2022 Cybercrime Arrests: RaidForums, NetWalker and Other Cases
Summary
A 2022 roundup covers arrests, charges and outcomes involving cybercrime figures tied to RaidForums, Bitfinex, NetWalker, Raccoon Stealer, Silk Road and the Capital One breach.
Key points
- RaidForums administrator Diogo Santos Coelho was arrested in the UK and charged in the US; authorities seized the marketplace in a multinational operation.
- Ilya Lichtenstein and Heather Morgan were charged over an alleged effort to launder $3.6 billion in bitcoin stolen in the Bitfinex hack; investigators traced funds to accounts and cloud-stored keys.
- NetWalker affiliate Sebastien Vachon-Desjardins was extradited to the US, sentenced to 20 years, and agreed to forfeit $21.5 million.
- Mark Sokolovsky was indicted over an alleged role in Raccoon Stealer; the FBI said the malware was linked to more than 50 million unique credentials and identification items.
- James Zhong pleaded guilty to wire fraud after authorities recovered about 50,000 bitcoin connected to Silk Road thefts.
- Paige Thompson was convicted of wire fraud and unauthorized computer access related to the Capital One breach; more than 100 million users' personal information was exposed.
Article Details
- Event Type
- 2022 roundup of arrests, indictments, convictions, and law-enforcement actions involving alleged or convicted cybercriminals.
- Impact
- Authorities disrupted or seized cybercrime operations and assets, including RaidForums and NetWalker infrastructure, and pursued individuals linked to data theft, ransomware, cryptocurrency theft, and money laundering. Reported impacts included exposed personal and financial information, ransomware victims, cryptocurrency losses and seizures, and financial penalties for Capital One.
People
Diogo Santos CoelhoRaidForums administrator charged in connection with the marketplace; the source says he used the names OMNIPOTENT, DOWNLOADING, SHIZA, and Kevin MARADONA.Heather MorganCharged with conspiracy to launder bitcoin allegedly stolen in the Bitfinex exchange hack; the source says she used the persona Razzlekhan.Ilya LichtensteinCharged with conspiracy to launder bitcoin allegedly stolen in the Bitfinex exchange hack.James ZhongPled guilty to wire fraud after using Silk Road accounts and transactions to obtain bitcoin from its payment system.Mark SokolovskyUkrainian national indicted for his alleged role as a core member of Raccoon Infostealer.Paige ThompsonFormer Amazon employee convicted of wire fraud, damaging a protected computer, and unauthorized computer access related to the Capital One breach.Ross UlbrichtIdentified by the source as the creator of the Silk Road marketplace.Sebastien Vachon-DesjardinsSentenced to 20 years in prison after pleading in connection with his alleged participation as a NetWalker affiliate.
Malware
NetWalkerNetWalker Ransomware group primarily targeted healthcare and education institutions as well as other sectors such as law enforcement, companies, and emergency services.Raccoon InfostealerOn October 25, 2022 a grand jury unsealed indictment charges against Ukrainian national Mark Sokolovsky due to his alleged role in Raccoon Infostealer as a core member.
Products
BitfinexThe indictments stem from their alleged attempts to launder $3.6 billion in stolen bitcoin from the Bitfinex exchange hack.Capital OneThe former Amazon employee was responsible for a major breach in 2019 when she downloaded and posted to the darknet the personal information of more than 100 million Capital One users.RaidForumsOn Tuesday April 12, 2022, the United States Department of Justice announced the seizure of RaidForums and unsealed criminal charges against Diogo Santos Coelho, RaidForum’s alleged administrator.Silk RoadThe Silk Road was notoriously one of the first well-known and most used darknet marketplaces created by Ross Ulbricht, a.k.a Dread Pirate Roberts.
Tools
Countries
BulgariaInformation from the seizure of NetWalker’s backend servers in Bulgaria highlighted the true number of victims exploited by the group.PortugalRaidForums was taken down in Operation TOURNIQUET, which was a joint operation with Europol, the United States, the United Kingdom, Sweden, Portugal, and Romania.RomaniaRaidForums was taken down in Operation TOURNIQUET, which was a joint operation with Europol, the United States, the United Kingdom, Sweden, Portugal, and Romania.SwedenRaidForums was taken down in Operation TOURNIQUET, which was a joint operation with Europol, the United States, the United Kingdom, Sweden, Portugal, and Romania.UkraineDoxxing can be used as a form of aggression between conflicting groups, such as when 22 members from Trickbot were doxxed as part of the Russia-Ukraine cyberwar by a pro-Ukrainian affiliate.United KingdomHe was arrested on January 31 in the United Kingdom.United StatesOn Tuesday April 12, 2022, the United States Department of Justice announced the seizure of RaidForums and unsealed criminal charges against Diogo Santos Coelho, RaidForum’s alleged administrator.
Industries
EducationNetWalker Ransomware group primarily targeted healthcare and education institutions as well as other sectors such as law enforcement, companies, and emergency services.HealthcareNetWalker Ransomware group primarily targeted healthcare and education institutions as well as other sectors such as law enforcement, companies, and emergency services.