

Superseding Indictment] United States v. edorav - UNITED STATES ATTORNEY . I.

No 17 . 700 STEWART STREET, SUIT-E .5220
- . SEATTLE, WASI-HNGTON 98101
(206) 553?7970

 

 

\o 065.: cyan-4: DJ 



payment cards.

 

 

Case DocumentIZOaZ ?led 07/27/18 Page 19 of 32

publicly reported a security breach that reSulted 1n the loss of tens of thousands abOut April 8, 2016, co-cohspiiator F. H. created a 
HipChat room called ?My_ Files, to which he had exclusive access, and later uploaded
data for approximately 100 stolen payment cards. . 

On or about July 19, 2016, co?conSpirator F. H. posted a

HipChat room accessible to other FIN 7 members, ?les related to a victim company, 

. including multiple .screenshots from one or more victim Company computers that shovved, I. .

among other things, internal cempany information and 'an administrator password
I IiIv. On or about November 22, 2016, co-conspirator ..H .
uploaded to his Files? HipChat room a ?le containing data for stolen payment 
cards. . 
b. DMYT-RO VALERIEVICI-I FEDOROV served as a high-level? ?pen-
tester? one tasked With finding vulnerabilities that an attacker may exploit) who

managed other pen-testers responsible for breaching the security of victims? computer

systems. For example,
. i. I - VALERIEVICH FEDOROV created and I
managed? issues? on FIN7 ?s private JIRA server relating to intrusions of multiple victim

companies, including, but not limited to, Victim-7 and Victim-9:, to which FIN7 members 

__shared and stored intrusion infermation and ex?ltrated-datan

. ii. . Using 3 private Jabber Server, 
VALERIEVICH FEDOROV communicated under the alias ?hotdinia? with other FIN7
members regarding his hacking efforts, and his payment for such efforts. 
VALERIEVICH FEDOROV accessed and
controlled comprOmised computer systems through custom control panels..-
- .0. The conspiIaCy compromised, illegally accessed, had unauthorized

communications with, and'ex?ltrated proprietary, private, and nan-public victim data. and . 5

Superseding Indictment United States v. Fedorov WEED STAIES ATTORNEY I
No. CR18- 004RSM 18 . . . . . 700 3111me 
1 SEATTLE, WASHINGTON 98101
. (206) 5531:1970

 

ne'ooqoxuuowcwv?

 

 

Case Document 20-2 Filed 07/27/18 PageZO 0132 -

information from thecomputer systems. of the Victim-l, .a hotel and casino in the I

Western District of Washington. Fer instance

. . i. On or abOut August 8, 2016, the conspiracy, directly and__
through intermediaries, used the account just__ etravel@yahoo. com to send a phishing
email, with the subject ?order,? to an employee of Victim?l located 111 Tacoma,
Washington, with an attached Microsoft Word doCumenIt that contained malware. The
email contained materially false representations designed to induce the targeted employee
to open enable the malware, and compromise the computer system

- ii. - I On or about August 8, 2016,- the conspiracy, directly and

through intermediaries, used the account frankjohnSon@revital?traVel. com to send a
phishing email, with the subject ?order, to an employee of Victim-1 located 1n Tacoma,

Washington, with an attached Microsoft IWord document that contained malware. The

email contained materially false representations designed to induce the targeted employee

to enable the malware, and compromise the computer system.
I - Under the control of the conspiracy malWaIre, a
comprotnised computer of Victim-1 communicated with a command and control server -

located a foreign country. For instance, from August 8, 2016 to August 9,2016, and 

from August 24, 2016 to August 31, 2016, a compromised Victims] computer legged

approximately 3, 639 with various URLs all starting with? I?Irevital-I_
travel. com? ?at an IP address hosted in Russia. I I 

d. The conspiracy compromised, illegally accessed, had unauthorized
communications with, and ex?ltrated proprietary, private, and non-public victim data and

information from the computer systems of Victim?6, a restaurant chain with locations 1n

multiple states. For instance, -

i; On or about August 25, 2016, the conSpiracy, directly and

through intermediaries, used the account revital. travel @yahoo. com to send a phishing

email to Ian employee of Victim-I6, with an attached Microsoft Word document that

contained malware. The email contained materially false representations designed to

. Superseding United States v. Fedorov I UNITED STATES ATTORNEY 700 STEWART STREET, SUITE 5220

SEATTLE, 9810]
(206) 553?7970

 






 

 

Document 20-2 Filed 07/27/18 PageIZl of 32. 

induce the. targeted'employee to enable the malware, and compromise the'computer

systemabout September 7,2016, co-conspirator F. H. created
an ?issue? _on the conspiracy? 3 private JIRA server speci?cally related to Victim?6 One
or more IN 7 members posted ?les containing internal credentials for the Victim?6
computer network. 7 I I
e. . The censpiracy compromised, illegally accessed, had unauthorized - I
communications with, and ex?ltrated proprietary, private, and non-public victim data and 
information from the Computer systems of Victim~7, an automotive retail and repair chain -
with hundreds of locations 1n multiple states, including Washington. Fer instance,
1 I i. On or about January 18,2017, a FIN7 member created an
?fissue? on the conspiracy? 5 private IRA server speci?cally related to Victim?7. That
FIN 7 member and VALERIEVICH FEDOROV pested results from Several 

- network mapping tools used on Victim-7? 3 internal network.

ii. On or about January 20, 2017, a FIN7 member posted
ex?ltrated data, including multiple usemames and paSSwords with the title ?Server
Passwords, to the Victim- 7 ?issue.? 1 I

On or about January 23, and January 24, 2017, 
VALERIEVICH FEDOROV posted information about Victim-7? 3 internal network and

uploaded a ?le containing multiple IP addresses and information about Vietim~7?s

servers to the Victim-7 JIRA ?issue.?

iv. 5 On or about January 27, 2017, VALERIEVICH

.FEDOROV'Luploaded to the Victim-7 ?issue? a ?le containing over 1,000 I 

usernames and passwords for generic cempany employee acCOunts. The
potentially compromised accounts related to approximately 700 Victim-73 locations

throughout the United States, including approximately 12 locations Iceated 1n the state of I

Washington.
Superseding Indictment United States v. Fedorov 9" UNITED STATES ATTORNEY
No700 STEWART STREET, Sum: "5220

8131111143, WASHINGTON 98101
(206) 553 7970

 

 

Case Document'ZO-Z Filed 07/27/18 Page-22 of 32

f. 7 The conspiracy compromised, illegallyaccessed, had unauthorized

communications with and exfiltrated proprietary, private, and nonepublic-victim data and

information from the computer systems of Victim-2, a Corporation headquartered in ..

I Seattle, Washington. For instance,

i. On or about February 21, 2017, the conspiraCy, directly and 
through intermediaries, used an account purporting to be ?lings@sec. gov (but actually?

sent by secureservernet) to- send a phishing email to an employee? of Victim-2 lecated 1n

Seattle, Washington, with an attached Microsoft word document that contained malWare. - 

The email falsely purported to relate to a corporate ?ling with the SEC and contained
materially false representations designed to induce the targeted employee to open the ?le,
enable the malware, and compromise the computer systems
?ii. From on or about February 21, 2017, to approximately
March 3, 2017, the conspiracy illegally accessed and had communicati-Ons with the
computer systems of Victim-2 located 1n Seattle, Washington. For instance, between
about February 23, 2017, and February 24, 2017, the victim computer made outgoing
connections to and transferred internal data, without authorization, to an address
located 111 a foreign country.
1 1 On or about February 24,2017, a member posted to a
?issue? created for Victim?2, a screenshot from the targeted 'employee? 3 computer
at Victim-2, which showed, among other things, an internal Victim-2 webpage available 
only to employees with a valid user account. i i I 
iv. . Similarly, a FIN7 member posted to the Victim?2 JIRA
?issue? a teXt file containing the usernames and passwords of the targeted Victim-'2
employee, including his/her personal email account, Linkedln account,-and personal
investment and ?nancial institution accOunts. . I - 
g. i. The conspiracy compromised, illegally accessed, had unauthorized
communications with, and e'x?ltrated proprietary, private, and non-public victim data and

information from the computer systems of Victim-3, a restaurant chain With thousands of -

Superseding Indictment/ United States v. Fedorov - i -- 1 UNITED STATES ATTORNEY i

. 760 STEWART STREET, SUITE 5220
No CR1 SPOMRSM 21 1 - SEATTLE, WASHINGTON 98101
(206) 553 47970

 

 a. .
mtg-mmaumwceijGEBBZS



 

 

Case Document 20-27 Filed 07/27/18 Page :23 of 32

- locations, including the State Of Washington. From approximately March 24 2017 to 

April 18, 2017, the conspiracy accessed computer systems of Victim-3 and implanted
malWare designed to harvest payment card data from cards ?used on pointrof-sale devices i
at restaurant lQCations nationwide, including approximately 33 locations Within the 7
Western District of Washington. I 

h. The conspiracy compromised, illegally accessed, had unauthorized

. communiCationIs With, and ex?ltrated proprietary, private, and nOn-public victim data and

information from the Computer systems of Victim-8, a reStaurantI chain with hundreds of
locations 111 multiple states, including Washington. For instance, I
i. 011 or about March 27, 2017, the conspiracy, directly and II
through intermediaries, used the account ray. donovan84@yahoo. com, to send a phishing
email to a Victim-8 employee, With an attached Microsoft Word document that contained
malware. The email falsely purported to convey a customer complaint and contained
additional materially false representations designed to indUCe the targeted employee to
enable the malware, and compromise the computer systemabout March 29, 2017, a FIN7 member created an i .
?issue? on the conspiracy? 8 private JIRA server speci?cally related to Victim-8 and
posted results 110111 several network mapping tools used on Victim-8?s internal netWork
On or about March 31, 2017,21 FIN7 member posted a link to

the point-of-sale software management solution used by Victim-8, and a username and

paSS'word to the Victim~8 JIRA ?issue.? The software management tool allows a

company to manage point-of-sale systems at multiple locations. The FIN7 memberalso

uploaded several screenshots presumably from: one Or more Victim computers at Victim- .

8, which shoWed, among other things, the user logged into Victim-8?s account for the
software management toolabout April 6, 2017, a FIN7 member uploaded tothe I 
Victim?8 JIRA ?issue? Ia ?le- 'containing hundreds of usernames and passWo?rds for I
approximately 798 Victim-8 locations, including'3z7 locationsilocated in the, Stateof .

Superseding Indictment/ United States v. Fedorov I 1 UNITED STATES ATTORNEY
No 22 I 5 I 700 STEWART Smear, SUITE 5220?
- Swims, WASHINGTON 98101

(206) 553.1970 

 

 






 

 

Document 20-2 Page-24 of32

Washington. The ?le included network information, telephone cOmmuniCations, and
locations of- alarm panels within restaurantsabout April 7, 2017, a FIN7 member uploaded to the I A

Victim-8 JIRA ?issue? a similar ?le containing numerdus usernames and passwords for
Victim-8 locations?vi. 7 On or about May 5,2017, a FIN7 member uploaded to the
Victim-8 JIRA ?issue? a file containing ?le directories on a cempromised computer. .

vii. On or about May 8,2017, a FIN 7 member uploaded to the .
Victim-8 ?issue? ex?ltrated ?les related to a password management system from a 
compromised computer, which contained the credentials, usernames, and passwords of a
particular employee. I

On or about May 15, 2017 a FIN7 member uploaded to the . 

Victim?8 ?issue? screenshots of a compromised computer that showed the 7 i .
employee accessing Victim-8?s security infrastructure management sOftWar'e using that
same employee? 3 credentials. . 7 .

i. The conspiracy compromised, illegally accessed, had unauthorized
communications with, and ex?ltrated proprietary, private, and nonwpublic victim data and
information from the computer systems of one or more locations Of Victim-9, a feet-food
restaurant chain with thousands of locations throughout the United States, including I
Washington. For instancevarious dates,the conspiracy, directly and. through I
intermediaries, sent phishing emails with an attached ?le that eontained malware to
multiple Victim-9 locations. For instance, on or about April 7,2017, the conspiracy used
the account oliver_palmer@yahoo. com to send a phiShing email to a Victim-9 location in
the State of Oregon. The email contained materially false repreSentations designed to
induce the targeted emplOyee to open the ?le, enable the'm'alwa're, and compromise the

computer system, . 

Superseding Indictment] Ur?zitediS?tates v. Fedorov . 3? UNITED STATES ATTORNEY .
No CR18-004RSM - 23 . . . 100 STEWART Smear, Suns 5220
SEATTLE, WASHINGTON 98101
(206) 5534970 

 

 .1?me 1?1




 

 

Case Document 20-2 Filed 07/27/18 Page 25 0f 32 _1

11. on or, about April 5, 2017, VALERIEVICH

created an ?issue? on the conspiracy?s private JIRA server speci?cally 1

related to Victim?9. One. or more FIN 7 members posted usernames and passwords for. 7 7 7 I
Victime locations, including aiVictim-9 location in'VancoUVer, Washington. 1

The conspiracy compromised, illegally accessed, had unauthorized 
communications with, and ex?ltrated preprietary, private, and non-public victim data and
information from the computer systems of One or more locations of Victim-4, a pizza
parlor chain With hundreds of locations, including 1n Washington. For instanCe,

ii. .. On or about April 11, 2017, the conspiracy, directly and

through intermediaries, used the account ol1ver_palmer@yahoo com, to send a phishing

email, With the subject ?claim,? to an employee of a Victim-4 located in Renton,

Washington, with an attached Rich Text Format (. rtf) document that contained malware.

The email falsely purported to convey a customer complaint and contained additional

materially false representations designed to induce the targeted employee to enable the
malware, and compromise the computer system. i

ii. On or about April 11, 2017, the conspiracy, directly and

through intermediaries, used the account oliver_p_almer@yahoo. cem, to send a phishing .1 .7

email, with the subject ?claim,? to an employee of a Victim-4 located 1n Vancouver,
Washington, With an attached Rich Text Format (. itt) document that contained malware, 1? 

The email falsely purported to convey a customer complaint and contained additional

materially false representations designed to induce the targeted employee to enable the 

'malware, and compromise the computer system.

On or about May 25, 2017, the conspiracy, directly and
through intermediaries, uSed the account Adrian. 1987clark@yahoo com, to send a ,7 7,

phishing email, With the subject ?takeout order,? to an employee of a Victim-4 located in. i

- or around Spokane, WaShington,with an attached'Rich Text Format (th) document that,

contained malware. The email falsely stated that the sender-had a large takeout order and 

Superseding Indictment/ United?Statas v. Fedorov 1-1. UNITED STATES ATTORNEY

No. ?7 24 - . - 700 STEWARTSIREET, 311111352211
. . - . 

(206) 553-7970

 






For instance,

 

 

I Case Document 20?2 Filed 07/27/13 Page 26 of 32?

contained additional materially false representations designed to induce the targeted

employee to enable the malware, and compromise the computer system.

k, The conspiracy compromised, illegally accessed, had unauthorized
communications with, and ex?ltrated proprietary, private, and non-public Victim data and 
information from the computer systems of one or more locations of VictimelO, a fast- -

food restaurant chain with hundreds of locations in various states, including Washington 7

i. I. On or about May 24, 2017 a IN7 member created an ?issue?
on the conspiracy? private JIRA server speci?cally related to Victim-10.- One or more 
FIN 7 members posted information relating to the intrusion cf computer sySterns and

ex?ltrated data, including ?les containing and screenshOts from one or more 

compromised computers.

. ii. . On or abOut June 12, 2017, the conspiracy, directly and
through intermediaries, used the account Adrian. l987clark@yahoo. com, to send a
phishing email, with the subject ?order. catering,? to an employee of a Victim-10 located
in Iowa, with an attached Rich Text Format (.rtf) document that containedimalware. The . 7'
email falsely stated that the sender had a'catering order for the following'day and . I
contained additional materially false representations designed to induce the employee to
enable the malware, and compromise the computer system.

From on or about June 12, 2017, to a date unknown, the .
consPiracy illegally accessed and had with the computer systems of the - 
Vietim-IO located 1n Iowa. For instance, the conspiracy transferred, without r_
authorization, the proprietary: private, and non-publicVi?ctim data and infOrmation,
including usernames and passwords, to a JIRA server managed by FIN7, located a
foreign country. . 

All inviolation of Title 18, United States Code, Section 371., ?3

Superseding Indictment/ United States v. edorov 7 WEED STATES ATTORNEY.

No. 25 7 .- .700 STEWART smnr,3unn5220
. . . - 7 98101

(206) 553-7979

 

 






 

 

Case Document 20-2 FiledrO7/27/1?8? Page 27 0132

1,9 . 7 .- 1' .
(Accessing a Protected Computer 1n Furtherance of Fraud) - 7' 
26. I The allegations set forth in Paragraphs 1 through 25 of this superseding
Indictment are re-alleged and incorporated as if fully set- forth herein. 
i 1 27. On or about the dates listed belOw, within the Western District of 7
washington, and el-sevVhere VALERIEVICH others known
and unknown tothe Grand Jury, knowingly and with intent to defraud accessed a 3 

protected computer without authorization and in excess of authorized access, and by 

means cf such conduct furthered the intended fraud and obtained something of value, .

speci?cally, payment card data and proprietary and non-public infOrmation, whereby the 1 

obj ect of the fraud and the thing obtained consisted of more than the use of the Computers

and the value of such use was mere than $5 000 111 a 1-year penod as listed below:

 
     

 

 

 

 

18 February 21, 2017 through March 3, 2017 Victim-2
19 March 24, 2017 through April 18,2017 Victim?3

 

 

 

All in violation of Title 18, United States Code, Sections 

1030(c)(3)(A) and 2. 
7 ?'COUNTszo-zzr
1 (Intentional Damage to a'Protected Computer)

28. The allegations set forth 1n Paragraphs 1 through 27 of this Supersedlng
Indictment are re-alleged and incorporated as if fully set forth herein 

. 29. On or about the dates listed below, within the Western District. of i 
Washington, and elsewhere, VALERIEVICH FEDOROV, and others known 

. and unknown to the Grand Jury, knowingly caused the tranSmissiOn of a program,

1 information, code, and command, and as a result of such conduct, intentionally caused 

damage without authorizatiOn,ito a protected computer, speci?cally, the protected 

computer system of the victim listed below, and the offense caused 1033 to oneormore

Superseding Indictment/ United States v. Fedorov - I a UNITED STATES ATTORNEY

No. 26 - 1 . ?700 STEWART 81115111811111: 5220'
. . Seams, 98101

,i (206) 553?7970 

 

 






 

 

Document 20-2 Filed.O7/27/18 Page 28 of 32

persons during a l-year period aggregating at least 000. 00 value and (ii) damage

affecting 10 or more protected computers during a 1-year period 8 ..

      

 

{"233 .

 

 

 

 

 

 

 

21 February 21,2017 through March 3, 2017 Victim-2
22 March 24,2017 through April 18,2017 Victim-3

 

All 1n violation of Title 18, United States Code, Sections 

2
COUNT 23
(Access Device Fraud)

30. The allegations set forth in Paragraphs 1 through 29 of this Stiperseding
Indictment are re?alleged and incorporated as if fully set forth herein. 1

31. Beginning at a time unknown, and continuing through on or after 
January 17, 2018, Within the Western District of Washington, and elsewhere, 
VALERIEVICH FEDQROV, and others known and unknown to the Grand Jury, 
knowingly and with intent to defraud, possessed ?fteen or more counterfeit and 7

unauthorized access devices, namely, payment card data, account numbers, and other

. means of. account access that can be used, alone and in conjunction with another access 7

device, to obtain money, goods, services, and any other thing of value, 'and?that can be:
used to initiate a transfer of funds, said activity affecting interstate and foreign commerce

All in violation. of Title 18, United States Code, Sections 
1029(c)(1)(A), and 2 .

24'-
. (Aggravated Identity Theft)
. 32. The allegations set forth 1n Paragraphs 1 through 31 of this Superseding - .- .

Indictment are re?alleged and incorporated as if fully set forth herein. i

33. Beginning at a time unknown, but no earlier than on or about February 21,
2017, and no later than March 3, 2017, and continuing through on or after November 21,
2017, at Seattle, within the Western District of Washington, and elseWhere, 

Superseding Indictment/ United States Fedorov . . UNITED STATES ATTORNEY 
No. 27 700_ STEWART STREET, SUITE 5220 
- SEATTLEWASHINGTONQSIOIH

(206) 553-7970

 

 



i?Ii?ti?Im
Luigi-dc:

mumm-Ari?cowacxu



 

 

Case - Document 20-2 Filed 07/27/18 Page 29 of 32 I

VALERIEVICH FEDOROV, and others known and unknown to the Grand Jury, did

knowingly transfer, possess, and use, without lawful authority, a means of identi?c?atiOn

. of another person, to Wit: the name, username, and passWord of a real person, J. Q, an

employee of Victim-2, during and 111 relation to a felony violation enumerated in 18 
U. S. C. 1028A(c), that 1s, conspiracy to commit wire and bank fraud, in Violation of 18 
U. S. 1349, as charged in Count 1, and wire fraud, in violation of 18 U. S. C. 1343, as i 

1 charged in Counts 5 and 6, knoWing that the means of identification beIOnged to another 

actual person.
All 1n violation of Title 18, United States Code, Sections 1028A(a) and 2.

. . (Aggravated Identity Theft)
341 I The allegations set forth 1n Paragraphs 1 through 33 of this Supe'rseding

Indictment are re?alleged and incorporated as if fully set forth herein.

- 35. Beginning at a time unknown, but no later than on or about May 8, 
and continuing through on Or after November 21, 2017, within the Western District of
Washington, and elsewhere, VALERIEVICH FEDOROV, and others known

. and unknown to the Grand Jury, did knowingly transfer, possess, and use, Without lawful
autho11ty, a means of identi?cation of another person, to Wit: the name,emp10yee

credentials, username, and password Of a real person, N. M. ,an empIOyee of Victim?8,

during and in relation to a felony violation enumerated 111 1.8 U.S.C. 1028A(c), that is, 
conspiracy to commit wire and bank fraud, inviolation of 18 U.S.C. 1349, as charged
in Count 1 ,knowing that the means of identi?cation belonged to another actual person.
All in violation of Title 18, United States Code, Sections 1028A(a) and 2.
COUNT 26'
7 (Aggravated Identity Theft)
36. The allegations set forth in Paragraphs 1 through 35 of this Superseding'

Indictment are re.- alleged and inCorporated as if fully set forth herein.-

Superseding Indictment-l United States v. Fedorov 'l I i I - STATES ATTORNEY 

. No. CR18- 004RSMSEATTLE, WASHINGTON 98101
(206) 553-1910

 

 






 

 

Case Document 20-2 Filed 07/27/18 Page 30 of 32

37. Beginning at a time unknown, but no later than-011.01 about January 27, a; 1
2017, and continuing through onior after November 21, 2017,. Within the W?SternIDisuict

- of Washington, and elsewhere, VALERI-EVICH EDORQV, and others. -. 
known and unknown to'tIhe Grand Jury, did mowingly?transfer, possess, and use, without i 

lawful authority, a means of identi?cation of another person, to Wit: the name, username, 
andpasswerdofrealpersons BC C.H., E.L., J..M, AP RO T.T., 7
employees of Victim-7, during and in relatiOn to a felony violation enumerated in
18 U. S. C. 1028A(e), that IS, conspiracy to commit Wire and bank fraud, in violation of .
18 U. S. C. 1349, as charged 1n Count 1 ,knowing that the means of identificatiOn . 1 I
belonged to another actual person. I

All 1n violation of Title 18, United States Code, Sections l028A(aI) and 2

1 1 .

38. The allegations contained 111 Counts 1 through 15 of this superseding I I
Indictment are hereby realleged and incorporated by reference for the purpose of alleging 1 -
forfeitures pursuant to Title 18, United States Code, Section and Title 28,
United States Code, Section 2461(0). Upon conviction of any of the offenses chargedui'n I
Counts 1 through 15, the defendant, VALERIEVICH FEDORQV, shall
forfeit to the United States any property, real or personal, which constitutes or is derived

from proceeds traceable to such offenses, including- but not limited td a. judgment for a

sum of money representing the property described 1n this paragraph.

39. The allegations contained in Counts 16 through 22 of this Supersedmg I I
Indictment are hereby realleged and incorporated by reference for the purpose of alleging
forfeitures pursuant to Title 18, United States Code, Sections 982(a)(2)(B) and 1030(1).
Upon conviction of any cf the offenses charged in Counts 16 through 22, the defendant,
shall'forfeit tothe United States any preperty 
Constituting, or derived from, proceeds the defendant obtained, direCtly or indirectly, as
the result of such offenses, and shall also forfeit the defendant? interest in any personal

property that was used or intended to be used to commit or to facilitate the commission cf

Supersedjng Indictment United States v. edorov . - UNITED STATES ATTORNEY
No_ 29 I I r, "700 STEWART STREET, SUITEISZZO
98101



 

 





tom-MN



A

 

 

Case Document 20-2 Filed 07/27/18 Page 31.. of'32

such offenses, including but not limited to a judgment for a 'sum of money representing

the property described 1n this paragraph. 7 
40. 7' The allegations contained 1n Count 23 of this supersedlng Indictment are ..

hereby realleged and inCorporated by reference for the purpose of alleging forfeitures . i - 

pursuant to Title 18, United States COde, Sections 981 and and 

Title 28, United States Code, Seetion 2461(0). Upon conViction of the offense charged in '1

Count 23, the defendant, VALERIEVICH FEDOROV shall forfeit to the 

United States any property, real or personal, which constitutes or is derived from
proceeds traceable to such offense, arid shall also forfeit any personal property used or
intended to be used to commit such Offense, including but not limited to a judgment for a
sum of money representing the property described 111 this paragraph.
(SubStitute Assets) 
41, If any Of the property described above, as a result of any act or omisSion of-
the defendant: 

cannot be located upon the exercise of due 

a.
b. has; been transferred or sold to, ordepoSited with, a third party; 5 i
c. . 7 has been placed beyond the jurisdiCtion of the court; .
- d. 7' has been substantially diminished 1n valuehas been cemmingled with other property which cannot be 2di'vid?edvi- 
without dif?culty, 8 


itpe?iift?tot?lg?gegg? United States Fedorov . . 

SEATTLE, WASHINGTON 98101 .
(206) 553-7970

 

 

 

Case Document 20-2 Filed 07/27/18. Page 32 of 32

Code, SeCtion 2461(0)

 

 

i I 
ANNETTE L. YE
United States Att rn

(An 

ANDREW C. FRIEDMAN 
Assistant United States Attorney

CIS FRANZ
Ass stant United ates Attorney

  

 

Assistant United States Attorney




Trial Attorney

Computer Crime and Intellectual Property Section .

Superseding Indictr'n?ent/ United States v. edorov 

No. CR18-004RSM - 31 

A TRUE BILL:
DATED:

the United States of America shall be entitled to forfeiture of substitute property pUrsuant .
to Title 21, United States Code,- Section 853(p), as incorporated by Title 28, United States 2V. I

12:9?;

A (Signature of FereperSOn redacted pursuant to
Delicv of. the Judicial Conference) 
FOREPERSON

UNITED STATES ATTORNEY
700 STEWART STREET, SUITE 5220

- SEATTLE, 98101.

(206) 553-7970