Case 1: 17- c?r? VEC Document 3 t??ed91Il9?7 Peg . USDC um QAPRQM DOLif); UNITED STATES DISTRICT COURT 1 1 SOUTHERN DISTRICT OF NEW YORK DOC {31/39 I 1! 1D 13% @333 UNITED STATES OF AMERICA SEALED INDICTMENT V. STANISLAV VITALIYEVICH LISOV, 17 C13- a/k/a ?Black," a/k/a ?Blackf,? Defendant. COUNT ONE (Computer Hacking Conspiracy) The Grand Jury charges: Background 1. Beginning at least in or about June 2012, up to and including in or about January 2015, STANISLAV VITALIYEVICH LISOV, a/k/a ?Black," a/k/a ?Blackf,? the defendant, worked with co?conSpirators to deploy and use a type of malicious software, or malware, known as NeverQuest (?NeverQuest?), which was designed to infect the computers of unwitting victims and, among other things, steal their login information for financial institution accounts. LESOV End his-co~conspirators then used that information to steal money from those victims through various means, including wire transfers, ATM withdrawals, and purchases of expensive goods via the Internet. Case Document 3 Filed 01/19/17 Page 2 of 10 2. STANISLAV VITALIYEVICH LISOV, a/k/a ?Black,? a/k/a ?Blackf,? the defendant, was responsible for key aspects of the creation and administration of'a network of Victim computers, or botnet, that was infected with NeverQuest. Among other things, LISOV maintained infrastructure for this criminal enterprise, including by renting and paying for computer servers used to manage the botnet that had been compromised by NeverQuest. Those computer servers contained lists of millions of stolen login credentials, including user names, passwords, and security questions and answers, for user accounts on banking and financial websites. LISOV had administrativewlevel access to those computer servers. 3. LISOV, a/k/a ?Black,? a/k/a ?Blackf,? the defendant, also personally harvested login information from unwitting victims of the NeverQuest malware, including user names, passwords, and security questions and answers. In addition, LISOV engaged in numerous communications with co~conSpirators regarding trafficking in stolen login information and personally;identifying information of Victims, as well as using stolen Begin information to steal money from Victims? bank accounts. Case Document 3 Filed 01/19/17 Page 3 of 10 4. NeverQuest has been responsible for millions of dollars worth of attempts to transfer money out of victims? financial institution accounts, many of which were successful. Statutory Allegations 5. From at least in or about June 2012 through at least in or about January 2015, in the Southern District of New York and elsewhere, STANISLAV5VITALIYEVICH LISOV, a/k/a ?Black," a/k/a ?Blackf,? the defendant, and others known and unknown, willfully and knowingly did combine, conspire, confederate, and agree together and with each other to commit offenses against the United States, to wit, to intentionally access and obtain information from protected computers without authorization, in violation of Title 18, United States Code, Section 1030(a)(2); to further fraud and obtain anything of value by means of intentionally accessing protected computers without authorization, in violation of Title 18, United States Code, Section 1030(a)(4); to cause'the transmission of a program, information, code, and command that caused damage to protected computers without authorization, in violation of Title 18, United States Code, Section 1030(a)(5)(A); and to traffic in passwordS'through which computers may be accessed without authorization, in violation of Title 18, United States Code, Section 1030(a)(6), .lw Case Document 3 Filed 01/19/17 Page part and an object of the conspiracy that STANISLAV VITALIYEVICH LIsov, a/k/a ?Black," a/k/a ?Blackf,? the defendant, and others known and unknown, would and did intentionally access computers without authorization, and thereby would and did obtain information from protected computers, for purposes?of commercial advantage and private financial gain, and in furtherance of criminal and tortious acts in violation of the Constitution and the laws of the United States, and the value of the information obtained would and did exceed $5,000, in violation of Title 18, United States Code, Section 1030(a)(2). 7. It was further a part and an object of the conspiracy that STANISLAV VITALIYEVICH LISOV, a/k/a ?Black," a/k/a ?Blackf,? the defendant, and others known and unknown, willfully, knowingly, and with intent to defraud, would and did access protected computers without authorization, and by means of such conduct would and did further the intended fraud and obtain anything of value, in violation of Title 18, United States Code, Section 1030(a)(4)i 8. It was further a part and an object of the conspiracy that STANISLAV: VITALIYEVICH LISOV, a/k/a ?Black," a/k/a ?Blackf,? the defendant, and others known and unknown, willfully and knowingly would and did cause the transmission of 4 Case Document 3 Filed 01/19/17 Page 5 of 10 a program, information, dbde, and command, and as a result of such conduct, would and did intentionally cause damage without authorization, to protected computers, in violation of Title 18, United States Code, Section 1030(a)(5)(A). I 9. It was further a part and an object of the conspiracy that STANISLAV VITALIYEVICH LISOV, a/k/a ?Black,? a/k/a ?Blackf,? the defendant, and others known and unknown, in transactions affecting interstate and foreign commerce, and computers used by and for the Government of the United States, willfully, knowingly, and with intent to defraud, trafficked in passwords and similar through which computers may be accessed without authorization, in violation of Title 18, United States Code, Section 1030(a)(6). Overt Acts 10. In furtherance of the conspiracy and to effect the illegal objects thereof, the following overt acts, among others, were committed in the Southern District of New York and elsewhere: a. From at least in or about June 2014, a computer belonging to an individual located in Manhattan, New York was infected with mdlicious software known as ?NeverQuest,? and login credentials for online banking accounts were stolen from that individual?s computer. Case DocUment 3 Filed 01/19/17 Page 6 of 10 b. From at least in or about July 2013, STANISLAV VITALIYEVICH LISOV, a/k/a ?Black," a/k/a ?Blackf,? the defendant, rented dedicated servers located in Germany that functioned as command and control servers for computers infected with NeverQuest malicio??ysoftware. (Title 18, United States Code, Section 371.) COUNT TWO (Conspiracy to Commit Wire Fraud) The Grand Jury further charges: 11. The allegations contained in paragraphs 1 through 4 of this Indictment are hereby repeated, realleged, and incorporated by reference, as if fully set forth herein. 12. From at least in or about June 2012 through at least in or about January 2015, in the Southern District of New York and elsewhere, VTTALIYEVICH LISOV, a/k/a ?Black," a/k/a ?Blackf,? the defendant, and others known and unknown, willfully and knowingly did combine, conspire, confederate, and agree together and with each other to commit wire fraud, in Violation of Title 18, United States Code, Section 1343. 13. It was a part and object of the conspiracy that STANISLAV VITALIYEVICH LISOV, a/k/a ?Black," a/k/a ?Blackf,? the defendant, and others known and unknown, willfully and knowingly, having devised and intending to devise a scheme and Case Document 3 Filed 01/19/17 Page 7 of 10 artifice to defraud and for obtaining money and property by means of false and fraudulent pretenses, representations, and promises, would and did transmit and cause to be transmitted by means of wire, radio, and television communication in interstate and foreign commerce, writings, signs, signals, pictures, and sounds for the purpose of executing such scheme and artifice, in Violation of Title 18, United States Code, Section 1343. (Title 18, United States Code, Section 1349.) FORFEITURE ALLEGATIONS 14. As a result of committing the offense alleged in Count One of the Indictment, STANISLAV VITALIYEVICH LISOV, a/k/a ?Black,? a/k/a ?Blackf,? the defendant, shall forfeit to the United States, pursuant to Title 18, United States Code, Sections 982(a)(2)(B) and 1030(i)(l), the defendant?s interest in any personal property that was used or intended to be used to commit or to facilitate the commission of the offense alleged in Count One, and any property, real or personal, constituting or derived from, any proceeds-obtained, directly or indirectly, as a result of said offenseE-including but not limited to a sum of money in United States currency representing the amount of proceeds traceable to the commission of said offense. 15. As a result of committing the offense alleged in Count Two of this Indictment, STANISLAV VITALIYEVICH LISOV, 7 Case Document 3 Filed 01/19/17 Page 8 of 10 a/k/a ?Black,? a/k/a ?Blackf,? the defendant, shall forfeit to the United States, pursuant to Title 18, United States Code, Section and Title 28, United States Code, Section 2461(c), any and all property, real and personal, which I constitutes, or is derived from, proceeds traceable to the commission of said offenses, including but not limited to a sum of money in United States currency representing the amount of proceeds traceable to the commission of the offense charged in Count Two of this Indictment. Substitute Asset Provision 16. If any of the above~described forfeitable property, as a result"of?any act or omission of the defendant: a. cannot be located upon the exercise of due diligence; b. has been'transferred or sold to, or deposited with, a third party; c. has been placed beyond the jurisdiction of the court; d. has been substantially diminished in value; or e. has been commingled with other property which cannot be withOut difficulty; Case Document 3 Filed 01/19/17 Page 9 of 10 lit is the intent of the United States, pursuant to Title 21, United States_Code, Section 853(p), and Title 28, United States Code, Section 2461(c), to seek forfeiture of any other property of the defendant up to the value of the above forfeitable property. (Title 18, United States Code, Sections 981 and 982; Title 21, United States Code, Sections 853; and Title 28, United States Code, Section 2461.) PREET United States Attorney 7 Case Document 3 Filed 01/19/17 Page 10 of 10 Form No. (Ed. 9~25~58) UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK UNITED STATES OF AMERICA v. STANISLAV VITALIYEVICH LISOV, -a/k/a ?Black," ?a/k/a ?Blackf, Defendant. SEALED INDICTMENT 17 Cr. (18 U.S.C. 1030(b), and 371, 1349.) PREET BHARARA United States Attorney. 'ff'A TRUE BILL 5:3? (Can?/Va Foreperson. WW i m! Mgz??( I u,