FILED UNITED STATES DISTRICT COURT DISTRICT or NEW JERSEY DEC 0 3 2018 AT ?451.95. UNITED STATES OF AMERICA Hon. v. Criminal No. 18? OLEKSII IVANOV, 18 U.S.C. 1349 a/k/a ?Oleksii Petrovich Ivanov,? 18 U.S.C. 1343 a/k/a ?Alex Ivanov,? and 18 U.S.C. 1030(a)(5)(A), OAeKci?? 18 U.S.C. 2 INDICTMENT The Grand Jury in and for the District of New Jersey, sitting at Newark, charges: COUNT ONE (Conspiracy to Commit Wire Fraud) 1. At all times relevant to Count One of this Indictment: a. OLEKSII IVANOV, a/ k/a ?Oleksii Petrovich Ivanov,? a/k/a ?Alex Ivanov,? and a k/ a (hereinafter, was a citizen of Ukraine who last resided in Kiev, Ukraine. b. Company A was a company headquartered in New York, New York that operated an advertising server platform used by advertising server companies to place advertisements on online websites. Company A?s primary computer servers were located in Hudson County, New Jersey. c. Company was a domain registrar and web hosting company headquartered in Scottsdale, Arizona. Overview 2. From at least October 2013, and continuing through at least May 2018, IVANOV and his co~conspirators devised and executed an international computer hacking scheme whereby they: a. Created and used ?ctitious entities, as well as fraudulent or stolen online identities, to purchase online advertising space; b. Used these entities and identities to register Internet domains that hosted malicious advertisements; and c. Launched malicious online advertising campaigns?so?called ?malvertising?? in an effort to deceive victim Internet users and to deliver malicious software (?malware?) to the computers of users who viewed or accessed the malicious advertisement. 3. IVANOV and his co?conspirators, through the above, caused unsuspecting Internet users to View or access their malicious advertisements on more than one hundred million occasions. By launching these malicious advertisement campaigns, IVANOV and his co?conspirators attempted to cause millions of dollars of losses to victim Internet users. 4. IVANOV and his co?conspirators deployed a number of approaches to pro?t from the dissemination of malware and malicious advertisements. Relevant Terms and De?nitions 5. The Internet advertising industry has three main components: ?online publishers,? ?online advertising server platforms,? and ?online advertising companies.? ?Online publishers? are the organizations that operate and rent out space on third?party websites, such as news, entertainment, or sports websites. ?Online advertising companies? are organizations that work directly with companies and individuals to publish their online advertisements on the Internet. In addition, certain companies operate ?online advertising server platforms? that use computer algorithms to facilitate the placement of advertisements submitted by ?online advertising companies? with ?online publishers.? 6. ?DiSplay advertising? is a type of Internet advertising that uses web banners, frame ads, and other graphical advertisements that are delivered through websites that are accessed by computer users. Display advertising allows advertisers to track how many times an advertisement is viewed. 7. ?Impressions? refers to how many views an online advertisement receives. A View is counted when a computer browser Visits a website and a particular advertisement is served to the browser. 8. ?Traf?c? is used to generically describe visitors to a website or impressions of an advertisement. 9. Malicious software (?malware?) is a software program designed to disrupt the operation of a computer or other device, gather sensitive information, gain access to the computer or other device, and take other unwanted actions. 10. ?Malicious advertisements? or ?malvertisements? are online advertisements that attempt to direct the Internet browser of a Victim computer towards unwanted advertisements, malicious computer programs, or to other computers that can be used to install malware on the victim computer. 11. A ?domain name? is a simple, easy-to?remember way to identify, among other things, computers, servers, and networks, using a series of characters letters, numbers, or other characters) that correspond with a particular Internet Protocol address. 12. Domain names may be purchased through a ?registrar,? which acts as the intermediary between the registry and the purchaser of the domain name. The individual or business that purchases, or registers, a domain name is called a ?registrant.? The Conspiracy 13. From at least in or around October 2013 through in or around May 2018, in Hudson County, in the District of New Jersey, and elsewhere, the defendant, OLEKSII IVANOV, a a ?Oleksii Petrovich Ivanov,? a a ?Alex Ivanov,? OAeKci?,? did knowingly and intentionally conspire and agree with others to devise a scheme and arti?ce to defraud and to obtain money and property by means of materially false and fraudulent pretenses, representations, and promises, and, for purposes of executing and attempting to execute such scheme and artifice to defraud, did transmit and cause to be transmitted by means of wire communications in interstate and foreign commerce certain writings, signs, signals, pictures, and sounds, contrary to Title 18, United States Code, Section 1343. Object of the Conspiracy 14. The object of the conspiracy was for IVANOV and others to unlawfully enrich themselves by launching malicious advertisements. Manner and Means of the Conspiracy 15. It was part of the conspiracy that: a. IVANOV and others created online personas and ?ctitious entities in order to pose as legitimate advertisers to advertising companies and advertising server platforms in correspondence or transactions regarding online advertising campaigns. b. IVANOV and others used ?ctitious and fraudulent aliases to register domains to be used in furtherance of publishing malicious advertisements, including domains registered with Company B. c. IVANOV and others deceived advertising companies and advertising server platforms, such as Company A, into causing the websites of third-party victim companies to publish malicious advertisements that appeared legitimate, but actually attempted to deliver malware to millions of victim Internet users. After online advertisers and advertising server platforms ?agged the co?conspirators? advertisements as malicious, IVANOV and others provided false and misleading statements designed to deceive advertisers and advertising server platforms into continuing to cause the publishing of malicious advertisements. e. IVANOV and others repeatedly changed the personas and fictitious companies that they used to launch malicious advertisements to circumvent advertising companies? and advertising server platforms? anti? malvertising safeguards. f. IVAN 0V and others took steps to re?ne their malicious advertisements to circumvent advertising companies? and advertising server platforms? anti?malvertising safeguards, including using services that test malware and, using fictitious entities, corresponding with online advertising companies and other entities to learn why advertising server platforms had banned their advertisements as malicious. g. IVANOV and others attempted to enrich themselves by offering to sell access to networks of devices infected with malware. All in violation of Title 18, United States Code, Section 1349. COUNTS TWO THROUGH FIVE (Wire Fraud) 1. Paragraphs 1 through 12 and 14 through 15 of Count One of this Indictment are re-alleged and incorporated herein as though fully set forth in this Paragraph. 2. From at least in or around October 2013 through in or around May 2018, in Hudson County, in the District of New Jersey, and elsewhere, the defendant, OLEKSII IVANOV, a/ k/ a ?Oleksii Petrovich Ivanov,? a/ a ?Alex Ivanov,? a/ k/ OAeKcii/i,? did knowingly and intentionally devise a scheme and arti?ce to defraud and to obtain money and property by means of materially false and fraudulent pretenses, representations, and promises, and, for purposes of executing and attempting to execute such scheme and arti?ce to defraud, did transmit and cause to be transmitted by means of wire communications in interstate and foreign commerce certain writings, signs, signals, pictures, and sounds, each constituting a separate count of the Indictment: Count Approximate Wire Transmission Date 2 4/ 24/ 2014 IVANOV caused a malicious advertisement hosted at an Internet domain address (?Domain to be electronically transmitted to the servers of Company A in the District of New Jersey for online publishing. 3 6/25/2014 IVAN OV caused a malicious advertisement hosted at an Internet domain address (?Domain to be electronically transmitted to the servers of Company A in the District of New Jersey for online publishing. 7/3/2014 IVANOV caused a malicious advertisement hosted at an Internet domain address (?Domain to be electronically transmitted to the servers of Company A in the District of New Jersey for online publishing. 7/15/2014 IVANOV caused a malicious advertisement hosted at an Internet domain address (?Domain to be electronically transmitted to the servers of Company A in the District of New Jersey for online publishing. In violation of Title 18, United States Code, Section 1343 and Section 2. COUNT SIX (Intentional Damage to a Protected Computer) 1. Paragraphs 1 through 12 and 14 through 15 of Count One of this Indictment are re?alleged and incorporated herein as though fully set forth in this Paragraph. 2. From on or about September 24, 2014, and continuing until the present, in Sussex County, in the District of New Jersey and elsewhere, the defendant, OLEKSII IVANOV, a/k/a ?Oleksii Petrovich Ivanov,? a/k/a ?Alex Ivanov,? a/k/ OAeKcifI,? did knowingly cause the transmission of a program, information, code, and command, and aid and abet in the same, and as a result of such conduct, intentionally cause damage without authorization, to protected computers in the District of New Jersey and elsewhere, and the offense caused: loss to one or more persons during any one?year period from IVAN course of conduct affecting protected computers aggregating to at least $5,000 in value, and (ii) damage affecting ten or more protected computers during any one?year period. In violation of Title 18, United States Code, Sections 1030(a)(5)(A), and Section 2. FORFEITURE ALLEGATION AS TO COUNTS ONE THROUGH FIVE 1. As a result of committing the offenses charged in Counts One through Five of this Indictment, the defendant, OLEKSII IVAN OV, a k/ a ?Oleksii Petrovich Ivanov,? a a ?Alex Ivanov,? a/k/ OAeKci?,? shall forfeit to the United States, pursuant to Title 18, United States Code, Section 981(a)(1)(C) and Title 28, United States Code, Section 2461, all property, real and personal, that constitutes or is derived from proceeds traceable to the commission of the said offense, and all property traceable thereto. 10 FORFEITURE ALLEGATION AS TO COUNT SIX 1. As a result of committing the offense charged in Count Six of this Indictment, the defendant, OLEKSII IVANOV, a a ?Oleksii Petrovich Ivanov,? a a ?Alex lvanov,? a/k/a/ Omxci?,? shall forfeit to the United States pursuant to Title 18, United States Code, Sections 982(a)(2)(B) and 1030(i), any property, real or personal, constituting, or derived from, proceeds obtained directly or indirectly as a result of the offense charged in Count Six of this Indictment; and pursuant to Title 18, United States Code, Section 1030(i), all right, title, and interest of the defendant in any personal property that was used or intended to be used to commit or to facilitate the commission of the offense charged in Count Six of this Indictment. ll SUBSTITUTE ASSETS PROVISION (Applicable to All Forfeiture Allegations) 1. If any of the above-described forfeitable property, as a result of any act or omission of the defendant: a. cannot be located upon the exercise of due diligence; b. has been transferred or sold to, or deposited with a third party; c. has been placed beyond the jurisdiction of the court; (1. has been substantially diminished in value; or e. has been commingled with other property which cannot be divided without dif?culty; the United States shall be entitled, pursuant to 21 U.S.C. 853(p) (as incorporated by 28 U.S.C. 2461(c) and 18 U.S.C. 982(b) and 1030(i)), to forfeiture of any other property of the defendant up to the value of the above- described forfeitable property. A TRUE BILL FOREPERSON CRAIG bjRPENnib BY Campy that me above and United States Attorney lo?sg?g is a true and correct copy 0? the original on file in my office. TTEST T. WALSH. Clerk rt "ad States Dmnot - or?? 01 New Janey . i 4L, y. Deputy Clerk 12 CASE NUMBER: 18- United States District Court District of New Jersey UNITED STATES OF AMERICA v. OLEKSH IVANOV, a/ k/ a ?Oleksii Petrovich Ivanov,? a/k/ a ?Alex Ivanov,? and a/ k/ a ?IBaHon OAexciifp, INDICTMENT FOR 18 U.S.C. 1349 18 U.S.C. 1343 18 U.S.C. 1030(a)(5)(A), 18 U.S.C. 2 A True Bill, Foreperson CRAIG CARPENITO U. S. ATTORNEY NEWARK, NEW JERSEY DARA AQUILA GOVAN ASSISTANT U. S. ATTORNEY 973-297?4365 8 (Ed. 1/97)