UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW UNITED STATES OF AMERICA . SEALED INDICTMENT {3 ANDREI TYURIN, s4 15 33-333 a/k/a ?Andrei Tiurin,? 1?1 Defendant. HE COUNT ONE (Conspiracy to Commit Computer Hacking) The Grand Jury charges: 1. From at least in or about 20l2, up to and including at least July 2015, in the Southern District of New York and elsewhere, ANDREI TYURIN, a/k/a ?Andrei Tiurin,? the defendant, and others known and unknown, willfully and knowingly combined, conspired, confederated, and agreed together and with each other to commit an offense against the United States, to wit, computer hacking, in violation of Title 18, United States Code, Sections 1030(a)(2)(A), 1030(a)(2)(C), 1030(a)(4), and 1030(c). 2. It was a part and an object of the conspiracy that ANDREI TYURIN, a/k/a ?Andrei Tiurin,? the defendant, and others known and unknown, would and did intentionally access a computer without authorization and exceed authorized access, and thereby obtain information contained in a financial record of a .. I .r >553, a mi VSE??ti*i* in Ll. financial institution, for purposes of commercial advantage and private financial gain, and in furtherance of a criminal act in violation of the laws of the United States, to wit, securities fraud, in violation of Title 15, United States Code, Sections 78j(b) 78ff, and Title 17, Code of Federal Regulations, Section 240.10b?5, the value of which information exceeded $5,000, in violation of Title 18, United States Code, Sections lO30(a)(2)(A) and 1030(c)(2)(B). 3. It was a further part and an object of the conspiracy that ANDREI TYURIN, a/k/a ?Andrei Tiurin,? the defendant, and others known and unknown, would and did intentionally access a computer without authorization and exceed authorized access, and thereby obtain information from a protected computer, for purposes of commercial advantage and private financial'gain, and in furtherance of a criminal act in violation of the laws of the United States, to wit, securities fraud, in violation of Title 15, United States Code, Sections 78j(b) 78ff, and Title 17, Code of Federal Regulations, Section 240.10b?5, the value of which information exceeded $5,000, in violation of Title 18, United States Code, Sections 1030(a)(2)(C) and 1030(c)(2)(B). 4. It was a further part and an object of the conspiracy that ANDREI TYURIN, a/k/a ?Andrei Tiurin,? the defendant, and others known and unknown, would and did knowingly and with intent to defraud, access a protected computer without authorization, and exceed authorized access, and by means of such conduct further the intended fraud and obtain a thing of value, to wit, customer information and data that was used in furtherance of securities fraud crimes, the value of which information exceeded $5,000 in a 1?year period, in violation of Title 18, United States Code, Section 1030(a)(4) and 1030(c)(3)(A). Overt Acts 5. In furtherance of the conspiracy and to effect the illegal objects thereof, the following overt acts, among others, were committed in the Southern District of New York and elsewhere: a. In or about June 2012, ANDREI TYURIN, a/k/a ?Andrei Tiurin,? the defendant, caused the unauthorized access to, and theft of customer data from, the computer network of a financial news publisher based in the United States. b. In or about December 2012, TYURIN caused the unauthorized access to, and theft of customer data from, a financial services corporation based in New York City, including by wire communications through the Southern District of New York. c. In or about August 2013, TYURIN caused the unauthorized access to, and theft of customer data from, the computer network of a financial news publication based in New York, New York Victim?l?). d. On or about August 30, 2013, while hacking into SDNY Victim?1?s computer network, TYURIN told a co?conspirator not named as a defendant herein in electronic communications, in substance, that TYURIN had located 10 million email addresses of SDNY Victim-1?s customers. e. During at least in or about September 2013 to in or about February 2014, TYURIN caused the unauthorized access to, and theft of customer data from, the computer network of a financial services corporation based in the United States. f. During at least in or about September 2013 to in or about November 2013, TYURIN caused the unauthorized access to, and theft of customer data from, the computer network of an additional financial services corporation based in the United States. g. In or about December 2013, TYURIN caused the unauthorized access to, and theft of customer data from, the computer network of a financial services corporation with headquarters in New York, New York Victim?2?). h. On or about December 7, 2013, while hacking into SDNY Victim?2?s computer network, TYURIN told in electronic communications, in substance, that TYURIN had located 15 million email addresses of SDNY Victim?2?s customers. i. In or about April 2014, TYURIN caused the computer network of yet another financial services corporation based in the United States to be accessed without authorization. j. From in or about June 2014, to in or about August 2014, TYURIN caused the unauthorized access to, and theft of customer data from, the computer network of a financial institution with headquarters in New York, New York Victim?3?). (Title 18, United States Code, Section 371.) COUNT TWO (Wire Fraud) The Grand Jury further charges: 6. From at least in or about 2012, up to and including at least July 2015, in the Southern District of New York and elsewhere, ANDREI TYURIN, a/k/a ?Andrei Tiurin,? the defendant, having devised and intending to devise a scheme and artifice to defraud, and for obtaining money and property by means of false and fraudulent pretenses, representations, and promises, transmitted and caused to be transmitted by means of wire, radio, and television communication in interstate and foreign 5 commerce, writings, signs, signals, pictures, and sounds for the purpose of executing such scheme and artifice, and aided and abetted the same, to wit, TYURIN accessed without authorization the networks of various companies for the purpose of exfiltrating customer information and data that was used in furtherance of securities fraud crimes. (Title 18, United States Code, Sections 1343 and 2.) COUNT THREE (Computer Hacking: SDNY Victim?3) The Grand Jury further charges: 7. From at least in or about June 2014, up to and including at least in or about August 2014, in the Southern District of New York and elsewhere, ANDREI TYURIN, a/k/a ?Andrei Tiurin,? the defendant, intentionally accessed a computer without authorization and exceeded authorized access, and thereby obtained information contained in a financial record of a financial institution and from a protected computer, for purposes of commercial advantage and private financial gain, and in furtherance of a criminal act in violation of the laws of the United States, to wit, securities fraud, in violation of Title 15, United States Code, Sections 78j(b) 78ff, and Title 17, Code of Federal Regulations, Section 240.10b?5, the value of which information exceeded $5,000, to wit, TYURIN hacked into the computer network of SDNY Victim-3 to steal personal 6 information of tens of millions of SDNY Victim?3 customers in furtherance of securities fraud schemes perpetrated by his co? conspirators. (Title 18, United States Code, Sections 1030(a)(2)(A), 1030(a)(2)(C), lO30(c)(2)(B), and 2.) COUNT FOUR (Computer Hacking: SDNY Victim?3) The Grand Jury further charges: 8. From at least in or about June 2014, up to and including at least in or about August 2014, in the Southern District of New York and elsewhere, ANDREI TYURIN, a/k/a ?Andrei Tiurin,? the defendant, knowingly and with intent to defraud, accessed a protected computer without authorization, and exceeded authorized access, and by means of such conduct furthered the intended fraud and obtained a thing of value which exceeded $5,000 in a 1-year period, to wit, TYURIN hacked into the computer network of SDNY Victim?3 to steal personal information of tens of millions of SDNY Victim?3 customers in furtherance of securities fraud schemes perpetrated by TYURIN and his co-conspirators. (Title 18, United States Code, Sections 1030(a)(4), 1030(c)(3)(A), and 2.) COUNT FIVE (Computer Hacking: SDNY Victim?l) The Grand Jury further charges: 9. From at least in or about late 2013, up to and including in or about May 2015, in the Southern District of New York and elsewhere, ANDREI TYURIN, a/k/a ?Andrei Tiurin,? the defendant, intentionally accessed a computer without authorization and exceeded authorized access, and thereby obtained information from a protected computer, for purposes of commercial advantage and private financial gain, and in furtherance of a criminal act in violation of the laws of the United States, to wit, securities fraud, in violation of Title 15, United States Code, Sections 78j(b) 78ff, and Title 17, Code of Federal Regulations, Section 240.10b-5, the value of which information obtained exceeded $5,000, to wit, TYURIN hacked into the computer network of SDNY Victim?1 to steal personal information of millions of SDNY Victim?l customers in furtherance of securities fraud schemes perpetrated by TYURIN and his co?conspirators. (Title 18, United States Code, Sections 1030(a)(2)(C), 1030(c)(2)(B), and 2.) COUNT SIX (Computer Hacking: SDNY Victim?1) The Grand Jury further charges: 10. From at least in or about late 2013, up to and including in or about May 2015, in the Southern District of New York and elsewhere, ANDREI TYURIN, a/k/a ?Andrei Tiurin,? the defendant, knowingly and with intent to defraud, accessed a protected computer without authorization, and exceeded authorized access, and by means of such conduct furthered the intended fraud and obtained a thing of value which exceeded $5,000 in a 1?year period, to wit, TYURIN hacked into the computer network of SDNY Victim?1 to steal personal information of millions of SDNY Victim?1 customers in furtherance of fraud schemes perpetrated by TYURIN and his co?conspirators. (Title 18, United States Code, Sections 1030(a)(4), 1030(c)(3)(A), and 2.) COUNT SEVEN (Conspiracy to Commit Securities Fraud) The Grand Jury further charges: 11. From at least in or about 2011, up to and including in or about July 2015, in the Southern District of New York and elsewhere, ANDREI TYURIN, a/k/a ?Andrei Tiurin,? the defendant, and others known and unknown, willfully and knowingly combined, conspired, confederated and agreed together and with each other to commit an offense against the United States, to wit, 9 securities fraud, in violation of Title 15, United States Code, Section 78j(b) and 78ff, and Title 17, Code of Federal Regulations, Section 240.10b?5. 12. It was a part and an object of the conspiracy that ANDREI TYURIN, a/k/a ?Andrei Tiurin,? the defendant, and others known and unknown, willfully and knowingly, directly and indirectly, by use of the means and instrumentalities of interstate commerce, and of the mails, and of the facilities of national securities exchanges, would and did use and employ, in connection with the purchase and sale of securities, manipulative and deceptive devices and contrivances in violation of Title 17, Code of Federal Regulations, Section 240.10b-5, by: employing devices, schemes, and artifices to defraud; making untrue statements of material fact and omitting to state material facts necessary in order to make the statements made, in light of the circumstances under which they were made, not misleading; and engaging in acts, practices and courses of business which operated and would operate as a fraud and deceit upon any person, in violation of Title 15, United States Code, Sections 78j(b) and 78ff. Overt Acts 13. In furtherance of the conspiracy and to effect the illegal object thereof, the following overt acts, among others, 10 were committed in the Southern District of New York and elsewhere: a. In or about early January 2012, a co?conspirator not named as a defendant herein transferred 2.5 million shares of a particular U.S.?trading stock (?Stock?1?) into an account (?Firm?1 Account?) at a brokerage firm located in New York, New York b. In or about late January 2012, and caused spam emails touting Stock?l, including false statements about the cause of the increase in Stock?1?s trading volume, to be widely disseminated to recipients throughout the United States. c. From on or about January 30, 2012 to on or about February 13, 2012, the holdings in Firm?1 Account were liquidated and, at the direction of Firm?l wired over $1.1 million in proceeds to a bank account in Cyprus. d. In or about September 2013, ANDREI TYURIN, a/k/a ?Andrei Tiurin,? the defendant, and discussed a stock manipulation scheme that would require use of the ?exchange? in ?New York, [in] America." (Title 18, United States Code, Section 371.) 11 COUNT EIGHT (Unlawful Internet Gambling Enforcement Act Conspiracy) The Grand Jury further charges: 14. From at least in or about 2007, up to and including in or about July 2015, in the Southern District of New York and elsewhere, ANDREI TYURIN, a/k/a ?Andrei Tiurin,? the defendant, and others known and unknown, willfully and knowingly combined, conspired, confederated, and agreed together and with each other to commit offenses against the United States, to wit, violations of Title 31, United States Code, Section 5363. 15. It was a part and an object of the conspiracy that ANDREI TYURIN, a/k/a ?Andrei Tiurin,? the defendant, and others known and unknown, willfully and knowingly, while engaged in the business of betting and wagering, would and did knowingly accept, in connection with the participation of another person in unlawful internet gambling, to wit, gambling in violation of New York Penal Law Sections 225.00 and 225.05 and the laws of other states where the gambling businesses operated, credit, and the proceeds of credit, extended to and on behalf of such other person, including credit extended through the use of a credit card, and an electronic fund transfer and the proceeds of an electronic fund transfer from and on behalf of such other person, and a check, draft and similar instrument which is drawn by and on behalf of such other person and is drawn on and 12' payable at and through any financial institution, in violation of Title 31, United States Code, Sections 5363 and 5366. Overt Acts 16. In furtherance of theconspiracy and to effect the illegal object thereof, the following overt acts, among others, were committed in the Southern District of New York and elsewhere: a. On or about October 1, 2007, by email, informed another individual that his internet casino ?is one of the only casinos accepting players worldwide including the United States.? b. On or about January 13, 2010, by email, arranged to send advertisements promoting CC?l?s internet casinos by U.S. mail to U.S. residents, including individuals located in the Southern District of New York. c. On or about May 8, 2014, at CC?l?s direction, ANDREI TYURIN, a/k/a ?Andrei Tiurin,? the defendant, provided the login credentials for various individuals who owned or worked at two software development firms, with offices in the United States and elsewhere. d. Between approximately June 26, 2015, and July 7, 2015, in the Southern District of New York and elsewhere, a federal law enforcement agent, acting in an undercover capacity, 13 deposited U.S. currency and gambled at one of internet casinos. (Title 18, United States Code, Section 371.) COUNT NINE (Conspiracy to Commit Wire Fraud and Bank Fraud: Unlawful Payment Processing) The Grand Jury further charges: 17. From at least in or about 2011, up to and including on or about July 2015, in the Southern District of New York and elsewhere, ANDREI TYURIN, a/k/a ?Andrei Tiurin,? the defendant, and others known and unknown, willfully and knowingly combined, conspired, confederated, and agreed together and with each other to violate Title 18, United States Code, Sections 1343 and 1344 18. It was a part and an object of the conspiracy that ANDREI TYURIN, a/k/a ?Andrei Tiurin,? the defendant, and others known and unknown, willfully and knowingly, having devised and intending to devise a scheme and artifice to defraud, and for obtaining money and property by means of false and fraudulent pretenses, representations, and promises, would and did transmit and cause to be transmitted by means of wire, radio, and television communication in interstate and foreign commerce, writings, signs, signals, pictures, and sounds for the purpose of executing such scheme and artifice, in violation of Title 18, United States Code, Section 1343, to wit, TYURIN and his co~ 14 conspirators participated in a scheme involving wire communications to deceive financial institutions and other financial intermediaries into processing and authorizing payments relating to various illegal activities (including illegal online gambling, counterfeit online pharmaceutical distribution, and sales of counterfeit and malicious software) by disguising the transactions to create the false appearance that they were unrelated to such criminal activities, and thereby to obtain money of, or under the custody and control of, those financial institutions and intermediaries. 19. It was a further part and an object of the conspiracy that ANDREI TYURIN, a/k/a ?Andrei Tiurin,? the defendant, and others known and unknown, willfully and knowingly, would and did execute and attempt to execute a scheme and artifice to obtain moneys, funds, credits, assets, securities, and other property owned by, and under the custody and control of, financial institutions, the deposits of which were then insured by the Federal Deposit Insurance Corporation, by means of false and fraudulent pretenses, representations, and promises, in violation of Title 18, United States Code, Section l344, to wit, TIURIN and co?conspirators not named as defendants herein knowingly made, and caused other individuals to make, material misrepresentations to federally insured financial institutions 15 and other financial intermediaries in order to deceive those financial institutions into processing and authorizing payments relating to illegal online gambling, counterfeit online pharmaceutical distribution, and sales of counterfeit and malicious software by disguising the transactions to create the false appearance that they were unrelated to such criminal activities, and in doing so, obtained and attempted to obtain moneys, funds, and property owned by and under the custody and control of such financial institutions. (Title 18, United States Code, Section 1349.) COUNT TEN (Aggravated Identity Theft) The Grand Jury further charges: 20. From at least in or about February 2014 to at least in or about September 2014, in the Southern District of New York and elsewhere, ANDREI TYURIN, a/k/a ?Andrei Tiurin,? the defendant, knowingly transferred, possessed, and used, without lawful authority, a means of identification of another person, during and in relation to a felony violation enumerated in Title 18, United States Code, Section 1028A(c), and aided and abetted the same, to wit, TYURIN transferred, possessed, and used, and aided and abetted the transfer, possession, and use of, other vindividuals? identities during and relation to the wire fraud 16 and conspiracy to commit wire and bank fraud offenses charged in Counts Two and Nine of this Indictment. (Title 18, United States Code, Sections 1028A(a)(l), 1028A(b), lO28A(c)(5) and 2.) FORFEITURE ALLEGATIONS 21. As a result of committing one or more of the offenses alleged in Count One and Counts Three through Six of this Indictment, ANDREI TYURIN, a/k/a ?Andrei Tiurin,? the defendant, shall forfeit to the United States, pursuant to Title 18, United States Code, Section 982(a)(2)(B) any property constituting, or derived from, proceeds obtained directly or indirectly as a result of the offenses alleged Count One and Counts Three through Six and, pursuant to Title 18, United States Code, Section 1030(i), any interest in any personal property that was used or intended to be used to commit or facilitate the commission of the offenses alleged in Count One and Counts Three through Six, and any property, real or personal, constituting or derived from any proceeds obtained directly or indirectly as a result of the offenses alleged in Count One and Counts Three through Six, including but not limited to a sum of money in United States currency representing the amount of proceeds traceable to the commission of said offenses. 22. As a result of committing the offenses alleged in Counts Two and Nine of this Indictment, ANDREI TYURIN, a/k/a l7 ?Andrei Tiurin,? the defendant, shall forfeit to the United States, pursuant to Title 18, United States Code, Section any and all property constituting or derived from, proceeds obtained directly or indirectly, as a result of the commission of the offenses alleged in Counts Two and Nine of this Indictment, including but not limited to a sum of money in United States currency representing the amount of proceeds traceable to the commission of said offenses. 23. As a result of committing one or more of the offenses charged in Counts Seven and Eight of this Indictment, ANDREI TYURIN, a/k/a ?Andrei Tiurin,? the defendant, shall forfeit to the United States, pursuant to Title 18, United States Code, Section 981(a)(1)(C) and Title 28, United States Code, Section 2461, any and all property, real and personal, which constitutes or is derived from proceeds traceable to the offenses alleged in Counts Seven and Eight, including but not limited to a sum of money in United States currency representing the amount of proceeds traceable to the commission of said offenses. 18 Substitute Assets Provision 24. If any of the above?described forfeitable property, as a result of any act or omission of the defendant: a. cannot be located upon the exercise of due diligence; b. has been transferred or sold to, or deposited with, a third person; c. has been placed beyond the jurisdiction of the Court; d. has been substantially diminished in value; or e. has been commingled with other property which cannot be subdivided without difficulty; it is the intent of the United States, pursuant to Title 18, United States Code, Section 982(b), Title 21, United States Code, Section 853(p), and Title 28, United States Code, Section 2461, to seek forfeiture of any other property of the defendant up to the value of the above forfeitable property. (Title 18, United States Code, Sections 981, 982 1030; Title 21, United States Code, Section 853; and Title 28, United States Code, Section 2461.) FOREPERSON H. KIM Acting United States Attorney 19 Form No. (Ed. 9?25-58) UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK UNITED STATES OF AMERICA ANDREI TYURIN Defendant. SEALED SUPERSEDING INDICTMENT S4 15 Cr. 333 (LTS) (18 U.S.C. 371, 1028A, 1030, 1343, 1349, 2) JOON H. KIM Acting United States Attorney. FOREPERSON 2'2, A le?x? 5(nk?4f} Seine; 3664/12} P1 e9, Am?. WNW