Equipo Nizkor - Text of the Indictment Charging 36 Defendants for Alleged Roles in Transnational Criminal Organization Responsible for Cybercrimes.

STEVEN W.MYHRE
Acting United States Attorney
Nevada Bar No. 9635
CHAD W. MCHENRY
Assistant United States Attorney
DAVID A. JAFFE
Acting Chief, Organized Crime and Gang Section
U.S. Department of Justice
KELLY PEARSON
Trial Attorney, Organized Crime and Gang Section
501 Las Vegas Blvd. South, Suite 1100
Las Vegas, Nevada 89101

Representing the United States of America

UNITED STATES DISTRICT COURT
DISTRICT OF NEVADA

United States of America,
Plaintiff,
v.
[1] Svyatoslav Bondarenko,
a.k.a. "Obnon,"
a.k.a. "Rector,"
a.k.a. "Helkern,"
[2] Sergey Medvedev,
a.k.a. "Stells,"
a.k.a. "segmed"
a.k.a. "serjbear"
[3] Amjad Ali,
a.k.a. "Amjad Ali Chaudary"
a.k.a. "RedruMZ,"
a.k.a. "Amjad Chaudary"
[4] Roland Patrick N'Djimbi Tchikaya,
a.k.a. "Darker,"
a.k.a. "dark3r.cw,"
[5] Arnaldo Sanchez Torteya,
a.k.a. "Elroncoluna,"
[6] Miroslav Kovacevic,
a.k.a. "Goldjunge,"
[7] Frederick Thomas,
a.k.a. "Mbsto,"
a.k.a. "1stunna,"
a.k.a. "Bestssn,"
[8] Osama Abdelhamed,
a.k.a. "MrShrnofr,"
a.k.a. "DrOsama,"
a.k.a. "DrOsamal,"
[9] Besart Hoxha,
a.k.a. "Pizza,"
[10] Raihan Ahmed,
a.k.a. "Chan,"
a.k.a. "Cyber Hacker,"
a.k.a. "Mae Tony,"
a.k.a. "Tony,"
[11] Audrey Sergeevich Novak,
a.k.a. "Unicc,"
a.k.a. "Faaxxx,"
a.k.a. "Faxtrod,"
[12] Valerian Chiochiu,
a.k.a. "Onassis,"
a.k.a. "Flagler,"
a.k.a. "Socrate,"
a.k.a. "Eclessiastes,"
[13] John Doe #8,
a.k.a. "Aimless88,"
[14] Germaro Fioretti,
a.k.a. "DannyLogort,"
a.k.a. "Genny Fioretti"
[15] Edgar Rojas,
a.k.a. "Edgar Andres Viloria Rojas"
a.k.a. "Guapo,"
a.k.a. "Guapol988;
a.k.a. "Onlyshop,"
[16] John Telusma,
a.k.a. "John Westley Telusma"
a.k.a. "PetereUiot,"
a.k.a. "Pete,"
a.k.a. "Pette,"
[17] Rami Fawaz,
a.k.a. "Rami Imad Fawaz"
a.k.a. "Validshop,"
a.k.a. "Th3d,"
a.k.a. "Zatcher,"
a.k.a. "Darkeyes,"
[18] Muhammad Shiraz,
a.k.a. "Moviestar,"
a.k.a. "Leslie,"
[19] Jose Gamboa,
a.k.a. "Jose Gamboa-Soto,"
a.k.a. "Rafael Garcia,"
a.k.a. "RafaellOl,"
a.k.a. "Memberplex2006,"
a.k.a. "Knowledge,"
[20] Alexey Klimenko,
a.k.a. "Grandhost,"
[21] Edward Lavoile,
a.k.a. "Eddie Lavoie"
a.k.a. "Skizo,"
a.k.a. "Eddy Lavoile"
[22] Anthony Nnamdi Okeakpu,
a.k.a. "Aslikel,"
a.k.a. "Aslike,"
a.k.a. "Moheymafia,"
a.k.a. "Shilonng,"
[23] Pius Sushil Wilson
a.k.a. "FDIC,"
a.k.a. "TheRealGuru,"
a.k.a. "TheRealGuruNYC,"
a.k.a. "RealGuru,"
a.k.a. "Poison,"
a.k.a. "Infection,"
a.k.a. "Infected,"
[24] Muhammad Khan,
a.k.a. "CoolJ2,"
a.k.a. "CoolJ,"
a.k.a. "Secureroot,"
a.k.a. "Securerootl,"
a.k.a. "Secureroot2,"
a.k.a. "Mohammed Khan"
[25] John Doe #7,
a.k.a. "Muad'Dib,"
[26] John Doe #1,
a.k.a. "Carlitos," a.k.a. "TonyMontana,"
[27] David Jonathan Vargas,
a.k.a. "Cashmoneyinc,"
a.k.a. "Avb,"
a.k.a. "Poony,"
a.k.a. "Renegade 11,"
a.k.a. "DvdSVrgs,"
[28] John Doe #2;
a.k.a. [ ]
a.k.a. [ ]
[29] Marko Leopard,
a.k.a. "Leopardmk,"
[30] John Doe #3,
a.k.a. "Scotish,"
[31] Aldo Ymeraj,
a.k.a. "Niii.in,"
a.k.a. "Kubanezi,"
a.k.a. "Yankeeman,"
[32] John Doe #4,
a.k.a. "Best4Best,"
a.k.a. "Wazo,"
a.k.a. "Modmod,"
a.k.a. "Alonel,"
a.k.a. "Shadow,"
a.k.a. "Banderas,"
a.k.a. "Banadoura,"
[33] Liridon Musliu,
a.k.a. "Ccstore,"
a.k.a. "Bowl,"
a.k.a. "Hulk,"
[34] John Doe #5,
a.k.a. "Deputat,"
a.k.a. "ZoOmer,"
[35] Mena Mouries Abd El-Malak,
a.k.a. "Mina Morris"
a.k.a. "Source,"
a.k.a. "Mena2341,"
a.k.a. "MenaSex,"
[36] John Doe #6,
a.k.a. "Goldenshop,"
a.k.a. "Malov,"
Defendants.
SEALED
First Superseding Criminal Indictment
2:17-cr-306-JCM-PAL
VIOLATIONS:
18 U.S.C. § 1962(d): Racketeering Conspiracy (Count 1)
18 U.S.C. § 1029(a)(3): Possession of 15 or more Access Devices (Counts 2 through 9)
18 U.S.C. § 2: Aiding and Abetting (Counts 2 through 9)

FIRST SUPERSEDING INDICTMENT

THE GRAND JURY CHARGES THAT:

GENERAL ALLEGATIONS

These General Allegations are realleged and incorporated by reference in Count One (Conspiracy to Engage in a Racketeer Influenced Corrupt Organization)

Introduction

1. At all times relevant to this Indictment, the defendants, and others known and unknown to the grand jury, were members and associates of a criminal organization, herein referred to as the "Infraud Organization," which engages in, among other things, acts of identity theft and financial fraud. These acts include, but are not limited to: money laundering; trafficking in stolen means of identification; trafficking in, production and use of counterfeit identification; identity theft; trafficking in, production and use of unauthorized and counterfeit access devices; bank fraud; and wire fraud, as well as services associated with all of the above. The Organization operates in the District of Nevada and elsewhere.

2. A primary purpose of the Infraud Organization is to promote and grow interest in the Infraud Organization as the premier destination for carding, and to direct traffic and potential purchasers to the automated vending sites of its members, which serve as online instruments that traffic in stolen means of identification, personally-identifying information, stolen financial and banking information, and other illicit goods. As of March 2017, there were 10,901 member accounts on the Infraud Organization's discussion forum.

Definitions

3. The following are definitions for terms used throughout this Indictment:

a. "AVS" or "automated vending site" are used to describe automated websites that do not require human intervention to function, and that are used by Infraud members to purchase and sell illicit goods.

b. "Bulletproof Hosting" and "Abuse Hosting" are services provided by a domain or web hosting firm that allows their customers considerable leniency in the kinds of material the customer distributes from the firm's servers. Such material may include spam, compromised credit card data, high yield investment product ("Ponzi") schemes, online gambling, and malware distribution infrastructure.

c. "Carded travel services" are services wherein the vendor books things such as airline or train tickets, hotel rooms, rental cars, sporting or entertainment event ticket, or other items for his or her customer. These bookings are made using fraudulent or stolen credit card numbers. In exchange, the customer pays the vendor a fraction of the face value of the items booked--typically, 20-30%.

d. "Carding" refers to the general concept of purchasing retail items with counterfeit credit cards or stolen credit card information. Such scheme may involve a counterfeit credit card that has been encoded with the legitimate victim account information, and is presented to a store's cashier by the offender. Often, various false identification documents are used to facilitate this fraud. "Carders" is a term ased by members of a carding organization to describe themselves.

e. "CVV" and "fulls" refer to compromised credit card account data that ypically contains all of a cardholder's information except for information encoded on the magnetic track on the rear of the card. This account data generally includes an iccount holder's name, date of birth, social security number, address, telephone and nother's maiden name, as well as the security code on the rear of the credit card.

f. "Dumps" are compromised credit card account data.

g. "Drop" can have several different meanings depending on the context n which it is used, but generally refers to a location or individual able to securely 'eceive and then forward goods obtained via carding or other types of fraud. A typical Irop service request might be: "Do you have a drop I can ship a laptop to?"

h. "Forum" and "Website" are terms used interchangeably to describe he online gathering place used as a meeting location for Infraud members.

i. "Holograms" are labels with a hologram printed onto them for secu-ity reasons. They are commonly found on genuine credit cards and identifications.

j. "ICQ" is a free instant messaging electronic communication service, or chat" service. ICQ user accounts are identified by a Universal Identification Num-er, or "UIN." An ICQ user may store frequently-contacted UINs in a "buddy list."

k. "Internet Protocol address," and "IP address," refer to a network ientifier used by a computer to access the Internet. IP addresses are assigned to omputers by the Internet Service Provider they use to access the Internet.

l. "Liberty Reserve" was an online currency utilized by Infraud members to facilitate the sale and purchase of compromised access devices, personal identifying information, malware and the services associated with such.

m. "Malware" is hostile or intrusive software that can be used to compromise end-user PCs and smartphones or retail point-of-sale ("POS") systems, among other things. Although functionality varies, malware is often used to harvest personally-identifying information and financial data, to gather intelligence for later use in a fraud scheme, or to electronically and unlawfully monitor victims.

n. "PHP" stands for "PHP: Hypertext Preprocessor," and is a programming/scripting language commonly used to create interactive websites, such as AVSes, as well as other Internet-related tools and applications.

o. "PM" means "Private Message." These are any non-public messages sent between users on a website or service, such as the Infraud Organization's forum.

p. "Proxy" and "Proxy Server" describe a computer that acts as an intermediary in a client's Internet connection, relaying that client's Internet request to its ultimate destination on the Internet and relaying back the destination's response or content to the client. Proxies are often used to provide a degree of anonymity by obscuring the user's originating IP address. Generally, the traffic itself between a proxy server and its client is unencrypted.

q. "Ripper" refers to a vendor of illicit goods of poor quality, or one who did not deliver the goods promised in a transaction. Infraud leadership routinely policed the forum for rippers, disciplining them to protect the general membership.

r. "Virtual Private Network" and "VPN" describe a connection configuration very similar to that involved with a proxy server, except that a VPN forms an encrypted tunnel from the client to the VPN server, thus providing a layer of privacy to the data traffic being exchanged between the client and the VPN.

s. "Web Hosting" services maintain server computers connected to the Internet. Their customers use those computers to operate websites on the. Internet. Customers of web hosting companies place files, software code, databases, and other data on servers that they wish to be accessible on the Internet. The Infraud Organization's website is an example of something that is provided via a web host.

Structure and Operation of the Enterprise

4. At all times relevant to this Indictment,

[1] Svyatoslav Bondarenko, a.k.a. "Obnon," "Rector," "Helkern";

[2] Sergey Medvedev, a.k.a. "Stells,"."Segmed," "Serjbear";

[3] Amjad Ali, a.k.a. "Amjad Ali Chaudary," "RedruMZ," "Amjad Chaudary";

[4] Roland Patrick N'Djimbi Tchikaya, a.k.a. "Darker," "dark3r.cw";

[5] Arnaldo Sanchez Torteya, a.k.a. "Elroncoluna";

[6] Miroslav Kovacevic, a.k.a. "Goldjunge";

[7] Frederick Thomas, a.k.a. "Mosto," "lstunna," "Bestssn";

[8] Osama Abdelhamed, a.ka. "MrShrnofr," " "DrOsama," "DrOsamal";

[9] Besart Hoxha, a.k.a. "Pizza";

[10] Raihan Ahmed, a.k.a. "Chan," "Cyber Hacker," "Mae Tony," "Tony";

[11] Andrey Sergeevich Novak, a.k.a. "Unicc," "Faaxxx," "Faxtrod";

[12] Valerian Chiochiu, a.k.a. "Onassis," "Flagler," "Socrate," "Eclessiastes";

[13] John Doe #8, a.k.a. "Aimless88";

[14] Gennaro Fioretti, a.k.a. "DannyLogort," "Genny Fioretti";

[15] Edgar Rojas, a.k.a. "Edgar Andres Viloria Rojas," "Guapo," "Guapo1998," "Onlyshop";

[16] John Telusma, a.k.a. "John Westley Telusma," "PetereUiot," "Pete," "Pette";

[17] Rami Fawaz, a.k.a. "Validshop," "Th3d," "Zatcher," "Darkeyes";

[18] Muhammad Shiraz, a.k.a. "Moviestar," "Leslie";

[19] Jose Gamboa, a.k.a. "Jose Gamboa-Soto," "Rafael Garcia," "Rafael101," "Memberplex2006," "Knowledge";

[20] Alexey Klimenko, a.k.a. "Grandhost";

[21] Edward Lavoile, a.k.a. "Eddie Lavoie," "Skizo," "Eddy Lavoile";

[22] Anthony Nnamdi Okeakpu, a.k.a. "Aslikel," "Aslike," "Money-mafia," "Shilonng";

[23] Pius Sushil Wilson, a.k.a. "FDIC," "TheRealGuru," "TheReal-GuruNYC," "RealGuru," "Poison," "Infection," "Infected";

[24] Muhammad Khan, a.k.a. "CoolJ2," "CoolJ," "Secureroot," "Secureroot1," "Secureroot2, "Mohammed Khan";

[25] John Doe #7, a.k.a "Muad'Dib";

[26] John Doe #1, a.k.a. "Carlitos," "TonyMontana";

[27] David Jonathan Vargas, a.k.a. "Cashmoneyinc," "Avb," "Poony," "Renegadell," "DvdSVrgs";

[28] John Doe #2, a.k.a. [ ] "a.k.a. [ ];

[29] Marko Leopard, a.k.a. "Lepoardmk";

[30] John Doe #3, a.k.a. "Scotish";

[31] Aldo Ymeraj, a.k.a. "Niii.in," "Kubanezi," "Yankeeman";

[32] John Doe #4, a.k.a. "Best4Best," "Wazo," "Modmod," "Alonel," "Shadow," "Banderas," "Banadoura";

[33] Liridon Musliu, a.k.a. "Ccstore," "Bowl," "Hulk";

[34] John Doe #5, a.k.a. "Deputat," a.k.a. "ZoOmer";

[35] Mena Mouries Abd El-Malak, a.k.a. "Mina Morris," "Source," "Mena2341," "MenaSex,"

[36] John Doe #6, a.k.a. "Goldenshop," "Malov";

the defendants herein, and others known and unknown to the grand jury, are members of, employed by, and associates of the Infraud Organization. Members and associates of the Infraud Organization operate in Las Vegas, Nevada; the United States; and throughout the rest of the world.

5. The Infraud Organization, including its leadership, members, and associates, constitutes an enterprise as defined by 18 U.S.C. § 1961(4): that is, a group of individuals associated-in-fact,. The enterprise constitutes an ongoing organization whose members function as a continuing unit for a common purpose of achieving the objectives of the enterprise. The enterprise is engaged in, and its activities affect, interstate and foreign commerce.

6. The hierarchy of the Infraud Organization includes, but is not limited to:

a. Administrators, a.k.a. "4DMini57r470rz": Administrators are individuals that serve as a governing council of the Infraud Organization who, collectively, control the destiny of the organization. The administrator(s) initially seeded the Infraud Organization forum with "reputable" vendors of contraband in order to attract traffic and membership and grow the organization. They handle the day-today management decisions of the Infraud Organization, as well as long term strategic planning for its continued viability. They determine which individuals are permitted to become and remain members of the Infraud Organization; the functions, responsibilities and levels of access to information for all members of the organization; and the rewards accorded members for their loyalty to the organization as well as the punishments meted out to members evidencing disloyalty to the organization. Furthermore, they decide when, how and under what circumstances to attack and to retaliate against members of rival criminal organizations and their associated Internet websites. The administrator(s) are accorded full access to, and privileges on, the computer servers hosting, the Infraud Organization's websites, and, thus, have the ultimate responsibility for the physical administration, maintenance, and security of these servers and websites.

b. Super Moderators, a.k.a. "Super M0DER470R5": Super Moderators oversee and administer one or more subject-matter specific areas on the Organiza tion's forum that either fall within an area of their expertise or cover their geographic location, limiting their activities to editing and deleting posts by members on these forums and mediating disputes. Super Moderators also frequently serve as reviewers for particular products or services with which they have an expertise.

c. Moderators, a.k.a. "M0d3r470r2": Moderators, like Super Moderators, oversee and administer one or more subject-matter specific areas on the Organization's forum that either fall within an area of their expertise or cover their geographic location. However, Moderators tend to be more limited in the authority they are granted, and are generally limited to moderating one or two specific sub-forums.

d. Vendors, a.k.a. "Professors" or "Doctors": Vendors sell illicit products and services to members of the Infraud Organization. These sales may occur through the vendor's own website, to which would-be purchasers are directed by the advertisements they pay for and place on the Infraud Organization's web forum. Such sales may also occur directly between the vendor and customer, i.e. via email, PM, or ICQ. Products sold by vendors are reviewed on the forum by Infraud members, to ensure that vendors of low-quality goods do not remain in business with the Organization. This helps to cement the Organization's reputation as a premiere online destination for safe", high-quality and readily-available fraud-related contraband.

e. VIP Members, a.k.a. "Fratello Masons" or "Advanced Members": These are some of the premiere members of the Infraud Organization. The leaders of the Organization bestow this title upon longstanding or otherwise notable members in order to distinguish them from the general membership and from vendors.

f. Members, a.k.a. "Phr4Ud573r": General members of the Infraud Organization typically use the organization's websites to gather and provide information about perpetrating criminal activity; to share information with and solicit other members to engage in their criminal schemes; to use the website's vendors to facilitate their unlawful purchases of credit card dumps, false identification documents, and other contraband; and in order to have their individual disputes with other Organization members settled by the Administrator(s) or Moderators.

7. Members join the Infraud Organization via an online forum. To be granted membership, an Infraud Administrator must approve the request. Once granted membership, members can post and pay for advertisements within the Infraud forum. Members may move up and down the Infraud hierarchy. The Infraud Organization continuously screens the wares and services of the vendors within the forum to ensure quality products. Vendors who are considered subpar are swiftly identified and punished by the Infraud Organization's Administrators.

The Defendants

8. At various times relevant to this Indictment, the following individuals, among others, were members or associates of the Infraud Organization in the various capacities or ranks set forth below, carrying out and agreeing to carry out various activities in furtherance of the enterprise described in this Indictment:

[1] Svyatoslav Bondarenko created the Infraud Organization in October of 2010. In addition to being one of the Organization's de facto leaders, by virtue of his standing, Bondarenko [1] held the rank of Administrator within the Organization. In 2015, Bondarenko [1] stopped posting on and/or using Infraud.

[2] Sergey Medvedev is a co-founder of the Infraud Organization with Bondarenko [1], and has been an active member on the Organization's website since November of 2010. Medvedev [2] is one of the Organization's leaders, and also holds the rank of Administrator within the Organization. Medvedev [2] operates an "escrow" or currency exchanging service for the benefit of Infraud Organization members engaging in transactions with other members, to ensure the integrity of those transactions. After Bondarenko [1] went missing in 2015, Medvedev [2] took his place as owner and administrator of the Infraud Organization.

[3] Amjad Ali became a member of the Infraud Organization in December of 2010. Ali [3] is a vendor of CWs, and has since been elevated by Medvedev [2] to Super Moderator status.

[4] Roland Patrick IsPDjimbi Tchikaya became a member of the Infraud Organization in January of 2011. He advertises in the Organization as a Vendor of CWs and an operator of the "d4rksys.cc" website to sell CWs to Organization membership.

[5] Arnaldo Sanchez Torteya became a member of the Infraud Organization in November of 2010. He was promoted to VIP Member in December of 2010 by Bondarenko [1], and advertises in the Organization as a seller of CWs and lookups of credit profile and/or personally-identifying information.

[6] Miroslav Kovacevic became a member of the Infraud Organization in November of 2010. He advertises within the Organization as' a Vendor of plastics, templates, and scans.

[7] Frederick Thomas became a member of the Infraud Organization in October of 2011. He advertises within the Organization as a Vendor of a Social Security Number and date of birth lookup service.

[8] Osama Abdelhamed became a member of the Infraud Organization in September of 2013. He advertises as a Vendor of dumps within the Organization, and is an operator of the "iswipe.cc" and "iswipe.pl" websites, using them as outlets to sell dumps to Infraud Organization members and associates.

[9] Besart Hoxha became a member of the Infraud Organization in January of 2011. He advertises within the Organization as a Vendor of "High Quality Plastics & Holos - VISA, MasterCard, Amex, Discover," and sells plastic card stock and holograms to Infraud Organization members and associates.

[10] Raihan Ahmed became a member of the Infraud Organization in January of 2011. He is a Vendor of compromised PayPal accounts, selling to Infraud members and associates.

[11] Audrey Sergevich Novak became a member of the Infraud Organization in January of 2013. He advertises as a Vendor of CWs, and is an operator of the "uniccshop.ru" website, using it as an outlet to sell CWs to Infraud Organization members and associates.

[12] Valerian Chiochiu became a member of the Infraud Organization in December of 2012. He is a member within the Organization, and provides guidance to other members on the development, deployment, and use of random access memory ("RAM") point-of-sale ("POS") malware as a means of harvesting stolen data.

[13] John Doe #8 became a member of the Infraud Organization in April of 2011. He operates and advertises as a Vendor of compromised online bank logins within the Organization.

[14] Gennaro Fioretti became a member of the Infraud Organization in December of 2010, and was later promoted to VIP Member. He is extremely active on the member forum and has made numerous illicit purchases from Infraud vendors and fellow members.

[15] Edgar Rojas became a member of the Infraud Organization in September of 2011. He was promoted to VIP Member status by Bondarenko [1] shortly after joining.

[16] John Telusma became a member of the Infraud Organization in August of 2011. He is a Vendor within the Infraud Organization, providing "cashout" and "drop" services for Organization membership, in addition to selling dumps.

[17] Rami Fawaz became a member of the Infraud Organization in January of 2011. Although only designated a member of the Organization, Fawaz [17] sold compromised account data to Infraud Organization members and associates via the well-regarded automated vending site, "vahdshop.su."

[18] Muhammad Shiraz became a member of the Infraud Organization in November of 2010. He advertises as a Vendor of dumps within the Organization's forum.

[19] Jose Gamboa became a member of the Infraud Organization in December of 2010. He advertises as a Vendor of custom-built ATM skimmers within the Organization's forum.

[20] Alexey Klimenko became a member of the Infraud Organization in September of 2011. He advertises as a Vendor of "Abuse Immunity" or "Bulletproof Hosting" services that Organization members and associates can employ to create, operate, maintain and protect their own online contraband stores.

[21] Edward Lavoile became a member of the Infraud Organization in July of 2011. Although only designated a member, he has advertised for sale to fellow Infraud Organization members "fresh" CWs that he had personally hacked from Canada.

[22] Anthony Nnamdi Okeakpu became a member of the Infraud Organization in December of 2010. He was promoted to VIP Member by Bondarenko [1] in April of 2014, and has also held the posts of Moderator and Super Moderator in the Organization.

[23] Pius Sushil Wilson became a member of the Infraud Organization in January of 2011. He is a VIP Member within the Organization, and was one of the more actiye Infraud members,. having made hundreds of posts to the Organization's forum.

[24] Muhammad Khan became a member of the Infraud Organization in August of 2011. He is designated as a "Vendor of Checking," and operates a service for Organization membership that shows whether a given stolen credit card number is still operable or if it has been shut down by the bank for fraud.

[25] John Doe #7 became a member of the Infraud Organization in October of 2011. He advertises as a Vendor of dumps within the Infraud Organization's forum, and is an operator of one of the more well-regarded AVSes, "mdshop.org."

[26] John Doe #1 became a member of the Infraud Organization in September of 2011. He advertises as a Vendor of dumps, and is an operator of the "tonystuff.cc" and "tonymontana.ee" websites as outlets to sell dumps to Infraud Organization membership.

[27] David Jonathan Vargas became a member of the Infraud Organization in August of 2011. He advertises in the Organization's forum as a Vendor of carded travel services.

[28] John Doe #2 became a member of the Infraud Organization in January of 2011. He advertises in the Organization as a Vendor of drop services, and directed members to a website under his control to complete their purchases.

[29] Marko Leopard became a member of the Infraud Organization in June of 2011. He operates "Abuse Immunity" or "Bulletproof Hosting" services that Organization members can employ to create, operate, maintain and protect their own online contraband stores.

[30] John Doe #3 became a member of the Infraud Organization in November of 2010. He advertises in the Organization's forum as a Vendor of dumps, and is an operator of the "newnumbers.biz" website, using it as an outlet to sell dumps to Infraud members and associates.

[31] Aldo Ymeraj became a member of the Infraud Organization in November of 2010. He advertises in the Organization's forum as a Vendor of dumps, and is an operator of the "niii.in" AVS, using it as an outlet to sell dumps to Infraud members and associates.

[32] John Doe #4 became a member of the Infraud Organization in May of 2014. He advertises in the Organization's forum as a Vendor of dumps, and is an operator of the "Best4best.su" AVS.

[33] Liridon Musliu became a member of the Infraud Organizatoin in August of 2011. He advertises in the Organization's forum as a Vendor of dumps, and operates the AVS located at the "ccstore.me," "ccstore.name," and "ccstore.ws" domains.

[34] John Doe #5 became a member of the Infraud Organization in October of 2010. He is an operator of the "swiped.su" and "approved.su" AVSes, which he used to sell dumps to other Infraud Organization members and associates.

[35] Mena Mouries Abd El-Malak became a member of the Infraud Organization in November of 2010. He advertises as a Vendor of dumps within the Organization, and is an operator of the AVS located at "source4dumps.tv," which he used to sell dumps to other Infraud Organization members and associates.

[36] John Doe #6 became a member of the Infraud Organization in January of 2011. He advertises in the Organization's forum as a Vendor of dumps, and is an operator of the AVS at "golden_:dumps.cc"

Purposes of the Enterprise

9. The purposes of the enterprise include, but are not limited to:

a. To enrich the members and associates of the Infraud Organization through the unlawful trafficking in: counterfeit and illegal means of identification, document-making implements, counterfeit identification documents, device-making equipment, and unauthorized and counterfeit access devices to include stolen credit card numbers;

b. To establish the Organization as the premier online destination for the purchase and sale of stolen property and other contraband, such as victims' personal and financial means of identification, and forged identification documents;

c. To "educate" members in obtaining and using such property and contraband;

d. To direct traffic, primarily through advertising, to member-owned and/or operated AVSes and other websites to generate illicit proceeds, and to thereby promote the Infraud Organization as the premier online source of "reputable" vendors and high-quality contraband.

e. To protect the enterprise and its members from detection,- apprehension and prosecution by law enforcement; and

f. To preserve and protect the reputation, operations and profits of the enterprise through discipline, expulsion, and other acts of retribution against nonconforming members.

Manner and Means of the Enterprise

10. The manner and means by which the defendants and their associates conduct and participate in the conduct of the affairs of the. enterprise include, but are not Umited to, the following:

a. Members of the enterprise utilize an online discussion forum called "Infraud," with the slogan of "In Fraud We Trust," controlled by Infraud Organization Administrators, to discuss, meet, and conduct criminal activities. Such activities include the sale and purchase of stolen social security numbers,, dates of birth, addresses, passwords, and other personally identifying information and property, advertising services to facilitate such activity, and disseminating malware.

b. The Infraud' Administrators bestowed specific benefits on members to include the ability to pay for posted advertisements for their respective AVSes, post questions related to the sale and purchase of stolen personally-identifying information and property and the dissemination of malware, and obtain free samples of the "wares" of various Infraud vendors.

c. Members of the enterprise and their associates are classified by various roles assigned to them by the leadership of the Infraud Organization. This hierarchy was established to maintain order, to grow the Organization's membership, and to facilitate the goals of the enterprise.

d. To enforce the rides of the enterprise, and maintain its reputation, members and associates engage in the feedback or rating of various vendors on the website. The system was designed to maintain the quality of contraband sold via the Infraud website, as well as via associated member-owned and/or operated vending websites.

e. The leadership of the Infraud Organization routinely policed the Infraud forum for "rippers" and other rule-violators, in order to ensure the quality of contraband sold and to protect the reputation of the general membership of the Infraud Organization.

f. Members and associates strive to achieve shared anonymity, to remain as anonymous as possible in order to evade law enforcement and other "real-world" or "offline" consequences for their fraudulent and criminal activities. To that end, members and associates remain anonymous even to each other. They are generally referred to online and interact only via their online "nic" or "username." Members and associates use any means possible to hide their identity.

g. Members and associates launder proceeds obtained through their unlawful activities by using, among other methods, Liberty Reserve, Bitcoin, Perfect Money, WebMoney, and other digital currencies, to conceal the nature of their proceeds and move the proceeds among enterprise members and associates.

h. Members of the enterprise and their associates use the Infraud Organization's website to advertise and direct buyers and sellers to their own AVSes and websites. This is done to complete sales of contraband, to create repeat customers, and to elevate their status in the Organization as "reputable" vendors.

i. Members of the enterprise and their associates use various means to communicate, complete transactions, and establish connections, all designed to protect their anonymity, evade detection and prosecution by law enforcement, and provide security for the criminal organization against attacks by other rival criminal organizations. These methods may include, but are not limited to, the use of:

i. Various website forums and chat rooms that are controlled by the Infraud Organization for use as their online gathering places;
ii. Private messaging ("PM");
iii. E-mail;
iv. ICQ chat;
v. Proxies;
vi. Virtual private networks ('VPNs"); and
vii. Protected drop sites ("drops").

COUNT ONE

Racketeering Conspiracy

11. Paragraphs 1 through 10 of the General Allegations Section are hereby realleged and incorporated as if fully set forth herein..

12. From a date unknown, but from at least in or about October 2010, up through and mcluding the date of this Indictment, both dates being approximate and inclusive, within the District of Nevada and elsewhere, the defendants,

[1] Svyatoslav Bondarenko, a.k.a. "Obnon," "Rector," "Helkern";

[2] Sergey Medvedev, a.k.a. "Stella," "Segmed," "Serjbear";

[3] Amjad Ali, a.k.a. "Amjad Ali Chaudary," "RedruMZ," "Amjad Chaudary";

[4] Roland Patrick N'Djimbi Tchikaya, a.k.a. "Darker," "dark3r.cw";

[5] Arnaldo Sanchez Torteya, a.k.a. "Elroncoluna";

[6] Miroslav Kovacevic, a.k.a. "Goldjunge";

[7] Frederick Thomas, a.k.a. "Mosto," "lstunna," "Bestssn";

[8] Osama Abdelhamed, a.k.a. "MrShrnofr," "DrOsama," "DrOsamal";

[9] Besart Hoxha, a.ka. "Pizza";

[10] Raihan Ahmed, a.k.a, "Chan," "Cyber Hacker," "Mae Tony," "Tony";

[11] Andrey Sergeevich Novak, a.k.a. "Unicc," "Faaxxx," "Faxtrod";

[12] Valerian Chiochiu, a.k.a. "Onassis," "Flagler," "Socrate," "Eclessiastes";

[13] John Doe #8, a.k.a. "Aimless88";

[14] Gennaro Fioretti, a.k.a. "DannyLogort," "Genny Fioretti";

[15] Edgar Rojas, a.k.a. "Edgar Andres Viloria Rojas," "Guapo," "Guapol998," "Onlyshop";

[16] John Telusma, a.k;a. "John Westley Telusma," "Peterelliot," "Pete," "Pette";

[17] Rami Fawaz, a.k.a. "Rami Imad Fawaz," 'Validshop," "Th3d," "Zatcher," "Darkeyes";

[18] Muhammad Shiraz, a.k.a. "Moviestar," "Leslie";

[19] Jose Gamboa, a.k.a. "Jose Gamboa-Soto," "Rafael101," "Member-plex2006," "Knowledge";

[20] Alexey Klimenko, a.k.a. "Grandhost";

[21] Edward Lavoile, a.k.a. "Eddie Lavoie," "Skizo," "Eddy Lavoile";

[22] Anthony Nnamdi Okeakpu, a.k.a. "Aslikel," "Aslike," "Money-mafia," "Shilonng";

[23] Pius Sushil Wilson, a.k.a. "FDIC," "TheRealGuru," "TheReal-GuruNYC," "RealGuru," "Poison," "Infection," "Infected";

[24] Muhammad Khan, a.k.a. "CoolJ2," "CoolJ," "Secureroot," "Secur-erootl," "Secureroot2," "Mohammed Khan";

[25] John Doe #7, a.k.a "Muad'Dib";

[26] John Doe #1, a.k.a. "Carhtos," "TonyMontana";

[27] David Jonathan Vargas, a.k.a. "Cashmoneyinc," "Avb," "Poony," "Renegadell," "DvdSVrgs";

[28] John Doe #2, a.k.a. [ ] "a.k.a. [ ]

[29] Marko Leopard, a.k.a. "Leopardmk";

[30] John Doe #3, a.k.a. "Scotish";

[31] Aldo Ymeraj, a.k.a. "Niii.in," "Kubanezi," "Yankeeman";

[32] John Doe #4, a.k.a. "Best4Best," "Wazo," "Modmod," "Alone 1," "Shadow," "Banderas," "Banadoura";

[33] Liridon Musliu, a.k.a. "Ccstore," "Bowl," "Hulk";

[34] John Doe #5, a.k.a. "Deputat," a.k.a. "ZoOmer";

[35] Mena Mouries Abd El-Malak, a.k.a. "Source," "Mena2341," "MenaSex"

[36] John Doe #6, a.k.a. "Goldenshop," "Malov";

together with others known and unknown to the grand jury, being persons employed by and associated with the Infraud Organization, an enterprise as described more fully above, which engaged in, and the activities of which affected, interstate and foreign commerce, did knowingly, willfully, and unlawfully combine, conspire, confederate, and agree with one another to violate 18 U.S.C. § 1962(c), that is, to conduct and participate, directly and indirectly, in the conduct of the affairs of said enterprise through a pattern of racketeering activity, as defined in 18 U.S.C. §§ 1961(1) and (5), consisting of multiple acts indictable under the following provisions of federal law:

a. 18 U.S.C. § 1028, fraud and related activity in connection with identification documents, authentication features, and information; and
b. 18 U.S.C. § 1029, access device fraud; and
c. 18 U.S.C. § 1343, fraud by wire, radio, or television; and
d. 18 U.S.C. § 1344, bank fraud; and
e. 18 U.S.C. §. 1543, forgery or false use of passport.

13. It was a part of the conspiracy that each defendant agreed that a conspirator would commit at least two acts of racketeering activity in the conduct of the affairs of the enterprise.

Overt Acts

14. In furtherance of the conspiracy and to achieve the object and purposes thereof, the defendants, and others known and unknown to the grand jury, performed or caused to be performed the following overt acts, among others, in the District of Nevada, and elsewhere:

14.1 On or about October 14, 2010, Bondarenko [1] officially opened the Infraud website for business and announced it to potential members, promising Infraud as a "comfortable and safe" place to "bring together professional people for who carding and hacking become a lifestyle."

14.2 On or about November 11, 2010, Shiraz [18] posted an advertisement on the Infraud forum, offering credit card dumps for sale to Infraud members and associates and providing his ICQ UIN for contact information.

14.3 On or about November 12, 2010, Bondarenko [1] posted the rules of the Infraud Organization that governed member conduct.

14.4 On or about November 12, 2010, Bondarenko [1] prohibited any advertising on the Infraud site except that approved by the leadership.

14.5 On or about November 12, 2010, Bondarenko [1] announced that he was the Administrator and Medvedev [2] was the designated escrow service provider for the Infraud Organization.

14.6 On or about November 30, 2010, Kovacevic [6] posted an advertisement on the Infraud Organization forum, calling himself the "Plastic, Template & Scans King," and offering those items for sale to Infraud membership.

14.7 On or about December 25, 2010, Medvedev [2] posted details about the official "Escrow" service provider for the Infraud Organization--himself-- and the price associated with his services for Infraud members.

14.8 Oh or about January 7, 2011, John Doe #2 [28] recruited an individual to become a drop for merchandise.

14.9 On or about January 11, 2011, Bondarenko [1] listed members that had been banned from accessing the Infraud Organization forum.

14.10 Oh or about February 1, 2011, Ymeraj [31] posted two compromised credit card dumps on the Infraud forum as a sample of his wares.

14.11 Between on or about February 2, 2011 through on or about February 23, 2011, Medvedev's [2] escrow service was used by two Infraud members to complete a criminal transaction.

14.12 On or about February 24, 2011, N'Djimbi Tchikaya [4] purchased 10 compromised credit card numbers from Unindicted co-conspirator CC.

14.13 On or about March 6, 2011, Shiraz [18] posted two free dumps for the use of Infraud members and associates on the Infraud forum.

14.14 On or about March 9, 2011, Bondarenko [1] prohibited members from buying and selling stolen access devices and other contraband belonging to victims within the Commonwealth of Independent States, a.k.a. Russia.

14.15 On or about March 25, 2011, Doe #3 [30] posted three compromised credit card dumps on the Infraud forum as a sample of his wares.

14.16 On or about April 23, 2011, Doe #4 [32] sent dozens of compromised credit card dumps to Unindicted Co-conspirator AA.

14.17 In or about May, 2011, Abdelhamed [8] purchased multiple compromised credit card numbers from Fawaz [17], to include a compromised credit card number from an individual residing in Nevada.

14.18 Or about May 22, 2011, Doe #8 [13] posted an advertisement selling United Kingdom bank logins. On or about May 26, 2011, Doe #8 [13] indicated he had 795,000 HSBC logins available.

14.19 On or about May 30, 2011, Gamboa [19] advertised credit card skimmers for sale to Infraud members and associates, as well as his post-sale support services for purchasers, on the Infraud forum.

14.20 On or about July 10, 2011, Doe #4 [32] sent numerous compromised credit card numbers to Unindicted Co-conspirator AA.

14.21 On or about July 27, 2011, Unindicted Co-conspirator Q purchased a credit card skimmer from Gamboa [19].

14.22 On or about July 28, 2011, Unindicted Co-conspirator M ordered counterfeit identification from Kovacevic [6].

14.23 On or about August 11, 2011, Unindicted Co-conspirator M ordered counterfeit identification from Kovacevic [6].

14.24 On or about August 18, 2011, Telusma [16] received in excess of 15 compromised credit card numbers from Unindicted Co-conspirator A.

14.25 On or about August 30, 2011, Gamboa [19] sold a credit card skimmer to Unindicted Co-conspirator D.

14.26 On or about September 3, 2011, Musliu [33] advertised bis online store on the Infraud website.

14.27 On or about September 12, 2011, Doe #8 [13] sent the full bank login information of an individual to Unindicted Co-conspirator P via email.

14.28 On or about September 15, 2011, Unindicted Co-conspirator A sent Telusma [16] in excess of 15 compromised credit card dumps via email.

14.29 On or about September 19, 2011, Klimenko [20] advertised his "Abuse Immunity" hosting services on the Infraud forum, offering to host illicit websites for Infraud members and associates.

14.30 On or about October 3, 2011, Ymeraj [31] advertised on the Infraud forum his fulls website, "bastard.su," which sold credit card fulls to Infraud members and associates.

14.31 On or about October 8, 2011, Doe #2 [28] posted an advertisement on the Organization forum offering drop services to the Infraud membership.

14.32 On or about October 9, 2011, Unindicted Co-conspirator X purchased in excess of 15 CWs from Doe #7 [34].

14.33 On or about October 11, 2011, Ymeraj [31] posted 10 compromised PayPal logins on the Infraud forum for use by Infraud members.

14.34 On or about October 11, 2011, Bondarenko [1] posted dozens of compromised PayPal login credentials to the Infraud forum for members.

14.35 On or about November 10, 2011, Doe #1 [26] posted free dumps for Infraud members as a sample of his wares.

14.36 On or about November 11, 2011, Doe #3 [30] posted two compromised credit card dumps for Infraud members as a sample of his wares.

14.37 From on or about November 13, 2011 to on or about June 13, 2013, Thomas [7] ran an AVS that provided a "look-up" service of compromised social security and date of birth personally-identifying information.

14.38 On or about November 18, 2011, Unindicted Co-conspirator N used Thomas [7] automated PII search to unlawfully obtain the personally-identifying information of R.Q.N., R.F.K., A.J.S., and other individuals.

14.39 On or about November 28, 2011, Bondarenko [1] began a thread on the Infraud forum for moderators to document any members they elected to ban from the forum and their reasons for doing so.

14.40 On or about December 22, 2011, Sanchez Torteya [5] sent in excess of 15 compromised credit cards to Unindicted Co-conspirator E.

14.41 On or about January 13, 2012, Hoxha [9] posted in Unindicted Co-conspirator F's Infraud vendor advertisement, vouching for his products and stating that Unindicted Co-conspirator F is "the best guy ever."

14.42 On or about January 13, 2012, Lavoile [21] sent more than 500 compromised credit card numbers to Unindicted Co-conspirator G.

14.43 On or about January 18, 2012, N'Djimbi Tchikaya [4] posted an advertisement for his online store, "d4rksys.cc" on the Infraud forum. In the advertisement; he indicated he had "high quality" credit card dumps, compromised PayPal accounts, and other types of "Hacked Stuffs" for sale.

14.44 On or about February 14, 2012, Ali [3] vouched for Fawaz's [17] online dumps store, "validshop.su," in a post on the Infraud forum.

14.45 On or about March 7, 2012, Sanchez Torteya [5] sent in excess of 15 compromised credit card numbers to Hoxha [9] in order for Hoxha [9] to transfer those numbers onto plastic for use.

14.46 On or about March 23, 2012, Fioretti [14] posted 10 compromised credit card dumps for the use of other members on the Infraud forum.

14.47 From on or about April 26, 2012 to on or about March 1, 2013, Vargas [27] purchased 31 CWs from Doe #5 [34].

14.48 On or about March 30, 2012 to on or about April 18, 2012, Musliu [33] offered for sale on his AVS "ccstore" in excess of 15 compromised credit card numbers belonging to individuals residing in Nevada.

14.49 On or about April 14, 2012, Bondarenko [1] set uniform advertising prices for vendors in the Infraud Organization.

14.50 From on or about April 24, 2012 to on or about May 7, 2012, Ali [3] purchased in excess of 130 compromised credit card dumps from Musliu [33].

14.51 From on or about April 26, 2012 to on or about March 1, 2013, Unindicted Co-conspirator Y purchased in excess of 30 CWs from Doe # 5 [34].

14.52 From on or about May 31, 2012, to on or about July 23, 2012, Okeakpu [22] purchased 6 compromised credit card rolls, including the personally-identifying information of the victims, from Doe #8 [13].

14.53 On or about June 8, 2012, Shiraz [18] posted two free dumps for the use of Infraud members and associates to the Infraud forum.

14.54 On or about June 27, 2012, Unindicted Co-conspirator L used Thomas' [7] automated lookup system to unlawfully obtain the personally-identifying information of S.C.C., D.J.S., J.H.W., and other individuals.

14.55 On or about July 7, 2012, Khan [24] advertised on the Infraud forum for his dumps checking service, "dumpscheckus," and solicited business from Infraud members and associates needing to check their dumps.

14.56 On or about July 7, 2012, Khan [24] advertised on the Infraud forum, offering credit card counterfeiting equipment for sale.

14.57 On or about July 10, 2012, Unindicted Co-conspirator U purchased checking services from Khan [24].

14.58 On or about July 31, 2012, Unindicted Go-conspirator T purchased checking services from Khan [24].

14.59 On or about August 9, 2012, Vargas [27] purchased two CWs from Musliu [33].

14.60 On or about August 16, 2012 to on or about September 4, 2012, Medvedev's [2] escrow service was used by Doe #7 [25] and another Infraud member to complete a criminal transaction.

14.61 On or about September 9, 2012, Bondarenko [1] set out the process by which new vendors would become verified within the Infraud Organization. Bondarenko [1] mandated that, prior to verification, would-be vendors must provide samples to the Infraud leadership of contraband that they intended to sell, in order for the leadership to ensure the quality of the wares.

14.62 On or about October 16, 2012, Vargas [27] advertised for his "World Wide Travel Agency" on the Infraud forum, offering to fraudulently book flights, rental cars, hotels, and seats at United States concerts and sporting events for Infraud members at a fraction of their actual price.

14.63 On or about October 28, 2012, Doe #7 [25] advertised on the Infraud forum, offering dumps of VISA, MasterCard, American Express, and Discover, credit card account numbers for sale to Infraud members.

14.64 On or about October 31, 2012, Ymeraj [31] contacted "SiteAdmin" on the Infraud forum via private message requesting the purchase of banner advertisement space on the forum for a one-month period.

14.65 In or about November, 2012, Unindicted Co-conspirator V purchased compromised credit card dumps from Doe #7 [25].

14.66 On, about, during and between November 8, 2012, and January 19, 2015, Unindicted Co-conspirator B purchased 21 dumps from El-Malak[35].

14.67 On or about January 23, 2013, Ahmed [10] received in excess of 1300 compromised PayPal account logins from Unindicted Co-conspirator H.

14.68 On or about January 26, 2013, Wilson [23] purchased a compromised credit card from the AVS operated by Musliu [33].

14.69 On or about February 6, 2013, Shiraz [18] posted a list of carding websites to the Infraud Forum and stated "best is infraud.cc".

14.70 On or about March 3, 2013, Fioretti [14] sent funds via Liberty Reserve for CWs that he bought from Ahmed [10].

14.71 On or about March 12, 2013 to on or about May 10, 2015, Unindicted Co-conspirator Z purchased compromised credit card dumps from El-Malak [35].

14.72 On or about March 25, 2013, Hoxha [9] received in excess of 15 compromised credit cards from Unindicted Co-conspirator O.

14.73 On about, during and between April 3, 2013, and May 20, 2013, Rojas [15] used Medvedev's [2] money exchanging service.

14.74 On or about April 10, 2013, Klimenko [20] began hosting the website "newnumbers.biz," which belonged to Infraud member Doe #3 [30] and served as an outlet for Doe #3 [30] to sell dumps to Infraud members and associates.

14.75 On or about April 13, 2013 to on or about April 17, 2013, Doe #2 [28] utilized an individual unknown to the grand jury as a drop for merchandise.

14.76 On or about April 15, 2013, Hoxha [9] received in excess of 15 compromised credit card dumps from Unindicted Co-conspirator O.

14.77 On or about April 16, 2013, John Doe #1 [26] posted in excess of 15 compromised credit card dumps on the Infraud forum as a sample for Infraud members.

14.78 On or about April 23, 2013, Chiochiu [12] posted a Craigslist email-scraping PHP script on the Infraud Organization forum.

14.79 On or about April 26, 2013, Doe #3 [30] advertised on the Infraud forum for his dumps website, "newnumbers.biz," which acted as an outlet for Doe #3 [30] to sell credit card dumps to Infraud members and associates.

14.80 On or about April 27, 2013, Unindicted Co-conspirator H sent Ahmed [10] in excess of 40 compromised credit card numbers.

14.81 On or about May 14, 2013, Chiochiu [12] posted a link to download a RAM credit card skimmer to the Infraud Organization forum.

14.82 On or about May 16, 2013, Unindicted Co-conspirator S sent Okeakpu [22] in excess of 15 compromised credit card dumps via email.

14.83 On or about July 10, 2013, Novak [11] posted an advertisement on the Infraud forum for his credit card dumps website, "uniccshop.ru." That same day, in the same thread, forum administrator Bondarenko [1] stated that Novak [11]'s advertisement has been paid for through July 10, 2014.

14.84 On or about August 12, 2013, Unindicted Co-conspirator R sent Lavoile [21] compromised credit card dumps.

14.85 On or about September 5, 2013, Unindicted Co-conspirator R sent Lavoile [21] compromised credit card dumps.

14.86 On or about September 16, 2013, Doe #8 [13] sent compromised credit card data to another Infraud member.

14.87 On or about October 26, 2013, Rojas [15] purchased a compromised credit card from Musliu [33].

14.88 On or about October 29, 2013, Leopard [29] began handling the website traffic for an AVS selling compromised credit card dumps, which was owned by Unindicted Co-conspirator W.

14.89 On or about November 3, 2013, Leopard [29] began hosting the website "tonymontana.cc," which belonged to Infraud member Doe #1 [26] and served as an outlet for Doe #1 [26] to sell dumps to Infraud members and associates.

14.90 On or about November 25, 2013, Wilson [23] purchased three compromised credit cards from the AVS operated by Musliu [33].

14.91 On or about February 24, 2014 to on or about February 27, 2014, Doe #2 [28] corresponded via email with an individual who was acting as a drop for merchandise.

14.92 On or about March 1, 2014, Hoxha [9] responded to a request on the Infraud forum by Unindicted Co-conspirator A for quality Visa and MasterCard large and small holograms, indicating that Unindicted Co-conspirator A should contact Hoxha [9].

14.93 On or about March 13, 2014, Abdelhamed [8] posted 50 dumps in response to a complaint on the forum by an Infraud member that Abdelhamed's [8] dumps were low quality.

14.94 On or about April 17, 2014, N'Djimbi Tchikaya [4] instructed Torteya [5] on how to join his AVS that was advertised on the Infraud forum and the cost associated with joining it via private message.

14.95 On or about May. 3, 2014, Doe #4 [32] advertised on the Infraud forum, proclaiming "We are glad to provide you best dumps services in market!!" and espousing that he had "only" United States dumps.

14.96 On or about May 6, 2014, Doe #4 [32] updated his advertisement via a post in the forum, listing inventory from.various States, and boasting that he had "120K USA updates" covering "Visa Master Amex, Discover."

14.97 On or about May 24, 2014, Unindicted co-conspirator EE posted in Doe #3's [30] vendor thread on the Infraud forum, mquiring if there was a way that he could be added to Doe #3's [30] dumps shop.

14.98 On or about July 15, 2014, Wilson [23] posted an advertisement on the Infraud forum sohciting sales of credit card fulls from other . Infraud members, stating they were needed immediately and offering prompt payment.

14.99 On or about September 3, 2014, Ali [3] posted 30 stolen CWs on the Infraud forum as a sample of his wares for members to view and use.

14.100 On or about September 3, 2014, Hoxha [9] posted in Unindicted Co-conspirator DD's vendor advertisement thread on'the Infraud forum, warning him not to copy Hoxha's [9] own vendor advertisement from elsewhere on the forum.

14.101 On or about September 9, 2014, Chiochiu [12] posted information on the Infraud Organization forum about how to make a RAM skimmer.

14.102 On or about October 13, 2014, Fawaz [17] sent an email to Ali [3] with his vendor advertisement indicating that 700 "fulls" and 3000 "cards" had been added to bis AVSes.

14.103 On or about November 10, 2014, Kovacevic [6] advertised to the Infraud forum for "scan kits" to manufacture fraudulent documents.

14.104 On or about November 17, 2014, Unindicted Co-conspirator S sent Okeakpu [22] in excess of 15 compromised credit card dumps.

14.105 On or about December 12, 2014, Ali[3] posted in excess of 15 dumps for members to the Infraud forum.

14.106 On or about December 23, 2014, Ahmed [10] received in excess of 1300 compromised PayPal account logins from Unindicted Co-conspirator H.

14.107 On or about January 19, 2015, Klimenko [20] began hosting, the website "torcarders.cc," which belonged to Unindicted Co-conspirator J and served as his/her outlet to sell dumps to Infraud members and associates.

14.108 On or about March 2, 2015 to April 21, 2015, Gamboa [19] discussed the sale of skimmers to various Infraud members via private message.

14.109 On or about March 26, 2015, Telusma [16] requested via private message that Bondarenko [1] ban another Infraud member for "ripping" him on a deal.

14.110 On or about April 16, 2016, Medvedev [2] posted to the Infraud forum explaining that Bondarenko [1] had gone missing, and that Medvedev [2] was now "admin and owner" of the Infraud Organization.

14.111 On or about July 22, 2016, Medvedev [2] posted to the Infraud forum indicating that the Organization now had an "open invite" policy, and that members would be able to secure invitations for their associates into the Infraud Organization, provided that the would-be new members met minimum standards.

14.112 On or about January 23, 2017, Doe #6 [36] posted an advertisement to the Infraud forum stating that he was "ready to introduce [his] private service" that he had been working on for over four years. It promised dumps that were "high quality, fresh, and guarantee 90%+ valid."

14.113 On or about July 12, 2017, John Doe #6 [36] posted updates to his Infraud vendor advertisement.

14.114 On or about August 2, 2017, John Doe #6 [36] sold in excess of 15 compromised credit card dumps belonging to Nevada cardholders from his/her AVS "goldenshop.cc" to an undercover agent for Homeland Security Investigations ("HSI").

14.115 On or about August 2, 2017, Novak [11] sold 15 compromised credit card dumps belonging to Nevada cardholders from his AVS "unicc.at" to an undercover agent for Homeland Security Investigations ("HSI").

14.116 On or about August 4, 2017, Novak [11] sold 54 compromised credit card dumps for Nevada cardholders from his AVS "unicc.at" to an undercover agent for Homeland Security Investigations ("HSI").

14.117 On or about August 8, 2017, John Doe #6 [36] sold in excess of 15 compromised credit card dumps belonging to Nevada cardholders from his AVS "goldenshop.cc", to an undercover agent for Homeland Security Investigations ("HSI").

All in violation of 18 U.S.C. § 1962(d).

COUNTS TWO THROUGH FOUR
Possession of Fifteen or More Counterfeit and Unauthorized Access Devices

On or about each of the dates set forth below, in the District of Nevada, and elsewhere,

[2] Sergey Medvedev, a.k.a. "Stelis," "Segmed," "Serjbear"; and
[11] Andrey Sergeevich Novak a.k.a. "Unicc," "Faaxxx," "Faxtrod";

Defendants herein, together with and aiding and abetting one another and others, known and unknown, knowingly and with intent to defraud, did possess fifteen (15) or more unauthorized access devices, that is stolen credit and debit card account numbers issued to persons other than the defendants, in and affecting interstate and foreign commerce, with each instance set forth below constituting a separate violation of Title 18, United States Code, Sections 1029(a)(3), and (c)(1)(A)(I); and Title 18 United States Code, Section 2, as follows:

Count Dates Approximate No. Devices

TWO August 2, 2017 15

THEEE August 4, 2017 54

FOUR August 8, 2017 57

COUNTS FIVE THROUGH SEVEN
Possession of Fifteen or More Counterfeit and Unauthorized Access Devices

On or about each of the dates set forth below, in the District of Nevada, and elsewhere,

[2] Sergey Medvedev, a.k.a. "Stelis," "Segmed," "Serjbear"; and
[36] John Doe #6, a.k.a. "Goldenshop," "Malov";

Defendants herein, together with and aiding and abetting one another and others, known and unknown, knowingly and with intent to defraud, did possess (15) or more unauthorized access devices, that is stolen credit and debit card account numbers issued to persons other than the defendants, in and affecting interstate and foreign commerce, with each instance set forth below constituting a separate violation of Title 18, United States Code, Sections 1029(a)(3), and (c)(1)(A)(I); and Title 18 United States Code, Section 2, as follows:

Count Dates Approximate No. Devices

FIVE August 2, 2017 17

SIX August 4, 2017 16

SEVEN August 8, 2017 17

COUNT EIGHT
Possession of Fifteen or More Counterfeit and Unauthorized Access Devices

In or about February, 2015, in the District of Nevada, and elsewhere,

[2] Sergey Medvedev, a.k.a. "Stells," "Segmed," "Serjbear"; and
[34] John Doe #5, a.k.a. "Deputat," a.k.a. "ZoOmer";

COUNT NINE
Possession of Fifteen or More Counterfeit and Unauthorized Access Devices

In or about June, 2014, in the District of Nevada, and elsewhere,

[2] Sergey Medvedev, a.k.a. "Stells," "Segmed," "Serjbear"; and
[33] Liridon Musliu, a.k.a. "Ccstore," "Bowl," "Hulk";

Defendants herein, together with and aiding and abetting one another and others, known and unknown, knowingly and with intent to defraud, did possess (15) or more unauthorized access devices, that is stolen credit and debit card acpount numbers issued to persons other than the defendants, in and affecting interstate and foreign commerce, with each instance set forth below constituting a separate violation of Title 18, United States Code, Sections 1029(a)(3), and (c)(1)(A)(I); and Title 18 United States Code, Section 2.

FORFEITURE ALLEGATION ONE
Racketeering Conspiracy

15. The allegations contained, in Count One of this Criminal Indictment are hereby realleged and incorporated herein by reference for the purpose of alleging forfeiture pursuant to Title 18, United States Code, Section 1963(a)(1), (a)(2), and (a)(3); Title 18, United States Code, Section 1028(g) and (h); Title 18, United States Code, Section 1029(c)(1)(C) and 1029(c)(2); Title 18, United States Code, Section 981(a)(1)(C) with Title 28, United States Code, Section 2461(c); Title 18, United States Code, Section 982(a)(2)(A); Title 18, United States Code, Section 982(a)(2)(B); Title 18, United States Code, Section 982(a)(6)(A)(ii)(I) with 982(a)(6)(B); and Title 18, United States Code, Section 982(a)(6)(A)(ii)(U) with 982(a)(6)(B).

16. Upon conviction of the felony offense charged in Count One of this Criminal Indictment,

[1] Svyatoslav Bondarenko, a.k.a. "Obnon," "Rector," "Helkern";

[2] Sergey Medvedev, a.k.a. "Stells," "Segmed," "Serjbear";

[3] Amjad Ali, a.k.a. "Amjad Ah Chaudary," "RedruMZ," "Amjad Chaudary"

[4] Roland Patrick N'Djimbi Tchikaya, a.k.a. "Darker," "dark3r.cw";

[5] Arnaldo Sanchez Torteya, a.k.a. "Elroncoluna";

[6] Miroslav Kovacevic, a.k.a. "Goldjunge";

[7] Frederick Thomas, a.k.a. "Mosto," "lstunna," "Bestssn";

[8] Osama Abdelhamed, a.k.a. "MrShrnofr," "DrOsama," "DrQsa-mal";

[9] Besart Hoxha, a.k.a. "Pizza";

[10] Raihan Ahmed, a.k.a. "Chan," "Cyber Hacker," "Mae Tony," "Tony";

[11] Andrey Sergeevich Novak, a.k.a. "Unicc," "Faaxxx," "Faxtrod";

[12] Valerian Chiochiu, a.k.a. "Onassis," "Flagler," "Socrate," "Eclessiastes";

[13] John Doe #8, a.k.a. "Aimless88";

[14] Gennaro Fioretti, a.k.a. "DannyLogort," "Genny Fioretti";

[15] Edgar Rojas, a.k.a. "Edgar Andres Viloria Rojas," "Guapo," "Guapo1998," "Onlyshop";

[16] John Telusma, a.k.a. "John Westley Telusma," "Peterelliot," "Pete," "Pette";

[17] Rami Fawaz, a.k.a. "Validshop," "Th3d," "Zatcher," "Darkeyes";

[18] Muhammad Shiraz, a:k.a. "Moviestar," "Leslie";

[19] Jose Gamboa, a.k.a. "Jose Gamboa-Soto," "Rafael Garcia," "Rafael101," "Mem-berplex2006," "Knowledge";

[20] Alexey Klimenko, a.k.a. "Grandhost";

[21] Edward Lavoile, a.k.a. "Eddie Lavoie," "Skizo," "Eddy Lavoile";

[22] Anthony Nnamdi Okeakpu, a.k.a. "Aslikel," "Aslike," "Money-mafia," "Shilonng";

[23] Pius Sushil Wilson, a.k.a. "FDIC," "TheRealGuru," "TheReal-GuruNYC," "RealGuru," "Poison," "Infection," "Infected";

[24] Muhammad Khan, a.k.a. "CoolJ2," "CoolJ," "Secureroot," "Secureroot1," "Secureroot2," "Mohammed Khan";

[25] John Doe #7, a.k.a "Muad'Dib";

[26] John Doe #1, a.k.a. "Carlitos," "TonyMontana";

[27] David Jonathan Vargas, a.k.a. "Cashmoneyinc," "Avb," "Poony," "Renegade11," "DvdSVrgs":

[28] John Doe #2, a.k.a. [ ] "a.k.a. [ ]

[29] Marko Leopard, a.k.a. "Lepoardmk";

[30] John Doe #3, a.k.a. "Scotish";

[31] Aldo Ymeraj, a.k.a. "Niii.'in," "Kubanezi," "Yankeeman";

[32] John Doe #4, a.k.a. "Best4Best," "Wazo," "Modmod," "Alone1," "Shadow," "Banderas," "Banadoura";

[33] Liridon Musliu, a.k.a. "Ccstore," "Bowl," "Hulk";

[34] John Doe #5, a.k.a. "Deputat," a.k.a. "ZoOmer";

[35] Mena Mouries Abd El-Malak, a.k.a. "Mina Morris," "Source," "Mena2341," "MenaSex,"

[36] John Doe #6, a.k.a. "Goldenshop," "Malov";

defendants herein, shall forfeit to the United States (1) any interest acquired or maintained in violation of Title 18, United States Code, Section 1962; (2) any interest in; security of; claim against; or property or contractual right of any kind affording a source of influence over; any enterprise established, operated, controlled, conducted, or participated in the conduct .of, in violation of Title 18, United States Code, Section 1962; and (3) any property constituting, or derived from, any proceeds obtained, directly or indirectly, from racketeering activity in violation of Title 18, United States Code, Section 1962;

defendants herein, shall forfeit to the United States, all illicit authentication features, identification documents, document-making implements, or means of identification in violation of Title 18, United States Code, Section 1028;

defendants herein, shall forfeit to the United States, any personal property used or intended to be used to commit the violations of Title 18, United States Code, Section 1029;

defendants herein, shall forfeit to the United States, any property, real or personal, which constitutes or is derived from proceeds traceable to violations of Title 18, United States Code, Sections 1028, 1028A(a)(1) with 1028A(c)(4), (c)(5), and (c)(7), 1029,1343,1344, or 1543, specified unlawful activities as defined in Title 18, United States Code, Sections 1956(c)(7)(A) and 1961(1)(B), or Title 18, United States Code, Section 1962(c) and (d), conspiracy to commit such offenses;

defendants herein, shall forfeit to the United States, any property constituting, or derived from, proceeds obtained directly or indirectly , as the result of violations of Title 18, United States Code, Sections 1343 and 1344, affecting a financial institution, or Title 18, United States Code, Section 1962(c) and (d), conspiracy to violate such offenses;

defendants herein, shall forfeit to the United States, any property constituting, or derived from, proceeds obtained directly or indirectly, as the result of violations of Title 18, United States Code, Sections 1028 and 1029, or Title 18, United States Code, Section 1962(c) and (d), conspiracy to violate such offenses;

defendant herein, shall forfeit to the United States, any property real or personal that constitutes, or is derived from or is traceable to the proceeds obtained directly or indirectly from the commission of violations of Title 18, United States Code, Sections 1028 and 1543, or Title 18, United States Code, Section 1962(c) and (d), conspiracy to violate such offense; and

defendant herein, shall forfeit to the United States, any property real or personal that is used to facilitate, or is intended to be used to facilitate, the commission of violations of Title 18, United States Code, . Sections 1028 and 1543, or Title 18, United States Code, Section 1962(c) and (d), conspiracy to violate such offenses;

specific property to be identified pursuant to Fed. R. Crim. P. 32.2(b)(2)(C); and

an in personam criminal forfeiture money judgment including, but not limited to, at least

Bondarenko [1], to be calculated pursuant to Fed. R. Grim. P. 32.2(b)(2)(C);

Medvedev [2], to be calculated pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);

Ali [3], to be calculated pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);

Tchikaya [4], $500,000;

Torteya [5], to be calculated pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);

Kovacevic [6], $50,000;

Thomas [7], $186,000;

Abdelhamed [8], to be calculated pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);

Hoxha [9], to be calculated pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);

Ahmed [10], $1,200,000;

Novak [11], $2,700,000;

Chiochiu [12], to be calculated pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);

Doe #8 [13], to be calculated pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);

Fioretti [14], $70,000;

Rojas [15], to be calculated pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);

Telusma [16], to be calculated pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);

Fawaz [17], to be calculated pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);

Shiraz [18], $326,000;

Gamboa [19], $100,000;

Klimenko [20], $150,000;

Lavoile [21], $30,000;

Okeakpu [22], $50,000;

Wilson [23], to be calculated pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);

Khan [24], $400,000;

Doe #.7 [25], $300,000;

John Doe #1 [26], $1,000,000;

Vargas [27], $355,000;

John Doe #2 [28], $48,000;

Leopard [29], $70,000;

John Doe #3 [30], $1,400,000;

Ymeraj [31], $675,000;

John Doe #4 [32], to be calculated pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);

Musliu [33], $277,725,552.33;

John Doe #5 [34], $279,612,110.41;

El-Malak [35], to be calculated pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);

John Doe #6 [36], to be calculated pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);

(all of which constitutes property).

17. If any property being subject to forfeiture pursuant to Title 18, United States Code, Section 1963(a)(1), (a)(2), and (a)(3); Title 18, United States Code, Section 1028(g) and (h); Title 18, United States Code, Section 1029(c)(1)(C) and 1029(c)(2); Title 18, United States Code, Section 981(a)(1)(C) with Title 28, United States Code, Section 2461(c); Title 18, United States Code, Section 982(a)(2)(A); Title 18, United States Code, Section 982(a)(2)(B); Title 18, United States Code, Section 982(a)(6)(A)(ii)(I) with 982(a)(6)(B); and Title 18, United States Code, Section 982(a)(6)(A)(ii)(II) with 982(a)(6)(B), as a result of any act or omission of the defendants-

a. cannot be located upon the exercise of due diligence;
b. has been transferred or sold to, or deposited with, a third party;
c. has been placed beyond the jurisdiction of the court;
d. has been substantially diminished in value; or
e. has been commingled with other property which cannot be divided without difficulty;

it is the intent of the United States of America, pursuant to Title 18, United States Code, Section 1963(m), to seek forfeiture of any properties of the defendants for the property listed above and the in personam criminal forfeiture money judgments listed above.

All pursuant to Title 18, United States Code, Section 9.81(a)(1)(C) with Title 28, United States Code, Section 2461(c); Title 18, United States Code, Sections 982(a)(2)(A) and 982(a)(2)(B), 982(a)(6)(A)(h)(1) and 982(a)(6)(A)(ii)(H) with 982(a)(6)(B), 1028A(a)(l) with 1028A(c)(4), (c)(5), and (c)(7), 1028(g) and (h); 1029(c)(1)(C) and 1029(c)(2), 1963(a)(1), (a)(2), and (a)(3); Title 18, United States Code, Sections 371, 1028, 1028A, 1029, 1029(b)(2), 1343, 1344, 1349, 1543, 1962(c) and (d); and Title 18, United States Code, Section 1963(m).

DATED: this 31st day of October, 2017

A TRUE BILL:

/S/
FOREPERSON OF THE GRAND JURY

STEVEN W. MYHRE
Acting United States Attorney

CHAD W. MCHENRY
Assistant United States Attorney
District of Nevada

DAVID A. JAFFE
Acting Chief, Organized Crime and Gang Section
U.S. Department of Justice

KELLY PEARSON
Trial Attorney
Organized Crime and Gang Section
United States Department of Justice

31Oct17

Text of the indictment charging 36 Defendants for Alleged Roles in Transnational Criminal Organization Responsible for Cybercrimes

Information
Bookshop \| Donate Derechos \| Equipo Nizkor

Count	Dates	Approximate No. Devices
TWO	August 2, 2017	15
THEEE	August 4, 2017	54
FOUR	August 8, 2017	57