PRESS RELEASE: Another Cyber Fraud Defendant, NIKOLAY GARIFULIN Charged in Operation Aching Mules Sentenced in Manhattan Federal Court, Investigation Targeted Global Bank Fraud Scheme that Used Zeus Trojan and Other Malware to Steal Millions of Dollars from U.S. Bank Accounts

U.S. Attorney’s Office
March 23, 2012

Southern District of New York
(212) 637-2600

Another Cyber Fraud Defendant Charged in Operation Aching Mules Sentenced in Manhattan Federal Court, Investigation Targeted Global Bank Fraud Scheme that Used Zeus Trojan and Other Malware to Steal Millions of Dollars from U.S. Bank Accounts

Preet Bharara, the United States Attorney for the Southern District of New York, announced that NIKOLAY GARIFULIN was sentenced today in Manhattan federal court to two years in prison for his involvement in a global bank fraud scheme that used hundreds of phony bank accounts to steal over $3 million from dozens of U.S. accounts that were compromised by malware attacks. On September 23, 2011, GARIFULIN pled guilty to one count of conspiracy to commit bank fraud and one count of conspiracy to possess false identification documents. He was sentenced today by U.S. District Judge Victor Marrero.

Manhattan U.S. Attorney Preet Bharara said: “The high-tech scheme that was perpetrated by Nikolay Garifulin and his co-conspirators is an example of the financial harm that can be wrought by cyber thieves. As today’s sentence and our record in this case make clear, we will track down these criminals and bring them to justice.”

According to the indictment, statements made in connection with the guilty plea, and other documents filed in Manhattan federal court:

As part of the bank fraud scheme, hackers in Eastern Europe used cyber attacks to steal money from the bank accounts of small and mid-sized businesses throughout the United States. The cyber attacks included the use of malware known as Zeus Trojan, which would embed itself in victims’ computers and record their keystrokes as they logged into their online bank accounts. The hackers responsible for the malware then used the account information to take over the victims’ bank accounts and make unauthorized transfers of thousands of dollars at a time to accounts controlled by co-conspirators, including GARIFULIN, who were members of a money mule organization.

The money mule organization recruited individuals who had entered the United States on student visas, provided them with fake foreign passports, and instructed them to open accounts at U.S. banks under false names. Once the false-name accounts were successfully opened and the stolen funds transferred into the accounts, the “mules” moved the money to other accounts, most of which were overseas, or withdrew and transported it overseas as smuggled bulk cash.

GARIFULIN collected money that had been withdrawn by mules from the phony accounts in the United States and, under the direction of the organization’s leader, distributed it to other co-conspirators and transported it back to Eastern Europe. GARIFULIN also arranged for fake passports to be transferred from Eastern Europe to mules in the United States.

***

In addition to his prison term, GARIFULIN, 23, of Volgograd, Russia, was sentenced to three years of supervised release. He was also ordered to forfeit $100,000 and to pay $192,123.122 in restitution.

The investigation into this global bank fraud scheme was conducted by the U.S. Attorney’s Office for the Southern District of New York, the New York County District Attorney’s Office, the Federal Bureau of Investigation, the New York City Police Department, the Department of State Diplomatic Security Service, the U.S. Immigrations and Customs Enforcement’s Homeland Security Investigations, and the U.S. Secret Service.

As a result of this investigation, 37 defendants were charged in September 2010. GARIFULIN was the last of the 27 defendants arrested in connection with the scheme to plead guilty. In addition to GARIFULIN, 23 defendants involved in the scheme have been sentenced, including two leaders of the mule organization. Kasum Adigyuzelov was sentenced on May 13, 2011 to four years in prison. Dorin Codreanu was sentenced on July 8, 2011 to 20 months in prison. Of the remaining defendants, two entered into deferred prosecution agreements with the government, and eight defendants are fugitives who are being sought in the United States and abroad.

Mr. Bharara thanked all of the law enforcement agencies involved in the investigation for their outstanding work. He also thanked Bank of America, TD Bank, JPMorgan Chase Bank, Wachovia, and HSBC Bank for their assistance in the investigation.

The investigation and prosecution of these cases is being overseen by the Office’s Complex Frauds Unit. The cases are being prosecuted by Assistant U.S. Attorneys Joseph P. Facciponti, Alexander J. Wilson, Sarah Lai, Justin Anderson, and Andrew Bauer.