Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 1 of 45
_ _ FILED
_ _ ENTERED

~-RECEIVED
_ _ SERVED ON
COUNSEi/PARTiES OF RECORD

1

8

STEVEN W. MYHRE
Acting United States Attorney
SEP 19 2ot7
Nevada Bar No. 9635
CHAD W. MCHENRY
Assistant United States Attorney.
CLERK US DISTRICT COURT
DISTRICT OF NEVADA
DAVID A. JAFFE
BY:
DEPUTY
Acting Chief, Organized Crime and Gang Sectio,.J.,..'.:'..:..:.:============.'.:.'.::~~~
U.S. Department of Justice
KELLYPEARSON
Trial Attorney, Organized Crime and Gang Section
501 Las Vegas Blvd. South, Suite 1100
Las Vegas, Nevada 89101
(702) 388-6336
.
Chad.W.McHenry@usdoj.gov
Kelly.Pearson@usdoj.gov

9

Representing the United States of America

2
3
4
5
6
7

10

UNITED STATES DISTRICT COURT
DISTRICT OF NEVADA

11
12

United States of America,
2:17-cr- ·

13
Plaintiff,
14
v.

3 t!/ G

REDACTED
/ UNSEALED *
. SEALED
CRIMINAL INDICTMENT

15
i6
17

[1] Svyatoslav Bondarenko,
a.k.a. "Obnon,"
a.k.a. "Rector,"
a.k.a. "Helkern,"

18 . [2] Sergey Medvedev,
a.k.a. "Stells,"
k a. "segme d"
19 a ..
k
a. .a. "Sel'J"b ear"
20
[3] Amj ad Ali,
21 a.k.a. "Amjad Ali Chaudary"
a.k.a. "RedruMZ,"
22 a.k.a. "Amjad Chaudary"

VIOLATIONS:
18 U.S.C. § 1962(d): Racketeering Conspiracy (Count 1)

* This Indictment is redacted and unsealed
pursuant to an order of the court entered
on February 7, 2018.

I

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 2 of 45

1

2

[4]
Roland Patrick
Tchikay~,
a.k.a. "Darker,"
a.k.a. "dark3r.cvv,"

N'Djimbi

.)

3

4
5

[5] Arnaldo Sanchez Torteya,
a.k.a. "Elroncoluna,"
[6J Miroslav Kovacevic,
a ..
k a. "Go1a·Junge, "

6

7

8

[7] Frederick Thomas,
a.k.a. "Mosto,"
a.k.a. "lstunna,"
a.k.a. "Bestssn,"

[8] Osama Abdelhamed,
a.k.a. "MrShrnofr,"
10 a.k.a. "DrOsama,"
. a.k.a. "DrOsamal,"
11
[9] Besart Hoxha,
12 · a.k.a. "Pizza,''
9

[10] Raihan Ahmed,
a.k.a. "Chan,"
14 · a.k.a. "Cyber Hacker,"
a ..
ae ony,"
k .a. "M.T
15 a.k.a. "Tony,"
13

16

17

[11] Andrey Sergeevich Novak,
a.k.a. "Un.ice,"
a.k.a. "Faa:xxx,"
a.k.a. "Faxtrod,"

18

[12] ·valerian Chiochiu,
19 · a.k.a. "Onassis,"
a.k.a. "Flagler,"
20 a;k.a. "Socrate,"
a.k.a. "Eclessiastes,"
21
[13] John Doe #8,
22· a.k.a. "Aimless88,"

2

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 3 of 45

1
2
3
4
·5
6
7
8
9
10
11

[14] Gennaro Fioretti,
a.k.a. "DannyLogort,"
a.k.a. "Genny Fioretti"
[15] Edgar Rojas,
a.k.a. "Edgar Andres Viloria Rojas"
k a. "Guapo,
. "
a ..
a.k.a. "Guapol988,"
a.k.a. "Onlyshop,"
[16] John Telusma,
a.k.a. "John Westley Telusma"
a.k.a. "Peterelliot,"
a.k.a. ''.Pete,"
a.k,a. "Pette,"
[17] Rami Fawaz,
a.k.a. "Rami Imad Fawaz"
a.k.a. ''Validshop,"
a.k.a. "Th3d,"
a.k.a. "Zatcher,"
a.k.a. "Darkeyes,"

12
13

[18] Muhammad Shiraz,
k a. " M
"t
-a..
ovies
ar,"
a.k.a. "Leslie,"

14
15
16
17
18

[19] J 9se Gamboa,
a.k.a. "Jose Gamboa-Soto,"
a.k.a. "Rafael Garcia,"
a.k.a. "RafaellOl,"
a.k.a. "Memberplex2006,"
a.k.a. "Knowledge,"
[20] Alexey Klimenko,
a.k.a. "Grandhost,"

l9
20
21
22

[21] Edward Lavoile,
a.k.a. "Eddie Lavoie"
a.k.a. "Skizo,"
a.k.a. "Eddy Lavoile"
[22] Anthony Nnamdi Okeakpu,
a.k.a. "Aslikel,"
3

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 4 of 45

1
2

a.k.a. "Aslike,"
a.k.a. "Moneyma:5.a,"
a.k.a. "Shilonng,"

3
4
5
6
7
8
9
10
11
12

[23] Pius Sushi! Wilson,
a.k.a. "FDIC,"
a.k.a. "TheRealGuru,"
a.k.a. "TheRealGuruNYC,"
a.k.a. "RealGuru,"
a.k.a. "Polson,"
a.k.a. "Infection,"
a.k.a. "Infected,"
[24] Muhammad Khan,
a.k.a. "CoolJ2,"
a.k.a. "CoolJ,"
a.k.a. "Secureroot,"
a.k.a. "Securerootl,"
a.k.a. "Secureroot2,"
a.k.a. "Mohammed Khan"
[25] John Doe #7,
a.k.a. "Muad'Dib,"

13
14

[26] John Doe #1,
a.k.a. "Carlitos,"
a.k.a. "TonyMontana,"

15
16
17
18
19
.20
21

[27] David Jonathan Vargas,
a.k.a. "Cashmoneyinc,"
b"
k a._ "Av,
a ..
a._k.a. "Poony,"
a.k.a. "Renegadell,"
a.k.a. "DvdSVrgs,"
'

[28] John Doe #2,
a.k.a.
a.k.a,
[29] Marko Leopard,
a.k.a. "Leopardmk,"

22

[30] J ohrt Doe #3,
4

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 5 of 45

'.

1

a.k.a. ·"Scotish,"

2

[31] Aldo Ymeraj,
a.k.a. "Niii.in,"
a. k.a. "Kb
u anez1,.,,
a.k.a. "Yankeeman,"

3
4
5
6

7
8
9

10

[32] John Doe #4,
a.k.a. "Best4Best,"
a.k.a. "Wazo," ·
a.k.a. "Mod.mod,"
k a. "Alone 1"
a. ..
, .
a.k.a. "Shadow,"
a.k.a·. "Banderas,"
a.k. a. "Banadoura,"
[33] Liridon Musliu,
a.k.a. "Ccstore,"
a.k.a. "Bowl,"
a:k.a. "Hulk,"

11
12

[34] John Doe #5,
a.k.a. "Deputat,"
a.k.a. "ZoOmer,"

13

[35] Mena Mouries Abd El-Malak,
14 a.k.a. "Mina Morris"
a.k.a. "Source,"
15 a.k.a. "Mena2341,"
. a.k.a. "MenaSex,"
16
[36] John Doe #6,
17 a.k.a. "Goldenshop,"
a.k.a. "Malov,"
18
Defendants.
19
20

21
22

5

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 6 of 45

1

THE GRAND JURY CHARGES THAT:

2

GENERAL ALLEGATIONS

3

These General Allegations are realleged and incorporated by reference in

4

Count One (Conspiracy to Engage in a Racketeer Influenced Corrupt Organization).

5

Introduction

6

1.

At all times relevan~ to this Indictment, the defendants, and others known

7

and unknown to the grand jury, were members and associates of a criminal organi-

8

zation, herein referred to as the "In:fraud Organization," which engages in, among

9

other things, acts of ide:qtity theft and financial fraud. These acts include, but are

10

not limited to: money laundering; trafficking in stolen means of identification; traf-

11

ficking in:, production and use of counterfeit identification; identity theft; trafficking

12

in, production and use of unauthorized and counterfeit access devices; bank fraud;

13

and wire fraud, as well as services associated with all of the above. The Organization

14

operates in the District of Nevada and elsewhere.

15

2.

A primary purpose of the Infraud Organization is to promote and grow in-

16

terest in the Infraud Organization as the premier destination for carding, and to

17

direct traffic and potential purchasers to the automated vending sites of its mem-

.18

bers, which serve as online instruments that traffic in stolen means of identification,

19

personally-identifying information, stolen financial and banking information, and

20

other illicit goods. As of March 2017, there were .10,901 member accounts on the

21

Infraud Organization's discussion forum.

22

6

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 7 of 45

1

2

Definitions
3.

The following are definitions for terms used throughout this Indictment:

3

a. "AVS" or "automated vending site" are used to describe automated

4

websites that do not require human intervention to function, and that are. used by

5

~nfraud members to purchase and sell illicit goods.

6

b. "Bulletproof Hosting'' and "Abuse Hosting'' are services provided

. 7 by a domain or web hosting firm that allows their customers considerable leniency
8

in the kinds of material the customer distributes from the firm's servers. Such ma-

9

tetiafmay include spam, compromised.credit card data, high yield investment prod-

IO

11

uct ("Ponzi") schemes, online gambling, and· malware distribution infrastructure.
c.

"Carded travel services" are services :wherein the vendor books

12

things such as airline or train tickets, hotel rooms, rental cars, sporting or entertain-

13

ment event ticket, or other items for his or her customer. These bookings are made

14 using frauduient or stolen credit card numbers. In exchange, the customer pays the
15 vendor a fract.ion of the face value of the items booked-typically, 20-30%.

16

d. "Carding'' refers to the general concept of purchasing retail items with

17

counterfeit credit cards or stolen credit card information. Such scheme may involve

18

a counterfeit credit _card that has been encoded with the legitimate victim account

19

information, and is presented to a store's cashier by the offender. Often, various

20

false identification documents are-used to facilitate this fraud. "Carders" is a term

21

used by members of a carding organization to describe themselves.

.

.

22

7

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 8 of 45

1

e. "CVV'' and "fulls" refer to compromised credit card account data that

2

typically contains all of a cardholder's information except for information encoded on

3

the magnetic track on the rear of the card. This account data generally includes ap.

4

account holder's name, date of birth, social security number, address, telephone and

5

mother's maiden name, as well as the security code on the re3:-1" of the credit card.·

6

· f.

"Dumps" are compromised credit card account data.
..

7

g. "Drop" can have several different meanings depending on the context

8

in which it is used, but generally refers to a location or individual able to securely

9

receive and then forward goods obtained via carding or other types of fraud. A typical

10
11
12

drop service request might be: "Do you have a drop I ~an ship a laptop to?".
h. "Forum" and "Website" are terms used interchangeably to describe
the online gathering place used as a meeting location for Infraud members.

13

. i. "Holograms" are labels with a hologram printed onto them for secu-

14

rity reasons. They are commonly found on genuine credit cards and identifications.

15

j. "ICQ" is a free instant messaging electronic communicatJ.on service, or

16

"chat" service. ICQ user accounts are identified by a Universal Identification Num-

17

ber, or "UIN." An ICQ user may store frequently-contacted UINs in a ''buddy list."

18

k. "Internet Protocol address," and "IP address," refer to a network

19

identifier used by a computer to access the Internet. IP addresses are assigned to

20

computers by the Internet Service Provider they use to access the Internet.

21
22

8

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 9 of 45

1

1. "Liberty Reserve" was an online currency utilized by Infraud mem-

2

bers to facilitate the sale and purchase of compromised access devices, personal iden-

3 tifying information, malware and the services associated with such.

_4

m. "Malware" is hostile or intrusive software that can be used to com-

5 promise end-user PCs and smartphones or retail point-of-sale ("POS") systems,
6

_among other 'things. Although functionality varies, malware is often used to harvest

7

personally-identifying information and financial q_ata, to gather intelligence for later

8

use in a fraud scheme, ·or to electronically and unlawfully monitor victims.

9

n. "PRP" stands for "PHP: Hypertext Preprocessor," and is a program-

10 . ming/scripting language commonly used to create interactive websites, such as

11 AVSes, as well as other Internet-related tools and applications. ·
12

o. "PM" means "Private Message." These are· any non~public messages

13

sent between users on a website or service, such as the Infraud Organization's forum.·

14

p. "Proxy" and "''Proxy Server" describe a co:m.puter that acts as an in-

15 termediary in a client's Internet connection, relaying that client's Internet request
16 to its ultimate destination on the Internet and relaying back the destination's re-

17

sponse or content to the client. Proxies are often used to provide a degree of ano-

18

nymity by obscuring the user's ·oi;iginating IP address. Generally, the traffic itself

19

between a proxy server and its client is unencrypted.

20

q. "Ripper" refers to a vendor of illicit goods of poor quality, or one who

21

did not deliver the goods promised in a transaction. h1fraud leadership routinely

22 policed the forum for rippers, disciplining them to protect the general membership.

9

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 10 of 45

1

r. "Virtual Private Network" and "VPN'' describe a connection con.fig-

2

uration very similar to that involved with a proxy server, except that a VPN forms

3

an encrypted tunnel from the client to the VPN server, thus providing a layer of

4

privacy to the data traffic being exchanged between the client and the VPN.

5

s. "Web Hosting" services maintain server computers connected to the

6

Internet. Their customers use those computers to operate websites on the Internet.

7

Customers of web hosting companies pl3:ce files, software code, databases, and other

8

data on servers that they wish to be accessible on the Internet. The Infraud Organi-

9

zation's website is an example of something that is provided via a web host.

Structure and Operation of the Enterprise

10

11

4.

At all times relevant to this Indictment,

12

[1]

13

[2]
[3]

14

[4]

15

[5]
[6]

16

[7]

[8]

17
[9]

18

[10]

19

[11]
[12]

20
. [13]
21

[14]

[15]

22

Svyatoslav Bondarenko, a.k.a. "Obnon," "Rector," "Helkern";
Sergey Medvedev, a.k.a. "Stells," "Segmed," "Serjbear";
Amjad Ali, a.k.a. "Amjad Ali Chaudary," "RedruMZ," "Amjad
Chaudary";
Roland Patrick . N'Djimbi Tchikaya,. a.k.a. "Darker,"
"dark3r.cvv";
Arnaldo Sanchez Torteya, a.k.a. "Elroncoluna";
Miroslav Kovacevic, a.k.a. "Goldjunge";
Frederick Thomas, ·a.k.a. "Mosto," "lstunna," "Bestssn";
Osama Abdelhamed,
a.k.a.
''MrShrnofr,"
"DrOsama,"
"DrOsamal";
Besart Hoxha, a.k.a. "Pizza";
Raihan Ahmed, a.k.a. "Chan," "Cyber Hacker," "Mae Tony,"
"Tony";
Andrey Sergeevich Novak, a.k.a. "Unicc," "Faaxxx," "Faxtrod";
Valerian Chiochiu, a.ka. "Onassis," "Flagler," "Socrate,"
"Eclessiastes";
John Doe #8, a.k.a. "Aimless88";
Gennaro Fioretti, a.k.a. "DannyLogort," "Genny_ Fioretti"; ·
Edgar Rojas, a.k.a. "Edgar Andres Viloria Rojas," "Guapo,"
"Guapol998," "Onlyshop";

10

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 11 of 45

1

[16]

2

[1.7]
[18]
[19]

3

. [20]
[21]
[22]

4

5
6

[23},

7

[24]

8

[25]
[26]
[27]

9

[28]
[29]
[30]
. [31]
[32]

10

11
12

14

[33]
[34]
[35]

15

[36]

13

John Telusma, a.k.a. "John Westley Telusma," "Peterelliot,"
"Pete," "Pette";
Rami Fawaz, a.k.a. ''Validshop," "Th3d," "Zatcher," "Darkeyes";
Muhammad Shiraz, a.k.a. "Moviesta:r," "Leslie";
Jose Gamboa, a.k.a. "Jose Gamboa-Soto," "Rafael Garcia," "RafaellOl," "Memberplex2006," "Knowledge'';
Alexey Klimenko, a.k.a. "Grandhost";
Edward Lavoile, a.k.a. "Eddie Lavoie," "Skizo," "Eddy Lavoile";
Anthony Nnamdi Okeakpu, a.k.a. "Aslikel," "Aslike," "Moneymafia," "Shilonng";
. Pius. Sushil Wilson, a.k.a. "FDIC," "TheRealGuru," "TheReal.GuruNYC," "RealGuru," "Polson," "Infection," "Infected'';
Muhammad Khan; a.k.a. "CoolJ2," "CoolJ," "Secureroot," "Securerootl,>' "Secureroot2, "Mohammed Khan";
John Doe #7, a.k.a "Muad'Dib";
· John Doe #1, a.k.a. "Carlitos," "TonyMontana";
David Jonathan Vargas, a.k.a. "Cashmoneyinc," "Avb," "Poony,"
"Renegadell," "DvdSVrgs";
John Doe #2, a.k.a.
"a.k.a.
;
Marko Leopard, a.k.a. "Lepoardmk";
John Doe #3, a.k.a. "Scotish";
Aldo Ymeraj, a.k.a. "Niii.in," "Kubanezi," "Yankeeman";
John Doe #4, a.k.a. "Best4Best," "Wazo," "Modmod," "Alonel,"
"Shadow," "Banderas," "Banadoura";
. "d on M us1·1u, a. k .a. "Ccst ore, " "Bowl"
, "Hu lk" ;
L 1r1
John Doe #5, a.k.a. "Deputat," a.k.a. "ZoOmer";
Mena Mouries Abd El-Malak, a.k.a. "Mina Morris," "Source,"
"Mena2341," "MenaSex,"
John Doe #6, a.k.a. "Goldenshop," "Malov";

16 .the defendants herein, and others known and unknown to the grand jury, are mem17 hers of, employed by, and associates of the Infraud Organization.. Members and as18

sociates of the In.fraud Organization operate in Las Vegas, Nevada; the United

19

States; and throughout the rest of the world.

20

5.

The Infraud Organization, including its leadership, members, and associ-

21

ates, constitutes an enterprise as defined by 18 -q.S.C. § 1961(4): that is, a group of

22

individuals associated-in-fact,. The enterprise constitutes an ongoing organization·

11

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 12 of 45

1

whose members function as a continuing unit for a common purpose of achieving the

2

objectives of the e~terprise. The enterprise is engaged in, and its activities affect,

3

interstate and foreign commerce.

4

6.

The hierarchy of the Infraud Organization includes, but is not limited to:

5

- a. Administrators, a.k.a. "4DMini57r470rz": Administrators are indi-

6

viduals that serve as a governing council of the Infraud Organization who, ·collec-

7

tively, control the destiny of the organization. The administrator(s) initially seeded

8

the Infraud Organization forum with "reputable" vendors of contraband in ord~r to

9

attract traffic and membership and grow the organization: They handle the day-to-

10

day management decisions of the Infraud Organization, as well as long term strate-

11

gic planning for its continued viability. They deter-mine which individuals are per-

12

mitted to become ari.d remain members of the Infraud Organization; the functions,

13

responsibilities and levels of access to information for all members of the organiza-

14

tion; and the rewards accorded members for their loyalty to.the organization as well

15

as the punishments meted out to members evidencing disloyalty to the organization.

16

Furthermore, they decide when, how and under what circumstances to attack and .

17

to retaliate against members of rival criminal organizations and their associated In-

18

ternet websites. The administrator(s) are accorded full access to, and privileges on,

19

the computer servers hosting the Infra'Q.d Organization's websites, and, thus, haye

20

the ultimate responsibility for the physical administration, maintenance, and, secu-

21

rity of these servers and websites.

22

12

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 13 of 45

1

b. _Super N.J;oderators,. a.k:a. "Super MODER470R5": Super Moderators

2

oversee and administer one or more subject-matter specific areas on the Organiza-

3 tion's forum that either fall within an area of their expertise or cover their geographi~
4

location, limiting their activities to editing and deleting posts by members on these

5

forums and mediating disputes. Super Moderators also frequently serve as review-

6

ers for particular products or services with which they have an expertise.

7

c. Moderators, a.k.a. "MOd3r470r2": Moderators, like Super Moderators,

8

oversee and administer one or more subject-matter specific areas on the Organiza-

9

tion's forum that either fall
within an
area of their expertise or cover
their geographic
.
.
.

10

location. However, M0derators tend to be more limited in the authority they are

11

granted, and are generally limited to moderating one or two specific sub-forums.

12

.d. Vendors, a.k.a. "Professors" or "Doctors": Vend.ors sell illicit products

13

and services to members of the Infraud Organization. These sales may occur through

14 ~he vendor's own website, to which would-be purchasers are directed by the adver15

tisements they pay for and place on the Infraud Organization's web forum. Such

16

sales may also

17

or ICQ. Products sold by vendors are reviewed on the forum by Infraud members, to

18

ensure that vendors of low-quality goods.do not remain in business with the Organ-

19

ization. This helps to cement the Organization's reputation as a premiere online des-

20

tination for safe, high-quality and readily-available fraud-related contraband.

OGcur

directly between the vendor and customer, i.e. via email, PM,

21

e. VIP Members, ~.k.a. "Fratello .Masons" or "Advanced Members":

22

These are some of the premiere members of the Infra~d Organization. 'J;'he leaders

13

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 14 of 45

1

of the Organization bestow this title upon longstanding or otherwise notable mem-

2

bers in order to distinguish them from the general membership and from vendors.

3

f. Members, a.k.a. "Phr4Ud573r": General members of the Infraud Or-

4

ganization typically use the organization's websites to gather and provide infor-

5

mation about perpetrating criminal activity; to share information with and soli~it

6

other members to engage in their criminal schemes; to us~ the website's vendors to

7

facilitate their unlawful purchases of credit card dumps, false .identification docu-

8

ments, and other contraband; and in order to have their individual disputes with

9

other Organization members settled by the Administrator(s) or Moderators.

10

7.

Members join the Infraud Organization via an online forum. To be granted

11

membership, an Infraud Administrator must approve the request. Once granted

. 12

membership, members can post and. pay for advertisements within the Infraud fo-

13

rum. Me.mbers may move up and down the Infraud hierarchy. The Infraud Organi-

14 zation conti:r;rnously screens the wares and services of the vendors within the forum
15

to ensure quality products. Vendors who are considered subpar are swiftly identified

16

and punishe'd by the Infraud Organization's Administrators.

17

The Defendants

18

· 8. · At various times relevant to this Indictment, the following individuals,

19

among others, were members or associates of the Infraud Organizatio:r;i in the vari-

20

ous capacities or ranks set forth below, carrying out ~nd agreeing to carry out various

21

activities in furtherance of the enterprise described in this Indictment:

22

[1]

Svyatoslav Bondarenko created the Infraud Organization in October of 2010. In addition to being one of the Organization's de facto
14

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 15 of 45

leaders, by virtue of his standing, Bondarenko [1] held the rank
of Administrator within the
Organization. In 2015,
Bondarenko [1] stopped posting on and/or using Infraud.

1

2
3

[2]

Sergey Medvedev was a co-founder of the Infraud Organization
with Bondarenko [1], and was an active member on the Organization's website since November of 2010. Medvedev [2] is one of
the Organization's leaders, and also holds the rank of Ad:ministrator within the Organization. Medvedev [2] operates an "escrow"
or currency exchanging service for the benefit ofinfraU:d Organization members engaging in transactions with other members, to ensure the integrity of those transactions. After Bondarenko
[1] went missing in 2015, !V[edvedev [2] took his place as owner
and administrator of the Infraud Organization.

[3]

Amjad Ali became a member of the Infraud Organizatio~ in December of 2010. Ali [3] is a vendor of CVVs, and has since been
elevated by Medvedev [2] to Super Moderator status.

[4]

Roland Patrick N'Djimbi Tchikaya became a member of the Infraud Organization in January of 2011. He advertises in the Organization as a Vendor of CVVs and operates the "d4rksys.cc" website
to sell CVVs to Organization membership.

[5]

Arnaldo Sanchez Torteya became a member of the Infraud Organization in November of 2010. He was promoted to VIP Member
in December of 2010 by Bondarenko [1], and advertises in the
Organization as a seller of CVVs and lookups of credit profile and/or
personally-identifying .information.

[6]

Miroslav Kovacevic became a member of the Infraud Organization in November of 2010. He advertises within the Organization
as a Vendor of plastics, templates,. and scans.

[7]

Frederick Thomas became a member of the Infraud Organization.
in October of 2011. He advertises within the Organization as a Vendor of a Social Security Number and date of birth lookup service.

[8]

Osama Abdelhamed became a member of the Infraud Organization in September of 2013. He advertises as a Ve:i;i.dor of dumps
within the Organization, and operates the "iswipe.cc" and
"iswipe.pf' websites as outlets to sell dumps to Infraud Organization members and associates.

4

5
6

7
8
9

10

11
12
13

14
15

16

17
18
19
20
21

22

15

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 16 of 45

1

[9]

Besart Hoxha became a member of the Infraud Organization in
January of 2011. He advertises within the Organization as a Vendor of "High Quality Plastics & Holos - VISA, MasterCard, Amex,
Discover," and sells plastic card stock and holograms to Infraud Organization members and associates.

[10]

Raihan Ahmed became a member of the Infraud Organization in
January of 2011.-He is a Vendor of compromised PayPal accounts,
selling to Infraud members and associates.

[11]

Andrey Sergevich Novak became a member of the Infraud Organization in January of 2013. He advertises as a Vendor of CyYs,
and operates the "uniccshop.ru" website as an outlet to sell CVVs
to Infralid Organization members and associates.

[12]

Valerian Chiochiu became a member of the Infraud Organization
in December of 2012. He is a member within the Organization, and
provides guidance to other members on the development, deployment, and use of random access memory ("RAM") point-of-sale
("POS") malware as a means of harvesting st.olen data.

[13]

John Doe #8 became a member of the Infraud Organization in
April of 2011. He operates and advertises as a Vendor of compromised online bank logins. within the Organization.

. [14]

Gennaro Fioretti became a member of the Infraud Organization
in December of 2010, and was later promoted to VIP Member. He
is extremely active on the member forum and has made numerous
illicit.purchases from Infraud vendors and fellow members.

[15]

· Edgar Rojas became a member of the Infraud Organization in
September of 2011. He was promoted to VIP Member status by
Bondarenko [1] shortly after joining.

[16]

John Telusma became a member of the Infraud Organization in
August of 2011. He is a Vendor within the Infraud Organization,
providing "cashout" and "drop" services for Organization membership, in addition to. selling dumps·.

[17]

Rami Fawaz became a member of the. Infraud Organization in
January of 2011. Although only designated a member of the Organization, Fawaz [22] sold compromised aGcount data to Infraud O~-

2
3

4

;'

5
6

7
8
9

10

11
12
13
14
15
16
17
18

19
20
21
22

16

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 17 of 45

ganization members and associates via his well-regarded automated vending site, "validshop.su."

1
2
[18]

Muhammad Shiraz became a member of the In.fraud Organization in November of 2010. He advertises as a Vendor of dumps
within the Organization's forum.

[19]

Jose Gamboa became a member of the In:fraud Organization in
December of 2010. He advertises as a Vendor of custom-built ATM
skimmers within the Organization's forum.

[20]

Alexey Klimenko became a member of the In.fraud Organization
in September of 2011. He advertises as a Vendor of"Abuse Immmiity" or "Bulletproof Hosting" services that Organization members
and associates can employ to create, qperate, maintain and protect
their own online contraband stores.

[21]

Edward Lavoile became a member of the Infraud Organization in
July of 2011. Although only -designated a member, he has advertised for sale to fellow In.fraud Organization members "fresh" CVVs
that he had personally hacked from Canada.

[22]

Anthony Nnamdi Okeakpu became a member of the Infraud Organization in December of 2010. He was promoted to VIP Member
by Bondarenko [1] in April of 2014, and has also held the posts of
Moderator · and Super Moderator 1n the .Organization.

[23]

Pius Sushil Wilson became a member of the In.fraud Organization
in January of 2011.. He is a VIP Member within the Organization,
and was one of the more active In.fraud memhers, having made
hundreds of posts to the Organization's forum. ·

[24]

Muhammad Khan b_ecame a member of the Infraud Organization
in.August of 2011. He is designated as a "Vendor of Checking," and
operates a service for _Organization membership that shows
whether a given .stolen credit card number is still operable or if it
has been shut down by the bank ~or fraud.

· [25]

John Doe #7 became a member of the In.fraud Organization in October of 2011. He advertises as a Vendor of dumps within the In.. fraud Organization's forum, and operates one of the more well-re. garded· AVSes, "mdshop.org."

3

4
5
6

7
8

9

10

11
12

13
14

15
16

17
18
19
20
21
22

17

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 18 of 45

1

[26]

John .Doe #1 became a member of the Infraud Organization in
September of 2011. He advertises as a Vendor of dumps, and operates the "tonystuf[cc" and "tonymontana.cc" websites as outlets tq
sell dumps to Infraud Organization membership.

[27]

David Jonathan Vargas became a member of the Infraud Organization in August of 2011. He advertises in the Organization's forum as a Vendor of carded travel services.

[28]

John Doe #2 became a member of the Infraud Organization in
January of 2011. He advertises in the Organization as a Vendor of
drop services, and directed members to a website under his control
to complete their purchases.

[29]

Marko Leopard became a member of the Infraud Organization in
June of 2011. He operates "Abuse Immunity" or "Bulletproof Hosting" services that Organization members can employ to create, operate, maintain and protect their own online contraband stores.

[30]

John Doe#~ became a member of the Infraud Organization in November of 2010. He advertises in the Organization's forum as a
Vendor of dumps, and operates the "newnumbers.biz" website as
an outlet to sell dumps· to Infraud members and associates.

[31]

Aldo Ymeraj became a member of the Infraud Organization in November of 20.10. He advertises in the Organization's forum as a
Vendor of dumps; and operates the "niii.in" AVS as an.outlet to sell
dumps to Infraud member~ and associates.

[32]

John Doe #4 became a member of the Infraud Organization in
May of 2014. He advertises in the Organization's forum as a Vendor
of dumps, and operates the ."Best4best.su" AVS.

[33]

Liridon Musliu ·became a member of the Infraud Organizatoin in
August of 2011. He advertises in the Organization's forum as a Vendor of dumps, and operates the AVS located at the "ccstore.me,"
"ccstore.name," and "ccstore.ws" domains.

[34]

John Doe #5 became a member of the Infraud Organization in October of 2010. He is the owner and operator of the "swiped.su" and
"approved.su" AVSes, which he used to sell dumps to other Infraud
Organization members and associates.

2
3·
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22

18

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 19 of 45

1

[35]

Mena Mouries Abd El-Malak became a member of the Infraud
Organization in November of 2010. He advertises as a Vendor of
dumps within the Organization, and operated the AVS located ;:tt
"source4dumps.tv," which he used to sell dumps to other Infraud
Organization members and associates.

[36]

John Doe #6 became a member of the Infraud Organization in
January of 2011. He advertises in the Organization's forum as a
Vendor of dumps, and operates the AVS at "goldendunips.cc"

2
3

4

5

Purposes of the Enterprise

6

7

9.

The purposes of the enterprise include, but are not limited to:

8

a. To enrich the members and associates of the Infraud Organization

9

through· the unlawful trafficking in: counterfeit and illegal means of identification,

10

document-making implements, counterfeit identification documents, device-making

11

equipment, and unauthorized and counterfeit access devices to include stolen credit

12

card.numbers;

l

13

.

b. To establish the Organization as the premier online destination for the

14 · purchase and sale of stolen property and other contraband, such as victims' personal
15

and financial means of identification, and forged identification documents;

16
17

c. To "educate" members in obtaining and using such property and contraband;

18

d. To direct traffic, primarily· through advertising, to member-owned

19

and/or operated AVSes and other websites to. generate illicit proceeds, and to thereby

20

promote the Infraud Organization as the premier online source of "reputable" ven-

21

dors and high-quality contraband.

22

19

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 20 of 45

'

1
2

.

e. To protect the enterprise and its member~ from detection, apprehension
and p:r;osecution by law enforcement; and

3

f. To preserve and protect the reputation, operations and profits of the

4

enterprise through discipline, expulsion, and other acts of.retribution against non-

5

conforming members.

6

Manner and Means of the Enterprise

7

10. The manner and means by which the defendants and their associates con-

8

duct and participate in the conduct of the affairs of the enterprise include, but are

9

not limited to, the following:

10

a. Members of the enterprise utilize an online discus~ion forum called "In-

11

fraud," with the slogan of "In Fraud We Trust," controlled by Infraud Organization

12 Administrators, .to discuss, meet, and conduct criminal activities. Such activities in13

elude the sale and purchase of stolen social security numbers, dates of birth, ad-

14

dresses, passwords, and other personally identifyin~ information and property, ad-

15

vertising services to facilitate such activity, and disseminating malware.

16

b. The Infraud Administrators bestowed specific benefits on members to

17 include the ability to pay for posted advertisements for their resp.ective AVSes, post
18 .questions related to the sale and purchase of stolen personally-identifying infor19

mation and property and the dissemination_ of malware, and obtain free samples of.

20

the "wares" of various Infraud vendors.

21

c. Members of the enterprise and their associates are classified by various

22

roles assigned to them by the leadership of the Infraud Organization. This hierarchy

20

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 21 of 45

1

was established to m,aintain order, to grow the Organization's membership, and

2

facilitate the goals of the enterprise.

to

3

d. To enforce the rules· of the enterprise, and maintain its reputation,

4

members and associates engage in the feedback or rating of various vendors on the

5

website. The system was designed to maintain the quality of contraband sold via the

6

Infraud website, as well as via associated member-owned and/or .operated vending

7

websites.

.8

e. The leadership of the Infraud Organization routinely policed the In-

9

fraud forum for "rippers" and other rule-violators, in order to ensure the quality of

10

contraband sold and to protect the reputation of the general membership of the In-

11 fraud Organization.
12

f. Members and associates strive to achieve shared anonymity, to remain

·13

as anonymous as possible in order to evade law enforcell?-ent and other "real-world"

14 or "oflline" consequences for their fraudulent and criminal activities. To that end,
15

members and associates remain anonymous even to each other. They are generally

16 referred to online and interact only via their online "nic" or "username." Members
17
18

and associates use any means possible to hide their identity.
g. Members and associates launder proceeds obtained through their un-

19 lawful activities by using, among other methods, Liberty Reserve, Bitcoin, Perfect
20

Money, W ebMoney, and other digital. currencies, to conceal the nature of the_ir pro-

21

ceeds and move the proceeds among enterprise members and associates.

22

21

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 22 of 45

1

h. Members of the enterprise and their associates use the Infraud Organ-

2

ization's website to advertise and direct buyers and sellers to their own AVSes and

3

websites. This is done to· complete sales of contraband, to create repeat customers,

4

and to elevate their status in the. Organization as "reputable" vertdors.

5

i. Members of the enterprise and their associates use various means to

6

communicate, complete transactions, and establish connections, all designed to .pro-

7

tect their anonymity, evade detection and prosecution by law enforcement, and pro-

8

vide security for the criminal organization against attacks by other rival criminal

9

organizations. These methods may include, but are not limited to, the use of:

10

· 11

i. Various website forums and chat rooms that are controlled by
the Infraud O:rgani.zation for use as their online gathering places;

12

11. Private messaging ("PM");

13

rn. E-mail;

14

1v. ICQ chat;

15

v. Proxies;

16

17
18

vi.

Virtual private networks (''VPNs"); and

v11. Protected drop sites ("drops").

COUNT ONE
Racketeering Conspiracy

19
11. Paragraphs 1 through 10 of the General Allega,tions Section are hereby re-

20
alleged and incorporated as if fully set forth herein.

21
22

22

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 23 of 45

1

12. From a date unknown, but from at -least in· or about October 2010, up

2

through and including the date of this Indictment, both dates being approximate and

3

inclusive, within the District of Nevada and elsewhere, the defendants,

5

[1]
[2]
[3]

6

[4]

7

[5]
[6]
[7]
[8]

4

8
9

10

11

[9]
[10]
[11]
[12]

12
13

[13]
[14]
[15]

14
[16]
15
[17]
16
17

[18]
[19]

19

[20]
[21]
[22]

20

[23]

21

[24]

22

[25]
[26]

18

Svyatoslav Bondarenko, a.k.a. "Obnon," "Rector," "Helkern";
Sergey Medvedev, a.k.a. "Stells," "Segmed," "Serjbear";
Amjad Ali, a.k.a. "Amjad Ali Chaudary," "RedruMZ," "Amjad
Chaudary";
Roland Patrick N'Djimbi Tchikaya, a.k.a. "Darker,"
"dark3r.cvv";
Arnaldo Sanchez Torteya, a.k.a. "Elroncoluna";
Miroslav Kovacevic, a.k.a. t'Goldjunge";
· k Th omas, a..k.a. "Most o, " "1 s t unna, " "Best ssn";
F re.d er1c
Osama Abdelhamed,
a.k.a.
"MrShrnofr,"
"DrOsama,"
"DrOsamal";
Besart Hoxha, a.k.a. "Pizza";
Raihan Ahmed, a.k.a. "Chan," "Cyber Hacker," "Mae Tony,"
"Tony";
Andrey Sergeevich Novak, a.k.a. "Unicc," "Faaxxx," "Fax:trod";
Valerian Chiochiu, a.k.a. "Onassis," "Flagler," "Socrate,"
"Eclessiastes"; ·
John Doe #8, a.k.a. "Aimless88";
Gennaro Fioretti, a.k.a. "DannyLogort," "Genny Fioretti";
Edgar Rojas, a.k.a. "Edgar Andres Viloria Rojas/' "Guapo,"
"Guapo1998," "Onlyshop";
.
John Telusma, a.k.a. "John Westley Telusma," "Peterelliot,"
"Pete," "Pette";
Rami Fawaz, a.k.a. "Rami Imad Fawaz," "Validshop," "Th3d,"
"Zatcher," "Darkeyes";
Muhammad Shiraz, a.k.a. "Moviestar," "Leslie";
Jose Gamboa, a.k.a. "Jose Gamboa-Soto," "RafaellOl," "Memberplex2006," "Knowledge";
·
Alexey Klimenko, a.k.a. "Grandhost";
Edward Lavoile, a.k.a. "Eddie Lavoie," "Skizo," "Eddy Lavoile";
Anthony Nnamdi Okeakpu, a.k.a. "Aslikel," "Aslike," "M~neymafi.a," "Shilonng";
Pius Sushil Wilson, a.k.a. "FDIC," "TheRealGuru," "TheRealG_uruNYC," "RealGuru," "Polson," "Infection," "Infected";
Muhammad Khan, a.k.a. "CoolJ2," "CoolJ," "Secureroot,". "Securerootl," "Secureroot2," "Mohammed Khan'';
John Doe #7, a.k.a ''Muad'Dib";
John Doe #1, a.k.a. "Carlitos," "TonyMontana";
23

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 24 of 45

1

[27]

2

[28]
[29]
[30]
[31]
[32]

3

4

6

[33]
[34]
[35l

7

[36]

5

David Jonathan Vargas, a.k.a. "Cashmoneyinc," "Avb," "Poony,'·'
.
"Renegade 11,'' "DvdSVrgs";
John Doe #2; a.k.a.
' "a.k.a.
Marko Leopard, a.k.a. "Lepoardmk";
John Doe #3, a.k.a. "Scotish";
Aldo Ymeraj, a.k.a. "Niii.in,'' "Kubanezi,'' ''Yankeeman";
John Doe #4, a.k.a. "Best"Best,'' "Wazo," "Modmod," "Alonel,''
"Shadow,'' "Banderas,'' "Banadoura";
Liridon Musliu, a.k.a. "Ccstore,'' "Bowl,'' "Hulk";
John Doe #5, a.k.a. "Deputat,'' a.k.a. "ZoOmer";
Mena Mouries Abd El-Malak, a.k.a. "Source,'' "Mena2341,''
"MenaSex"
John Doe #6, a.k.a. "Goldenshop," "Malov"; ·

8

together· with others known and unknown to the grand jury, being persons employed

9

by and associated with the In.fraud Organization, an enterprise as described more

10

fully above, which engaged in, and the activities of which affected, interstate and

11

foreign commerce, did knowingly, willfully, and unlawfully combine, conspire, con-

12

federate, and agree with one another to violate 18 U.S.C. § 1962(c), that is, to con-

13 ·duct and participate, directly and indirectly, in the conduct of the affairs of said en14 terprise through a pattern of racketeering activity, as defined in 18 U.S.C. §§ 1961(1)
15

and (5), consisting of multiple acts indictable under the following provisions of fed-

16

eral law:

17

a. 18 U.S.C. § 1028, fraud and related activity in connection with identifi-.

18

cation documents, ·authentication features, and information; and

19

b. 18 U.S.C. § 1029, access d~vice fraud; and

20

c. 18 U.S.C. § 1343, fraud by wire, radio, or television; and

21

d. 18 U.S.C. § 1344, bank fraud; and

22

e. 18 U.S.C. § 1543, forgery or false use of passport.

24

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 25 of 45

1

13. It was a part of the conspiracy that each defendant agreed that a conspirator

2

would commit at least two acts of racketeering activity in the conduct of the affairs

3

of the enterprise.

Overt Acts

4
5

14. In furtherance of the conspiracy and to achieve the object and purposes

6

thereof, the defendants, and others known and u)J.known to the grand jury, per-

7

formed or caused to be performed the following overt acts, among others, in the Dis-

8

trict of Nevada, and elsewhere:

9

14.1 · On or about October 14, 2010, Bondarenko [1] officially opened

10

the Infraud website for business and announced it to potential members, promising

11

Infraud as a "comfortable and safe" place to "bring together professional people for

12

who carding and hacking become a lifestyle."

13

14.2 On or about November 11, 2010, Shiraz [18] posted an adver-

14 tisement on the In.fraud forum, offering credit card dumps for sale to Infraud mem15

16

bers and associates and providing his ICQ DIN for contact information.

14.3 On or. about November 12, 2010, Bondarenko [1] posted the

17 . rules of the Infraud Organization that governed member conduct.

18
19

14.4 On or about November 12, 2010, Bondarenko [1] prohibited
any advertising on the Infraud site except that approved by the leadership.

20

14.5 On or about November 12, 2010, Bondarenko [1] announced

21

that he was the Administrator and Medvedev [2] was the designated escrow service

22

provider for the In.fraud Organization.

25

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 26 of 45

1

14.6

On or· about November 30, 2010, Kovacevic [6] posted an ad-

2

vertisement on the Infraud Organization forum, calling himself the "Plastic, Tem-

3

plate & Scans King," and offering those items for sale to Infraud membership.

4

14. 7

On or about December 25, 2010, Medvedev [2] posted details
.

.

5

about the official "Escrow" service provider for the Infraud Organization-himself-

6

and the price associated with his services for Infraud members.

7
8
9
10
ll
12

14.8

On or about January .7, 2011, John Doe #2 [28] recruited an

individual to become a drop for merchandise.
14.9

On or about January 11, 2011, Bondarenko [1] listed members

that had been banned from accessing the Infraud Organization forum.
14)0 On or about February 1, 2011, Ymeraj [31] posted two compromised credit card dumps on the. I?Jfraud forum as a sample of his wares. ·

13

· 14.11 Between on or about February 2, 2011 through on or· about Feb-

14

ruary 23, 2011, Medvedev's 12] escrow service was used by two Infraud members

15

to complete a criminal transaction.·

16

14.12 On or about February 24, 2011, N'Dji:n;ibi Tchikaya [4] pur~

17

chased 10 compromised credit card numbers from Unindicted co-conspirator CC.

18

14.13 On or about March 6, 2011, Shiraz [18] posted two free dumps

19

for the use of Infraud members and associates on the Infraud forum.

20

14.14 On or about March 9, 2011, Bondarenko [1] ·prohibited mem-

21

bers from buying and selling stolen access devices and other contraband belonging

22

to victims within the Cqmmonwealth of Independent States, a.k.a. Russia.

26

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 27 of 45

1
2
3

4

14.15 On or about March 25, 2011, Doe #3 [30] posted three compromised credit card dumps on the In.fraud forum as a sample of his wares. ·

14.16 On or about April 23, 201.1, Doe #4 [32] sent dozens of compromised credit card dumps to Unindicted Co-conspirator AA.

5

14.17 In or about May, 2011, Abdelhamed [8] purchased multiple

6

compromised credit card numbers from Fawaz [17], to include a compromised credit

7

card number from an individual residing in Nevada.

8

14.18 Or about May 22, 2011, Doe #8 [13] posted an advertisement

9

selling United Kingdom bank ~ogins. On or about May 26, 2011, Doe #8 [13] indi-.

10

cated he had 795,000 HSBGlogins available.

11

14.19 On or about May 30, 2011, Gamboa [19] advertised credit card

12

skimmers for sale to Infraud members and associates, as- well as his post-sale sup-

13

port services for purchasers, on the Infraud forum .

. 14
15
16
17
18
19
20
21

14.20 On or about July 10, 2011,· Doe #4 [32] sent numerous compromised credit card numbers to Unindicted Co-conspirator AA.

14.21 On or about July 27, 2q11, Unindicted Co-conspirator Q purchased a credit card skimmer from Gamboa [19]. ·

14.22 (?nor about July 28, 2011, Unindicted Co-conspirator Mordered counterfeit identification from Kovacevic [6] ..

14.23 On or about August 11, .2011, Unindicted Co-conspirator M
ordered counterfeit identification from Kovacevic [6].

22

. 27

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 28 of 45

1
2
3

4
5·

6
7

8
g·

14.24 On or about August 18, 2011, Telusma [16] received in excess
of 15 compromised credit card numbers from Unindicted Co-conspirator A.
14.25 On or about August 30, 2011, Gamboa [19] sold a credit card
skimmer to Unindicted.Co-conspirator D.
14.26 On or about September 3, 2011, Muslin [33] advertised his
online store on the Infraud website.
14.27 Ori or about September 12, 2011, Doe #8 [13] sent the full bank
login information of an individual to Unindicted Co-conspirator P via email.
14.28 On or about September 15, 2011, Unindicted Co-conspirator

10 A sent Telusma [16] in excess of 15 compromised credit card dumps via email.

11

14.29 On or about September 19, 2011, Klimenko [20] advertised his

12 "Abuse.Immunity" hosting services on the Infraud forum, offering 'to host illicit web13

sites for Infraud members and associates.

14

14.30 On or about October 3, 2011, Ymeraj [31] adyertised on the In-

15

fraud forum his fulls website, "bastard.su," which sold credit card fulls to Infraud

16

members and associates.

17
18
19
20
21
22

· · 14.31 On or about October 8, 2011, Doe #2 [28] posted an advertisement on the Organization forum offering drop services to tlie Infraud membership.
14.32 On or about October 9, · 2011, Unindicted Co-conspirator X
purchased in excess of 15 CVVs from Doe #7 [34].
14.33 On or about October 11, 2011, Ymeraj [31] posted 10 compro;mised PayPal logins on the Infraud forum for use by Infraud members.

28

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 29 of 45

1
2
3

·4
5

14.34 On or about October 11, ~011, Bondarenko [l] posted dozens of
compromised PayPal login credentials to the Infraud forum for members.
14.35 · On or about November lQ, 2011, Doe #1 [26] -posted free dumps
for Infraud members as a sample of his wares.
14.36 On or about November 11, 2011, Doe #3 [30] posted two compro)

6

mised credit card· dumps for Infraud members as a sample of his wares.

7

14.37 From on or about November 13, 2011 to on or about June 13,

8

2013, Thomas [7] ran an AVS that provided a "look-up" service of compromised so-

9

cial security and date of birth personally-identifying information.

10

14.38 On or about November 18, 2011, Unindicted Co-conspirator

11

N used Thomas' [7] automated PII search to unlawfully obtain the personally-iden-

12

tifying information of R.Q.N., R.F.K., A.J.S.; and other individuals.

13

14.39 .On or about November 28, 2011, Bondarenko [1] began a

· 14 thread on the Infraud forum for moderators to document any members they elected
15
16
17
18

to ban from the forum and their reasons for doing so.
14.40 On or about December 22, 2011, Sanchez Torteya [5] sent in
excess of 15 compromised credit cards to tJnindicted Co-conspirator E:
14.41 On or about January 13, 2012, Hoxha [9] posted in Unindicted

19 · Co-conspirator F's Infraud vendor advertisement, vouching for his products and
20
21
22

stating that Unindicted Co-conspirator Fis "the best guy ever."
.. 14.42 On or about January 13, 2012, Lavoile [21] sent more than 500
compromised credit card numbers to Unindicted Co-conspirator G.

29

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 30 of 45

1

14.43 On or about January 18, 2012, N'Dji:µibi Tchikaya [4] posted

2

an advertisement for his on.line store, "d4rksys.cc" on the Infraud.forum. In the ad-

3

vertisement, he indicated he had "high quality" credit card dumps, compromised

4

PayPal accounts, and other types of "Hacked Stuffs" for sale.

5
6

14.44 On or about February 14, 2012, Ali [3] iVouched for Fawaz's [17]
online dumps store, "validshop.su," in a post on the Infraud forum.

7

14.45 On or about March 7, 2012, Sanchez Torteya [5] sent in excess

8

of 15 compromised credit card numbers to Hoxha [9] in order for Hoxha [9] to

9

t:_ransfer those numbers onto plastic for use.

10
11

14.46 On or about March 23, 2012, Fioretti [14] posted .10 comproraised credit card dumps for the use of other members on the Infraud forum.
· 14.47 From on or about April 26, 2012 to on or about March 1, ·2013,

13

Vargas [27] purchased 31 CVVs from Doe #5 [34].

14

14.48 On or about March 30, 2012 to on or a_bout April 18, 2012, Mus-

15

liu [33] offered for sale on his AVS "ccstore" in excess of 15 compromised credit card

16

numbers belonging to individuals residing

17
18

mNevada.

14.49 On or about April 14, 2012, Bondarenko [1] set uniform advertising prices for vendors in the Infraud Organization..

19

14.50 From on or about April 24, 2012 to on or about May 7, 2012,

20

Ali[3] purchased in excess of 130 compromised credit card dumps from Musliu [3-3].

21

14.51 From on or about April 26, 2012 to on or about March 1, 2013,

22

Unindicted Co-conspirator Ypurchased ~ excess of 30 CVVs from Doe #.5 [34].

30

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 31 of 45

1

14.52 From on or about May 31, 2012, to on or about July 23, 2012,

2

Okeakpu.[22] purchased 6 compromised credit card fulls, including the personally-

3

identifying information of the victims, from Doe #8 [13]. _

4

14.53 On or about June 8, 2012, Shirai [18] posted two free dumps for

5 the use of Infraud members and associates to the Infraud forum.
6

14.54 On or about June 27, 2012, Unind:icted Co-conspirator L used

7

Thomas' [7] automated lookup system to.unlawfully obtain the personally-identify-

8

ing information of S.C.C., D.J.S., J.H.W., and other individuals.

9

14.55 On or about July·7, 2012, Khan [24] advertised on the Infraud

10

forum for his dumps checking service, "dumpscheck. us," and solicited business from

11

Infraud members and associates needing to check their dumps.

12
13
14
15
16

14.56 On or about July 7, 2012, Khan [24] advertised on the Infraud
forum, offering credit card counterfeiting equipment for sale.
14.57 On or about July 10, 2012, Unindicted Co-conspirator U purchased checking services from Khan [24].
14.58 On o:r about July 31, 2012, Unindicted Co-conspirator T pur-

17 · chased checking services from. Khan [24].
18

14:59 On or about August 9, 2012, Vargas [27] purchased two CVVs

19 ·from Musliu [33).
20

14.60 Q_n or about August 16, 2012 to on or about September 4, 2012,

21

Medvedev's [2] escrow service was 1=1-sed by Doe #7 [25] and another Infraud mem-

22

her to complete a criminal transaction.

31

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 32 of 45

1

14.61 On or about September 9, 2012, Bondarenko [1] set out the

-2

process by which new vendors would become verified within the Infraud Organiza-

3

tion. Bondarenko [1] mandated that, prior to verification, would-be vendors must

4

provide samples to the In.fraud ieadership of contraband that they intended to sell,

·5

in order for the leadership to ensure the quality of the· wares.

6

14.62 On or about October 16, 2012, Vargas [27] advertised for his

7

"World.Wi~e Travel Agency" on the In.fraud forum, offering to fraudulently book

8

flights, rental cars, hotels, and seats at United States concerts and sporting events

9

for In.fraud members at a fraction of their· actual price.

10

14.63 On or about October 28, 2012, Doe #7 [25] advertised on the In-

11

fraud forum, offering dumps of VISA, MasterCard, American Express, and Discover

12 · credit card
. account numbers for sale to In.fraud. members.
13

14.64 On or about October 31, 2012, Ymeraj [31] contacted "SiteAd-

14

min" on the In.fraud forum via private message requesting the purchase of banner

15

advertisement space on the forum for a one-month period.

16
17

14.65 In or about November, 2012, Unindicted Co-conspirator V
purchased compromised credit card dumps from Doe #7 [25].

18

14.66 On, about, during and between November 8, 2012, and January

19

19, 2015, Unindicted Co-conspirator B purchased 21 dumps from El-Malak Er-

20

ror! Reference source not found ..

21
22

14.67 On or about January 23, 2013, Ahmed [10] received in excess of
1300 compromised PayPal account-logins from Unindicted Co-conspirator H.

32

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 33 of 45

14.68 On or about January 26~ 2013, Wilson [23] purchased a compro-

1

2

mised credit card from the AVS operated by Muslin [33].
14.69. On or about February 6, 2013, Shiraz [18] posted a list of card-

3

4

ing websites to the Infraud Forum and stated "best is infraud:cc".
14.70 On or about March 3, 2013, Fioretti [14] sent funds via Liberty

5

6

Reserve for CVVs that he bought from Ahmed [10].

7

14.71 .On or about March 12, 2013 to on or about May 10, 2015, Unin-

8

dieted Co-cons_pirator Z purchased compromised credit card dumps from El-Ma-

9

lak [35].

10
11
12
13

14.72 On or about March 25, 2013, Hoxha [9] received in excess of 15

compromised credit cards from Uniridicted Co-conspirator 0.
14.73 On, about, during and between April 3, 2013, and May 20, 2013,

Rojas [15] used Medvedev's [2] money exchanging service.

14

. 14.74 On or about April 10, 2013, Klimenko [20] began hosting the

15

website "newnumbers.biz,." which b.elonged to Infraud member Doe #3 [28] and

16

served as an outlet for Doe #3 [28] to sell dumps to Infraud members and associates.

17

14.75 On or about April 13, 2013 to on or about April 17, 2013, Doe #2

18
19
20

[28] utilized an i~dividual unknown to the grand jury as a drop for merchandise.
14.76 On or about April 15, 2013, iloxha [9] received in excess of 15

comJ?romised credit card dumps from Unindicted Co-conspirator 0.

21
22

33

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 34 of 45

1

14.77 On or about April 16, 2013, John Doe #1 [26] posted in excess

2

of 15 compromised credit card dumps on the In.fraud forum as a sample for In.fraud

3

members.

4
.5

14. 78 On_ or about April 23, 2013, Chiochiu [12] posted a Craigslist
email-scraping PHP script on the In.fraud Organization forum.

6

14. 79 On or about April 26, 2013, Doe #3 [28] advertised on the In-

7

fraud forum for his dumps website, "newnumbers.biz," which acted as an outlet for

8

Doe #3 [28] to sell credit card dumps to Infraud_members and associates.

9
10
11

12
13
14

14.80 On or about April 27, 2013, Unindicted Co-conspirator H sent

Ahmed [10] in excess of 40 compromised credit card numbers.
14.81 On or about May 14, 2013, Chiochiu [12] posted a link to download a RAM credit card skimmer to the Infraud Organization forum.
14.82 On or about May 16, 2013, Unindicted Co-conspirator S sent

Okeakpu [22] in excess of 15 compromised credit card dumps via email.

15

14.83 On or about July 10, 2013,_ Novak [11] posted an advertisement

16

on the Infraud forum for his credit card dumps website, "uniccshop.ru.'1 That same

17

day, in the same thread, foru~ administrator Bondarenko [1] stated that No-

18

vak [ll]'s advertisement has been paid for through July 10, 2914.

19
20
21
22

14.84 On or about August 12, 2013, Unindicted Co-conspirator R
sent Lavoile [21] compromised credit card dumps.
14.85 On or about September 5, 2013, UniI1dicted Co-conspirator R
sent Lavoile [21] compromised credit card dumps.

34

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 35 of 45

1

2
3

4

14:.86 On or about September 16, 2013, Doe #8 [13].sent compromised
credit card data to another In.fraud member.
14.87 On or about October 26, 2013, Rojas [15] purchased a compromised credit card from Musliu [33].
·,

5.

-14.88 On or about October 29, 2013, Leopard [29] began handling the

6

website traffic for an AVS selling compromised credit card dumps, which was owned

7

by U nindicted Co-conspirator W.

,8

14.89 On or about November 3, 2013, Leopard [29] began hosting the

9

website "tonymontana.cc," which belonged. to· Infraud member Doe #1 [26]. and

10

served as an outlet for Doe #1 [26] to sell dumps to Infraud members and associates.

11

14.90 On or abou~ November 25, 2013, Wilson [23] purchased three

12

compromised credit cards from the AVS operated by Musliu [33].

13

14.91 On ·or about February 24, 2014 to on or about February 27, 2014,

14

Doe #2 [28] corresponded via email with an individual who was acting as a drop for

15

merchandise.

16

14.92 On or about March 1, 2014, Hoxha [9] responded to a request

17

on the Infraud forum b:y Unindicted Co-conspirator A for quality Visa and Mas-

18

terCard large and small holograms, indicating that Unindicted Co-conspirator A

19

should. contact Hoxha [9].

20

14.93 On or about March 13, 2014, Abdelhamed [8] posted 50 dumps

21

in response to a complaint on the· forum by an In.fraud member that Abdel-

22

hamed's [8] dumps were low quality.

35

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 36 of 45

1

14.94 On or about April 17, 2014, N'Djimbi Tchikaya [4] inst;ructed

2

Torteya [5] on how to join his AVS that was adve!tised on the Infraud forum and

3 · the cost associated with joining it via private message.
-14,95 On _or about·May 3, 2014, Doe #4 [32] advertised on the Infraud

4

5 forum, proclaiming "We are glad to provide you best dumps services in market!!''. and
6

espousing that he had "only" United States dumps.
14.96 On or about May 6, 2014, Doe #4 [32] updated his advertisement

7

8 via a post in the forum, listing inventory from various States, and boasting that he
9 had "120K USA updates" covering ''Visa Master Amex, Discover."
14.97

10

On or about May 24, 2014, Unindicted co-conspirator EE

11 posted in Doe #3's [30] vendor thread on the Infraud forum, inquiring if there was
12

a way that he could be added to Doe #3's [30] dumps shop: ·
14.98

13

On or about July 15, 2014, Wilson [23] posted an advertise-

14 ment on the Infraud forum soliciting sales of credit card fulls from other Infraud
15

members, stating they were needed immediately and offering prompt payment.

16
17

14.99

On or about September 3, 20i4, Ali [3] posted 30 stolen CVVs

on the In.fraud forum as a sample of his wares for members to view and use.

18

14.100 On or about September 3, 2014, Hoxha [9] posted in Unin-

19

dieted Co-conspirator DD's vendor advertisement thread on the Infraud forum,

20 warning him_ not to copy Hoxha's [9] own vendor advertisement from elsewhere on
21

the forum.

22

36

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 37 of 45

1
2

14.101 On or about September 9, 20~4, Chiochiu [12] posted information ori the Infraud Organization forum about how to make a RAM skimmer.

3

14.102 On or about October 13, 2014, Fawaz [17] sent an email to

4

Ali [3] with his vendor advertisement indicating that 700 "fulls" and 3000 "cards"

5

had been added to his AVSes.
14.103 On or about November 10, 2014, Kovacevic [6] advertised to

6
7

the Infraud forum for "scan kits" to manufacture fraudulent documents.
14.104 On or about November 17, 2014, Unindicted Co-conspirator

8
9

S sent Okeakpu [22] in excess of 15 compromised credit card dumps.
14.105 On or about December 12, 2014, Ali[3] posted in excess of 15

10
11

dumps for members to the Infraud forum.
14.106· On or about December 23, 2014, Ahmed [10] received in excess

12
13

of 1300 compromised PayPal account logins from Unindicted Co-conspirator H.
14.107 On or about January 19, 2015, Klimenko [20] began hosting

14

15. the website "torcarders.cc," which belonged to Unindicted Co-conspirator J and
16

served as his/her outlet to sell dumps to Infraud members and associates.
14.108 On or about March 2, 2015.toApril 21, 2015, Gamboa [19]

17
18

discussed the sale of skimmers to various Infraud members via private message.

19

14.109 On or about March 26, 2015, Telusma [16] requested via pri-

20

vate message that Bondarenko [1] ban another Infraud member for "ripping" him

21

on a deal.

22

37

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 38 of 45

1

14.110 On or about April 16, 2016, Medvedev [2] posted to the In-

2

fraud forum explaining that Bondarenko [1] had gone· missing, and that

3

Medvedev [2] was now "admin and owner" of the Infraud Organization.

4

14.111 Onor about July 22, 2016, Medvedev [2] posted to the Infraud

5

forum indicating that the Organization now had an "open invite" policy, and that

·6

members would be able to secure invitations for their' associates into the Infra.ud

7

Organization, proyided that the ~ould-be new members met minimum standards.

s.

14.112 On or about January 23,. 2017, Doe .#6 [36] posted an adver-

9

tisement to the Infraud forum stating that he was "ready to introduce [his] priyate

10

service" that he had been working on for over four years. It promised dumps that

11

were "high quality, fresh, and guarantee 90%+ valid."
14.113 On or about July 12, 2017, John Doe #6 [36] posted updates

J,2
13

to his Infraud vendor advertisement.

14

14.114 ·on or about August 2, 2017, John Doe #6 [36] sold in excess

15

of 15 compromised credit card dlJ.mps belonging to Nevada cardholders from his/her

16

AVS "goldenshop.cc" to an undercover agent for Homeland Security Investigations

17

("HSI").

18

14.115 On or about August 2, 2017, Novak [11] sold 15 compromised

19

credit card dumps belonging to Nevada cardholders from his AVS "unicc.at" to· an

20

undercover agent for Homeland Security Investigations ("HSI").

21
22

38

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 39 of 45

1

14.116 On or about August 4, 2017, Novak [°11] sold 54 compromised

2

credit ·card dumps for Nevada cardholders from his AVS "unicc.at" to an undercover

3

agent for Homeland Security Investigations ("HSI").

4

14.117 On or about August 8, 2017, John Doe #6 [36] sold in excess

5

of 15 compromised credit card dumps belonging to Nevada cardholders from his AVS

6

''goldenshop.cc", to an undercover agent for Homeland Security Investigations

7

("HSI").

8

9

All in violation of 18 U.S.C. § 1962(d).

FORFEITURE ALLEGATION ONE·
Racketeering Conspiracy

10

11
12

15. The allegations contained in Count One of this Criminal Indictment are

13

hereby realleged. and incorporated herein by reference for the purpose of alleging

14

forfeiture pursuant to Title 18, United States Code, Section 1963(a)(l), (a)(2), and

15

(a)(3); Title 18,.United States.Dode, Section 1028(g) and (b.); Title 18, United States

16

Code, Section 1029(c)(l)(C) and 1029(c)(2); Title 18, United States Code, Section

17

981(a)(l)(C) with Title 28, United States Code, Section 2461(c); Title 18, United

18

States Code, Section 982(a)(2)(A); Title 18; United States Code, Section 982(a)(2)(B);

19

Title 18, United .States Code, Section 982(a)(6)(A)(ii)(I) with 982(a)(6)(B); and Title

20

18, United States Code, Section 982(a)(6)(A)(ii)(II) with 982(a)(6)(B).

21
22

I

16. Upon conviction of the felony offense charged in Count One of this Criminal Indictment,

39

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 40 of 45

1
2
3
4
5

[1]
[2]
[3]
[4]
[5]
[6]
[7]
[8]

[9]
6
7

[10]
[11]
[12]

9

[13}
· [14]
[15]

10

[16]

11,

[17]
[18]
[19]

8

12

14

[20]
[21]
[22]

15

[23]

16

[24]

17

[25]
[26]
[27]

13

18
19
20
21
22

[28]
[29]
[30]
[31]
[32]
[33]
[34]

Svyatoslav Bondarenko, a.k.a. "Obnon," "Rector," "Helkerri";
Sergey Medvedev, a.k.a. "Stells," "Segmed," "Serjbear";
Amjad Ali; a.k.a. "Amjad Ali Chaudary," "RedruMZ," "Amjad
Chaudary"
.
Roland Patrick N'Djimhi Tchikaya, a.k.a. "Darker," "dark3r.cvv'';
Arnaldo Sanchez Torteya, a.k.a. "Elroncoluna";
Miroslav Kovacevic, a.k.a. "Goldjunge";
Frederick Thomas, a.k.a. "Mosto," "lstunna," "Bestssn";
Osama Abdelhamed, a.k.a. "MrShrnofr," "I;:>rOsama;» "DrOsa-mal";
Besart Hoxha, a.k.a. "Pizza";
.
Raihan Ahmed, a.k.a. "Chan," "Cyber Hacker," "Mae Tony," "Tony";
Andrey Sergeevich Novak, a.k.a. "Unicc," "Faax:xx," "Faxtrod";
.
Ch"10c.h"1u, a ..
k' a. "O nass1s,
. " "Flager,
1 " "S ocrat e," '1E c1ess1.
V a1er1an
astes";
John Doe #8, a.k.a. "Aimless88";
Gennaro Fioretti, a.k.a. "DannyLogort," "Genny Fioretti";
Edgar Rojas, a.k.a. "Edgar Andres Viloria Rojas," "Guapo,"
"Guapo1998," "Onlyshop";
John Telusma, a ..k.a. "John Westley Telusma," "Peterelliot," "Pete,"
"Pette";
Rami Fawaz, a.k.a. "Validshop," "Th3d," "Zatcher," "Darkeyes";
Muhammad Shiraz, a.k.a. "Moviestar," "Leslie";
Jose Gamboa, a.k.a. "Jose Gamboa-Soto," "Rafael Garcia," "Ra- ·
faellOl," '"Mem-berplex2006," "Knowledge";
Alexey Klimenko, a.k.a. "Grandhost";
Edward Lavoile, a,k.a. "Eddie Lavoie," "Skizo," "Eddy Lavoile";
Anthony Nnamdi Okeakpu, a.k.a. "Aslike.1," "Aslike," "Money-mafia," "Shilonng";
Pius Sushil Wilson, a.k.a. "FDIC," "TheRealGuru," "TheRealGuruNYC," "RealGuru," "Polson,"· "Infection," "Infected";
Muhammad Khan, a.k.a. "CoolJ2," "CoolJ," "Secureroot," "Se-cur-·
erootl," "Secureroot2," "Mohammed Khan";
John Doe #7, a.k.a "Muad'Dib\
John Doe #1, a.k.a. "Carlitos," "TonyMontana";
David Jonathan Vargas, a.k.a. "Cashmoneyinc," "Avb," "Poony,"
"Renegadell," "DvdSVrgs";
John Doe #2, a.k.a.
"a.k.a.
;
Marko Leopard, a.k.a. "Lepoardmk";
John Doe #3, a.k.a. "Scotish"; ·.
Aldo Ymeraj, a,.k.a. "Niii.in," "Kubanezi," ''Yankeeman";
John· Doe #4, .a.k.a.."Best4Best," "Wazo," "Modmod," "Alonel,"
"Shadow," "Banderas," "Banadoura";
Liridon Musliu, a.k.a. "Ccstore," "Bowl," "Hulk";
John Doe #5, a.k.a. "Deputat," a.k.a. "ZoOmer";
40

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 41 of 45

Mena Mouries Abd El-Malak, a.k.a. "Mina Morris," "Source,"
"Mena2341," "MenaSex,"
John Doe #6, a.k.a. "Goldenshop," "Malov";

1

[35]

2

[36]

3

defendants herein, shall forfeit to the United States (1) any interest acquired

4

or maintained in violation of Title 18, United States Code, "$ection 1962; (2) any

5

interest in; security of; claim against; or property or contractual right of any kind .

6

affording a source of influence over; any enterprise established, operated, con-

7

trolled, conducted, or participated in the conduct of, in violation of Title 18, United

8

States Code, Section 19.62; and ··(3) any property constituting, or derived from, any

9

proceeds obtained, directly or indirectly, ·from racketeering activity in violation of

10

Title 18, United States Code, Section 1962;

11

defendants herein, sh~ forfeit to the United States, all illicit authentication

12

features, identification documents, document-~aking implements, or means of

13

identification in violation of Title 18, United States Code, Section 1028;

14

defendants 4erein, shall forfeit to the United States, any personal property

15

used or intended to be used to commit the violations of Title 18, United States Code,

16

Section 1029;

17

defendants herein, shall forfeit to the United _States, any property, real or

18 personal, which constitutes or is derived from proceeds traceable to violations of
19

Title 18, United States Code, Sections 1028, 1028A(a)(l) with 1028A(c)(4), (c)(5),

20

and (c)(7), 1029, 1343, 1344, or 1543, specified unlawful activities as defined in Title

21

18, United States Code, Sections 1956(c)(7)(A) and 1961(1)(B), or Title 18, United

22

States Code, Section 1962(c) and (d), conspiracy to commit such offenses;

I

41
I

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 42 of 45

1

defendants herein, shall forfeit to the United States, any property constitut-

2

ing, or derived from, proceeds obtained CD.!ectly or indirectly, as the result of viola-

3

tions of Title 18, United States Code, Sections 1343 and 1344, affecting a :financial

4

institution, or Title 18, United States Code, Section 1962(c) and (d), conspiracy to

5

violate such offenses;

6

defendants herein, shall forfeit to the United States, any property constitut-

7

ing, or derived from, proceeds obtained directly or indirectly, as the result of viola-

8

tions of Title 18, United States Code, Sections 1028 and 1029, or Title 18, United

9

States Code, Section 1962(c) and (d), conspiracy to violate such offenses;

10

defendant herein, shall forfeit to the United States, any property real or per-

11

sonal that constitutes, or is derived from or is traceable to the proceeds obtained

12

directly or indirectly from the commission of violations of Title 18, United States

13

Code, Sections 1028 and 1543, or Title 18, United States Code, Section 1962(c) and

14

(d), conspiracy to violate such offense; and

15

defendant herein, shall forfeit to the United States, any property real or per-

16

sonal that is used to facilitate, or is intended to be used to facilitate, the commission

17

of violations of Title 18, United States Code, Sections 1028 and 1543, or Title 18,

18

United States Code, Section 1962(c) and (d), conspiracy to violate such offenses;
· specific property to be identified pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);

19
20
21
22

and
an in personam criminal forfeiture money judgment including, but not limited to, at least

42

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 43 of 45

1
2
3

4

5
6

7
8
9

. 10

11
12
13
14
15
16
17
18

Bondarenko [l], to be calculated pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);
Medvedev [2], to be calculated pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);·
Ali [3], to be calculated pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);
Tchikaya [4], $500,000;
Torteya [5], to be calculated pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);
Kovacevic [6], $50,000;
Thomas [7], $186,000;
Abdelhamed [8], to be calculated pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);
Hoxha [9], to be calculated pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);
Ahmed [10], $1,200,000; ·
Novak [11], $2,700,000;
.
Chiochiu [12], to be calculated·pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);
Doe #8 [13], to be calculated pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);
Fioretti [14], $70,000; ·
.
Rojas [15], to be calculated pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);
Telusma [16], to be calculated pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);
Fawaz [17], to be calculated pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);
Shiraz [18], $326,000;
Gamboa [19], $100,000;
Klimenko [20], $150,000;
Lavoile 121], $30,000;
Okeakpu [22], $50,000;
Wilson [23], to be calculated pursuant to Fed. R. Crim. P. 32.2(b)(2)(C); ·
Khan [24], $400,000;
·
·
Doe #7 [25], $300,000;
John Doe #1 [26], $1,000,000;
Vargas [27], $355,000;
John Doe #2 [28], $48,000;
Leopard [29];$70,000;.
John Doe #3 [30], $1,400,000;
Ymeraj [31], $675,000;
John Doe #4 [32], to be calculated pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);
Musliu [33], $277,725,552.33;
John Doe #5 [34], $279,612,110.41;
El-Malak [35], to be calculated pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);
John
Doe #6 [36], to be calculated pursuant
to Fed. R. Crim. P. 32.2(b)(2)(C);
.
.

19
20

(all of which constitutes property).

21
22

43

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 44 of 45

1

17. If any property being subject·to forfeiture pursuant to Title 18, United

2

States Code, Section 1963(a)(1), (a)(2), and (a)(3); Title 18, United. States Code, Sec-

3

tion 1028(g) and (h); Title 18, United States Code, Section 1029(c)(l)(C) and

4

1029(c)(2); Title 18, United States Code, Section 981(a)(l)(C) with Title 28, United

5

States Code, Section 2461(c); Title 18, United States Code, Section 982(a)(2)(A); Ti-

6

tle 18, United States Code, Section 982(a)(2)(B); Title 18, United States Code, Sec-

7

tion 982(a)(6)(A)(ii)(I) with 982(a)(6)(B); and Title 18, United States. Code, Section

8

982(a)(6)(A)(ii)(II) with 982(a)(6)(B), as a result of any act or omission of the defend-

9· ants10

a. cannot be located upon the exercise of due diligence;

11

b. has been transferred or sold to, or deposited with, a third party;

12

c. has been placed beyond the jurisdiction of the court;

13

d. has been substantially diminished in value; or

14

e. has been commingled with other property which cannot be divided with-

~5

out difficulty;

16

it is the intent of the United States of America, p·ursuant to Title 18, United States.

17

Code, Section 1963(m), to seek forfeiture· of any properties of the defendants for the

18

property listed above and the in personam criminal forfeiture money judgments

19

listed above ..

20
21
22

44

 Case 2:17-cr-00306-JCM-VCF Document 301 Filed 02/07/18 Page 45 of 45

1

All pursuant to Tjtle 18, United States Code, Section 981(a)(l)(C) with Title

2

28, United States Code, Section 2461(c); Title 18, United States Code, Sections

3

982(a)(2)(A) and 982(a)(2)(B), 982(a)(6)(A)(ii)(I) and 982(a)(6)(A)(ii)(II) with

4 · 982(a)(6)(B), 1028A(a)(l) with 1028A(c)(4), (c)(5), and (c)(7), 1028(g) and (h);
5

1029(c)(l)(C) and 1029(c)(2), 1963(a)(l), (a)(2), and (a)(3); Title 18, United States

6

Code, Sections 371, 1028; 1028A, 1029,. 1029(b)(2), 1343, 1344, 1349, 1543, 1962(c)

7

and (d); _and Title 18, United States Code, Section 1963(m).

8

DATED: this -19th day of September, 2017

9

A TRUE BILL:
. ISi
FOREPERSON OF THE GRAND JURY

10

11
12
STEVEN W. MYHRE

15
16
17
18

CHAD W .. MCHE~Y
Assistant United States Attorney
District of Nevada
DAVID A. JAFFE
Acting Chief, Organized Crime and Gang Section
U.S. Department of Justice

19
20
21
22

45