Infraud Indictment

Case 2:17-cr-00306-JCM-PAL *SEALED* Document 77 Filed 10/31/17 Page 2 of 50
_-_rnrEfRED· -RECEIVED
_SERVED ON
COUNSEIJPARTIES OF RECORD
1 STEVEN W. MYHRE OCT 3 1 2017

Acting United States Attorney
2 Nevada Bar No. 9635 CLERK US DISTRICT COURT
CHAD W. MCHENRY DISTRICT OF NEVADA .
3 Assistant United States Attorney BY: DEPUTY
DAVID A. JAFFE
4 4cting Chief, Organized Crime and Gang Section,
· U.S. Department of Justice
5 KELLY PE.ARSON
Trial Attorney, Organized Crime and Gang Section
6 501 Las Vegas Blvd. South, Suite 1100
Las Vegas, Nevada 89101
7 (702) 388-6336
Chad.W.McHenry@usdoj.gov
8 Kelly.Pearson@usdoj.gov
9 Representing the United States of America
10
UNITED STATES DISTRICT COURT·
11 DISTRICT OF NEVADA
12
United States of America, SEALED.
13 First Superseding Criminal l!lclictment ·
Plaintiff,
14 2:17-cr-306-JCM-PAL
v.
15
[1] Svyatoslav Bondarenko, VIOLATIONS:
16 a.k.a. "Ob:nont
a..
k a. "Rect or, " . 18.U.S.C. § 1962(d): Racketeering Con-
17 a.k.a. "Helkern," . spiracy (Count 1)
18 [2] Sergey Medvedev, 18 U.S.C. § 1029(a)(3): Possession of 15

a.k.a. "Stells-," or more Access Devices (Counts 2
19 a.k.a. "segmed" through 9)
a.k.a. "serjbear"
20 18 U.S.C. § 2: Aiding and Abetting
[3] Amjad Ali, (Counts 2 through 9)
21 a.k.a. "Amjad Ali Chaudary"
a.k.a. "RedruMZ,"
22 a.k.a. "Amjad Chaudary"
1 [4] Roland Patrick N'Djimbi

Tchikaya,
2 a.k.a. "Darker,"
a.k.a. "dark3r.cvv,"
3
[5] Arnaldo Sanchez Torteya,
4 a.k.a. "Elroncoluna,"
5 [61 Miroslav Kovacevic,

a. k .a. "Gold'Junge, "
6
[7] Frederick Thomas,
7 a.k.a. "Mosto,"
.k a. "1 st unna, "
a ..
8 k a. "Best ssn, "
a ..
9 [8] Osama Abdelhamed,

a.k.a. ''MrShrnofr,"
10 a.k.a. "DrOsama,"
a.k.a. "DrOsamal,"
11
[9] Besart Hoxha,
12 a.k.a. "Pizza,"
13 [10] Raihan Ahmed,

a.k.a. "Chan,"
14 a.k.a. "Cyber Hacker,"
a.k.a. "Mae Tony,"
k a. "Tany, ,,
15 a ..
16 [11] Andrey Sergeevich Novak,

a.k.a. "Unicc,"
17 a.k.a. "Faaxxx,"
a.k.a. "Faxtrod,"
18
[12] Valerian Chiocbiu,
19 a. k .a. "O n1;3.ss1s,
. "
a ..
k a. "Flager,1 "
20 a.k.a. "Socrate,"
a.k.a. "Eclessiastes,"
21
[13] John Doe #8,
22 a.k.a. "Aimless88,"
2
1 [14] Gennaro Fioretti,

a.k.a. "DannyLogort,"
2 a.k.a. "Genny Fioretti"
3 .[16] Edgar Rojas,

a.k.a. "Edgar Andres Viloria Rojas"
4 a ..
k a. "Guapo, "
a.k.a. "Guap61988/
5 a.k.a. "Onlyshop,"
6 [16] John Telusma,

a.k.a; "John Westley Telusma"
7 a.k.a. "Peterelliot,"
a.k.a. "Pete,"
& a.k.a. "Pette,"
9 [17] Rami Fawaz,

a.k.a. "Rami !mad Fawaz"
10 a.k.a. ''Validshop," ·
a.k.a. "Th3d,"
11 a.k.a. "Zatcher,"
a.k.a. "Darkeyes,"
12
[18] Muhammad Shiraz,
13 a.k.a. ''Moviestar,"
k a. ''LesIie,"
a ..
14
[19] Jose Gamboa,
15 a.k.a. "Jose Gamboa-Soto,"
a.k.a. "Rafael Garcia,"
16 a.k.a. "RafaellOl,"
a.k.a. "Memberplex2006,"
17 a.k.a. "Knowledge,"
18 [20] Alexey Klimenko,

k a ..''G·randhos,
a .. t"
19
[21) Edward Lavoile,
20 a.k.a. "Eddie Lavoie"
a.k.a. "Skizo,"
21 a.k.a. ~'Eddy Layoile"
22
3
1 [22] Anthony Nnamdi Okeakpu,

k a. "Aslike 1"
· a .. ,
2 a.k.a. "Aslike,"
k a. "M..
a .. oneymafia, "
3 a ..k a. "Shilonng,"
4
[23] Pius Sushil Wilson
5 a.k.a. "FDIC,"
a.k.a. "TheRealGuru,"
6 a.k.a. "TheRealGuruNYC,"
a.k.a. "RealGuru,"
k a. "Po1son, ,,.
7 a ..
a.k.a. "lnfection,"
8 a,k.a. "Infected,"
9 [24] Muhammad Khan,

a.k.a. "CoolJ2,"
10 a.k.a. "CoolJ,"
a.k.a. "Secureroot,"
11 a.k.a. "Securerootl,"
a.k.a. "Secureroot2,"
12 a.k.a. ''Mohammed Khan"
13 [25] John Doe #7,

a.k.a. "Muad'Dib,"
14
[26] John Doe #1,
15 a.k.a. "Carlitos,"
a.k.a. "TonyMontana,"
16
[27] David Jonathan Vargas,
17 a.k.a. "Cashmoneyinc,"
· a.k.a. "Avb,"
18 . a.k.a. "Poony,"
a.k.a. "Renegade 11,"
19 a.k.a. "DvdSVrgs,"
20 [28] John Doe #2;

a.k.a.
21 a.k.a.
22 [29] Marko Leopard,

k a. "Leopar dmk"
a .. ,
4
1
[80] John Doe #8,
2 a.k.a. "Scotish,"
3[31] Aldo Ymeraj,

a.k.a. "Nill.in,"
4 .a. k .a. "Kbu anez1,.,,
k a. ·''Yankeeman,
a .. . "
5
[32] John Doe #4,
6 a.k.a. '';Best4Best,"·
a.k.a. ''Wazo,"
7 a.k.a. "Mod.mod,"
k a. "Alone 1"
a .. ,
8 a.k.a. "Shadow,"
a.k.a. "Banderas,"
9 a.k.a. "Banadoura,"
10 [33] Liridon Musliu,

a.k.a. "Ccstore,"
11 a.k.a. "Bowl,"
a.k.a. "Hulk,"
12
[34] John Doe #5,
13 a.k.a. "Deputat,"
a.k.a. "ZoOmer,"
14
[35] Mena Mouries Abd El-Malak,
15 a.k.a. ''Mina Morris"
a.k.a. "Source,"
16 a.k.a. ''Mena2341,"
a.k.a. ''MenaSex,"
17
[86] John Doe #6,
18 a.k.a. "Goldenshop,"
a.k.a. "Malov,"
19
Defendants.
20
21
22
5
1 FIRST SUPERSEDING INDICTMENT
2 THE GRAND JURY CHARGES THAT:
3 GENERAL ALLEGATIONS
4 These General Allegations are realleged and incorporated by reference in
5 Count One (Conspiracy to Engage in a Racketeer Influenced Corrupt Organization).
6 Introduction
7 1. At all times relevant. to this Indictment, the defendants, anc,l ot:hers· known
8 and unknown to the grand jury, w~re members and associates of a criminal organi-
9 zation, herein referred to as the "Infraud Organization," which engages in, among
10 other things, acts of identity theft and financial fraud. These acts include, but are
11 not limited to: money laundering; trafficking in stolen means of identification; traf-
12 ficking .in, production and use of counterfeit identification; identity theft; trafficking
13 in, production and use of unauthorized and counterfeit access devices; bank fraud;
14 and wire fraud, as weµ as services associated with all of the above. The Organization
15 operates in the District of Nevada and elsewhere.
16 2. A primary purpose of the Infraud Organization is to promote and grow in-
17 terest in the Infraud Organization as the premier destination for carding, and to
18 direct traffic and potential purchasers to the automated vending sites of its mem-
19 ·bers, which serve as online instruments that traffic in stolen means of identification;
20 personally-identifying information, stolen financial and banking information, and
21 other illicit goods. As of March 2017, there were 10,901 member accounts on the
22 Infraud Organization's discus"Sion forum.
6
1 Definitions ·
2 3. The following are definitions for terms used throughout this Indictn;ient:
3 a. "AVS" or "automated vending site" are used to describe automated
4 websites that do riot require human intervention to function) and that are used by
5 In:fraud members to purchase and sell illicit goods.
6 b. "Bulletproof. Hosting" and "Abuse Hosting'' are services provided
7 by a domain or web hosting firm that allows their customers considerable leniency
8 in the kinds of material the customer distributes from the firm's servers. 'Such ma-
9 terial may include spam, compromised credit card data, high yield investment prod-
10 uct ("Ponzi") schemes, online gambling, and malware distribution infrastructure.
11 c. "Carded travel services'' are services wherein the vendor books
12 things such as airline or train tickets, hotel rooms, rental cars, sporting or entertain-
13 ·ment event ticket, or other items for his or her customer. These bookings are made
14 using fraudulent or stolen credit card numbers. In exchange, the customer pays the
15 vendor a fraction of the face value of the items booked-typically, 20~30%.
16 d. "Carding" refers to the general concept of purchasing retail items with
17 counterfeit credit cards or stolen credit card information. Such scheme may involve
18 · a counterfeit credit card that has been encoded with the legitimate victim account
19 information, and is presented. to a store's cashier by the offender: Often, various
20 false identification documents are used to facilitate· this fraud. "Carders" is a term
21 used by members of a carding organization to describe themselves.
2·2
7
Case 2:17-cr-00306-JCM-PAL *SEALED* Document 77 Filed 10/31/17 · Page 9 of 50
1 e. "CVV'' and "fulls" refer to compromised credit card account data that
2 typically contains all of a cardholder's information except for information encoded on
3 the magnetic track on the rear of the card. This account data generally includes an
4 account holder's name, date of birth, social security number, address, telephone and
5 mother's maiden name, as well as the security code on the rear of the credit card.
6 f.. · "Dumps" are coin.promised credit card account data.·
7 g. "D1:'op" can have several different meanings depending on the context
8 in which it is used, but generally refers to a location or individual able to securely
9 receive and then forward goods obtained via carding or other types of fraud. A typical
10 drop service request might ~e: "Do you have a drop I can ship a laptop to?"
11 h. "Forum'' and "Website" are terms used interchangeably to describe
12 the online gathering place used as a meeting location for Infraud members.
13 i. "Holograms" are labels with a hologram printed onto them for secu-
14 rity reasons. They are commonly found on genuine cre~t cards and identifications.
15 j. "ICQ" is a free instant messaging electronic communication service, or :
· 16 "chat" service. ICQ user accounts are identified by a Universal Identification Num-
17 1Jer, or "UIN." An ICQ user m:ay store frequently-contacted UINs in a "buddy list."
18 k. "Internet Protocol address," and "IP address," refer to a network
19 identµier used by a computer to access the Internet. IP· addresses ·are assigned to
20 computers by the Inte~net Service Provider they use to acc~ss the Internet.
21
22
8
1 I. ''Liberty Reserve" was an online .currency utilized by Infraud mem-
2 hers to facilitate the sale and purchase of compromised access devices, personal iden-
3 tifying information, malware and. the services associated with such.
4 m. ''Malware" is hostile or intrusive software that can be used to com-
5 promise end-user PCs and smartphon~s or retail point-of-sale ("POS'') systems,
6 among other things. Although functionality varies, malware is often used to harvest
7 · personally-identifying information and financial data, to gather intelligence for later
8 use in a fraud scheme, or to electronically and unlawfully monitor victims.
9 n. "PHP" stands for "PHP: ·Hypertext Preprocessor," and is a program-
10 ming/scripting language commonly used to create interactive websites, such as
11 AVSes, as well as other Internet-related tools and applications.
12 o. ''PM" means "Private Message." These are .any non-public messages
13 sent between users on a website or service, such as the Infraud Organization's forum.
14 p. "Proxy'' and "Proxy Server" describe a computer that acts as an in-
15 termediary in a client's Internet connection, relaying that client's Internet request.
16 to its ultimate destination on the Internet and relaying back the. destination's re-
17 spouse or content to the client. Proxies are often used to provide a degree of ano-
18 nymity by obscuring the user's originatin~ IP address. Generally, the traffic itself
19 between a pr·oxy .server and its client is unencrypted.
20 q. "Ripper" refers to a vendor of illicit goods of poor. quality, or one who
21 did not deliver the goods promised in a transaction. Infraud leadership routinely
22 policed the forum for rippers, disciplining them to protect the general membership.
9
Case 2:17-cr-00306-JCM-PAL *SEALED* Document 77 . Filed 10/31/17 Page 11 of 50
1 r. ''Virtual Priv:ate Network" and ''VPN'' describe a connection .CQnfigM
2 uration very similar to that involved with a proxy server, except that a VPN forms
3 an encrypted tunnel from the client to the VPN server, thus providing a layer of
4 privacy to the data traffic being exchanged between the client and the VPN.
5 s. ''We"!;> Hosting'' services maintain server computers connected to .the
6 Internet. Their customers use those computers to operate websites on the. Internet.
7 Customers of web hosting companies place files, software code, databases, and other
8 data on servers that they wish to be accessible on the Int~rnet. The Infraud OrganiM
9 zation's website is an example of something that is provided via a web host.
10 Structure and Operation of the Enterprise
11 4. At all times relevant to thi-s Indictment,
12 [1] $vyatoslav Bondarenko, a.k.a. "Obnon," "Rector," "Helkern";

[2] Sergey Medvedev, a.k.a. "Stells,". "Segmed," "Serjbear";
13 [3] Amjad Ali, a.k.1;1. "Amjad Ali Chaudary," "RedruMZ," "Amjad
Chaudary'';
14 [4] Roland Patrick N'Djimbi Tchikaya, a.k.a. "Darker,"
"dark3r.cvv";
15 [5] Arnaldo Sanchez Torteya, a.k.a. "Elroncoluna";
[6] Miroslav Kovacevic, a.k.a. "Goldjunge";
16 [7] Frederick Thomas, a.k.a. "Mosto," "lstunna," "Bestssn'';
[8] Osama Abdelhamed, a.k.a. "MrShrnofr," · "DrOsama,"
17 "DrOsamal";
[9] Besart Hoxha, a.k.a. "Pizza";
18 [10] Raihan Ahmed, a.k.a. "Chan," "Cyber Hacker," "Mae Tony,"
"Tony";
19 [11] Andrey Sergeevich Novak,· a.k.a. "Unicc," "Faaxxx," "Faxtrod";
[12] Valerian Chiochiu, a.k.a. "Onassis," "Flagler'," "Socrate,"
20 "Eclessiastes";
[13] John J?oe #8, a.k.a. "Aimless88";
21 [14] Gennaro Fioretti, a.k.a. "DannyLogort," "Genny: Fioretti";
[15] Edgar Rojas, a.k.a. "Edgar Andres Viloria Rojas," "Guapo,"
22 "Guapol998," "Onlyshop";
10
1 [16] · John Telusma, a.k.a. "John Westley Telusma," ".Peterelliot,"

"Pete," "Pette";
2 [~7] Ra.mi Fawaz, a.k.a. ''Validshop," "Th3d," "Zatcher," "Darkeyes";
[18] ).V[uhammad Shiraz, a.k.a. "Moviestar," "Leslie";
3 [19] Jose Gamboa, a.k.a. "Jose Gamboa-Soto," "Rafael Garcia," "Ra-
faellOl," "Memberplex2006," "Knowledge";
4 [20] Alex.ey Klimenko, a.k.a. "Grandhost";
[21] Edward Lavoile, a.k.a. "Eddie Lavoie," "Skizo," ''Eddy Lavoile";
5 [22] Anthony Nnamdi Okeakpu, a.k.a. "Aslikel," "Aslike," ''Money-
'mafia," "Shilonng'';
6 [23] Pius Sushil Wilson, a.k.a. "FDIC," ."TheRealGuru," "TheReal-
GuruNYC," "RealGuru/' "Polson," "Infection," "Infected";
7 [24] Muhammad Khan, a.k.a. "CoolJ2," "CoolJ," "Secureroot," "Secur-
erootl," "Secureroot2, ''Mohammed Khan";
8 [25] John.Doe #7, a.k.a "Muad'.Dib";.
[26] John Doe #1, a.k.a. "Carlitos," "TonyMontana";
9· [27] David Jonathan Vargas, a.k.a. "Cashmoneyinc," "Avb/ "Poony,"
"Renegadell," "DvdSVrgs";
10 [28] John Doe #2, a.k.a. "a.k.a. ;
[29] Marko Leopard, a.k.a. "Lepoardmk";
11 [30] John Doe #3,· a.k.a. "Scotish";
[31] Aldo Ymeraj, a.k.a. "Nill.in," "Kubanezi," ''Yank;eeman";
12 [32] John Dpe #4, a.k.a. "Best4Best," "Wazo," ''Modmod," "Alonel,"
"Shadow," "Banderas," "Banadoura";
13 [33] Liridon Musliu, ·a.k.a. "Ccstore," "Bowl," "Hulk";
[34] John Doe #5, a.k.a. "Deputat," a.k.a. "ZoOmer";
14 [35] Men~ Mouries Abd El-Malak, a.k.a. ''Mina Morris," "Source,"
''Mena2341," ''MenaSex,."
15 [36] John Doe #6, a.k.a. "Goldenshop," "Malov";
16 the defendants herein, and others known and unknown to the grand jury, are mem-
17 b~ts of, ~mployed by, and associates of the Infraud Organization. Members and as-
18 sociates of the Infraud Organization operate in Las Vegas, Nevada; the United
19 States; and throughout the rest of the world.
20 5. The Illfraud ·Organization, including its leadership, members, and associ-
21 ates, constitutes an enterprise as defined by 18 U.S.C. § 1961(4): that is, a group of
22 individuals associated-in-fact,. The enterprise constitutes an ongoing organization
11
Case 2:17-cr-00306-JCM-PAL *SEALED* Document 77 Filed 10/31/17 Page 13 of o
1 whose members function as a continuing unit for a common purpose of achieving the
2 objectives of ~he enterprise. The enterprise is engaged in, and its activities affect,
3 interstate and foreign comme_rce.
4 6.. The hierarchy of the Infraud Organization includes, but. is not

. ' limited to:
5 a. Administrators, a.k.a. "4DMini57r470rz": Administrators are indi"
6 viduals that serve as a governing council of the Infraud Organization who, collec"
7 tively, control the destiny of the organization. The administrator(s) initially seeded
8 the Infraud Organization forum with "reputable" vendors of contraband in order. to
9 · attract traffic and membership and grow.the organization. They handle the day"to"
10 day management decisions of the Infraud Organization, as well as long term strate"
11 gic planning for its continued viability. They determine which individuals are per"
12 mitted to become and remain members of the Infraud Organization; the functions,
13 responsibilities and levels of access to information for all members· of the organiza- ·
14 tion; and the rewards accorded members for t:Jieir loyalty to the organization 1;ts well
15 as the punishments meted out to members evidencing disloyalty to the organization.
16 Furthermore, they decide when, how and under what circumstances to attack and
17 to retaliate against members of rival criminal organizations and their associated In"
18 tern~t websites. The administrator(s) are accorded full 'access to, and privileges on,
19 the computer servers hosting. the Infraud Organization}s websites, and, thus, have
20 the ultimate responsibility for the physical administration, maintenance, and secu"
21 rity of these servers and websites.

22
12
1 b. Super Moderators,. a.k.a. "Super MODER470R5": Super Moderators
2 oversee and administer one or more subject-matter specific areas on the Organiza-
. .
3 tion's forum that either fall within an area of their expertise or cover their geographic
4 location, limiting their activities to editing and delet~g posts by members on these
5 forums and mediating disputes. Super Moderators also frequently serve as revi~w-
6 ers for particular products or services with which they have an expertise.
7 c. Moderators, a.k.a. "M0d3r470r2": Moderators, like Super Moderators,
8 over'see and adininister one or more subject-matter specific areas on the Organiza-
9 tion's forum that either fall within an area of their expertise or cover their geographic
10 location. However, Moderators tend to be more limited in the ·authorio/ they are
11 granted, and are generally limited to moderating one or two specific sub-forums.
12 d. Vendors, a.k.a. "Professors" or "Doctors": Vendors sell illicit products
13 and services to members of the Infraud Organization. These sales may occur through
14 the vendor's own website, to which would-be purchasers are directed by the adver-
15 tisements they pay for and place on the Infraud Organization's web forum. Such
16 sale$ may also occur directly between the vendor and customer, i.e. via email, PM,
17 or ICQ. Products sold by vendors are reviewed on the forum by Infraud members, to
18 ensure that vendors of low-quality goods do not remain in business with the Organ-
19 ization. This help~ to cement the Organization's reputation as a premiere online des-
20 tination for safs, high-quality and readily-available fraud-related contraband.
21 e. ·VIP Members, a.k.a. "Fratello Masons" or "Advanced Members":
22 These are some of the premiere members of the Infraud Organization. The leaders
13
1 of the Organization bestow this title upon longstanding or otherwise notable mem-
2 hers in order to distinguish them from the general membership and from vendors.
3 f. Members, a.k.a. "Phr4Ud573r": General members of the Infraud Or-
4 ganization typically use the organization's websites to gather and provide infor-
5 mation about perpetrating criminal activity; to share information with and solicit
6 other members to engage in their criminal schemes; to use the website's vendors to
7 facilitate their unlawful purchases of credit card dumps, false id1mtification docu-
8 ments, and other contraband; and in order to have their individual disputes with
9 other Organization members settled by the Ad.ministrator(s) or Moderators.
10 7. Members 'join the Infraud Organization via an online forum. To be granted
11 membership, an Infraud Administrator must approve the request. Once granted
12 membership, members can post and pay for advertisements within the Infraud fo-
13 rum. Members may move up and down the Infraud hierarchy. The Infraud Organi-
14 zation continuously screens the wares and services of the vendors within the forum
15 to ensure quality products. Vendors who are considered subpar are swiftly identified
16 and punished by the Infraud Organization's Administrators.
17 The Defendants
18 8. At various ti.J;nes relevant to this Indictment, the following individuals,
19 among others, were members or associates of the Infraud Organization in the vari-
20 ous capacities or ran.ks set forth below, carrying out and agreeing to carry out various
21 activities in furtherance of the enterprise described in this Indictment:
22 [1] Svyatoslav Bondarenko created the Infraud Organization in Oc-

tober of 2010. In addition to being one of the Organization's de facto
14
1 leaders, by virtue of his standing, Bondarenko [1] held the rank

of Administrator within the Organization. In 2015,
2 Bondarenko [1] stopped posting on and/or using Infraud.
3 [2] Sergey Medvedev is a co-founder of the Infraud Organization

with Bondarenko [1], and has been an active member on .the Or-
4 ganization's website since Noyember of 2010. Medvedev [2] is one
of the Organization's leaders, ·and also holds the rank of Adminis-
5 trator within the Organization. Medvedev [2] operates an "es-
crow" or currency exchanging service for the benefit of Infraud Or-
6 ganization members engaging in transactions with other members,
to ensure the integrity of those .transactions. After Bondarenko
7 [1] went missing in 2015, Medvedev [2]. took his place as owner
and administrator of the Infraud Organization.
8
[3] . Amjad Ali became a member of the Infraud· Organization in De-
9 cember of 2010. Ali [3] is a vendor of CVVs, and has since been
elevated by Medvedev [2] to Super Moderator ·status.
10
[4] Roland Patrick N'Djimbi. Tc;hikaya became a member of the In-
11 fraud Organization in January of.2011. He advertises in the Organ-
ization as a. Vendor o.f CVV~ and an operator of the "d4rksys.cc"
12 website to sell-CVVs to Organization membership.
13 [5] 'Arnaldo Sanchez Torteya became a member of the Infraud Or-

ganization in November of 2010. He was promoted to-VIP Member
14 in December of 2010 by Bondarenko [1], and advertises in the
Organization as a seller of CVVs and lookups of credit profile and/or
15 personally-identifying information. ·
16 [6] Miroslav Kovacevic became a in.ember of the Infraud Organiza-

tion in November of 2010. He advertises within the Organization
·17 as· a Vendor of plastics, tern.plates, and scans.
18 [7] Frederick Thomas became a member of the Infraud Organization

in October of 2011. He advertises within the. Organization as a Ven-
19 dor of a Social Security Number and date of birth lookup service.
20 [8] Osama Abdelhamed became a member of the Infraud Organiza-

tion in September of 2013. He advertises as a Vendor of dumps
21 within the Organization, and is an operator of the "iswipe.cc" and
"iswipe.pl" .websites, using them as outlets to sell dumps to Infraud
22 Organization members and associates.
15
Case 2:17-cr-00306-JCM-PAL *SEALED* Document 77 Filed ~0/31/17 Page 17 of 50
1 [9] Besart Hoxha became a member of the In.fraud Organization in

January of 2011. He advertises within the Organization as a Ven-
2 dor of "High Quality Plastics & Holos ~ VISA, MasterCard, Ame:x;, ·
Discover," and sells plastic card stock and holograms to Infraud Or-
3 ganization members and a.ssociates. ·
4 [10] · Raihan Ahmed became a member of the rnfraud Organization in

January of 2011. He is a Vendor of comproinised PayPal accounts,
5 selling to Infraud members and asso~iates.
6 [11] Andrey Sergevich Novak became a member of the Infraud Or-

ganization in January of 2013. He advertises as a Vendor of CVVs,
7 and is an operator of the "uniccshop.ru" website, using it as an out-
let to. sell CVVs to Infraud Organization members and associates.
8
9 [12] Valerian Chiochiu became a member of the Infraud Organization

in December of 2012. He is a member within the Organization, and
10 provides guidance to other members on the development, deploy-
ment, and use of random access memory ("RAM") point-of-sale
11 ("POS") malware as a means of harvesting stolen data.
12 [13] John Doe #8 became a member of the Infraud· Organization in'

April of 2011. He operates and advertises as a Vendor of compro-
13 mised online bank logins within the Organization.
14 [14] Gennaro Fioretti became a member of the Infraud Organization

in December of ~010, and was later promoted to VIP Member. He
15 is extremely active on the member forum ·and has made numerous
illicit purchases from Infraud vendors and fellow members.
16
[15] Eclgar Rojas became a member 0£ the In.fraud Organization in
17 September of 2011. He was promoted to VIP Member status by
Bondarenko [1] shortly after joining.
18
[16] John Telusma became a member of the In.fraud Organization in
19 August of 2011..He is a Vendor within the Infraud Organization,
P.roviding "cashout".and·"drop" services for Organization member-
20 ship, in addition to selling dumps.
21 [17] Rami Fawaz became a member of the Infraud Organization in

January of 2011. Although only designated a member of the Organ-
22 ization, Fawaz [17] sold compromised account data to Infra~d Or-
16
Case 2:17-cr-00306-JCM:PAL *SEALED* Document 77 Filed 10/31/17 Page 18 of 50
1 ganization members and associates via the well-regarded auto-

mated vending site, "validshop.su."
2
[18] Muhammad Shiraz became a member of the Infraud Organiza-
3 tion in November of 2010. He advertises as a Vendor of dumps
within the Organization's forum.
4
[19] Jose Gamboa became a member of the In.fraud Organization in
5 December of 2010. He advertises as a Vendor of custom-built ATM
skimmers within the Organization's forum.
6
[20] Alexey Klimenko became a member of the In.fraud Organizatidn
7 in September of 2011. He advertises as a Vendor of"Abuse Immun-'
ity" or "Bulletproof Hosting" servi,ces that Organization members
8 and associates can employ to create, operate, maintain and protect
·their own online contraband stores.
9
[21] Edward Lavoile became a i;nember of the Infraud Organization in
10 July of 2011_. Although only designated a :inem~er, he has adver-
tised for sale to fellow Infraud Organization members "fresh" CVVs
11 tp.at he had personally ~acked from Canada. ·
12 [22] Anthony Nnamdi Okeakpu became a member of the Infraud Or-

ganization in December of 2010. He was promoted to VIP Member
13 by Bondarenko [1] in April of 2014, and has also held the posts.of
Moderator and Super Moderator m the Organization.
14
[23] Pius Sushil.Wilson became a member of the Infraud Organization
15 in January of 2011.He is a VIP Member within the Organization,
and was one of the more active Infraud members,. having made
16 hundreds of posts to the Organization's forum. · ·
17 [24] Muhammad Khan became a member of the Infraud Organization

in August of 2011. He is designated as a "Vendor of Checking," and·
18 operates a service for Organization membership that shows
whether a given stolen credit card number is still operable or if it
19 has been shut down by the bank for fraud.
20 [25] John Doe #7 became a member of the Infraud Organization in Oc-

tober of 2011. He advertises as a Vendor of dumps within the In-
21 fraud Organization's forum, and is an operator of one of the more
well-regarded AVSes, "mdshop.org."
22
17
1 [26] John Doe #1 became a member of the In.fraud Organization in

September of 2011. He advertises as a Vendor of dumps, and is ;in
2 operator of the "tonystuff.cc" and "tonymontana.cc" websites as out-
lets to sell dumps to In.fraud Organization membership.
3
[27] David Jonathan Vargas became a member of the In.fraud Organ-
4 ization in August of 2011. He advertises in the Organization's fo-
rum as a Vendor of carded travel services.
5
[28] John Doe #2 became a member of the In.fraud Organization in
6 January of 2011. He advertises in the Organization as a Vendor of
drop services, and directed members to a website under his control
7 to complete their purchases.
8 [29] Marko Leopard became a member of the In.fraud Organization in

June of 2011. He operates "Abuse Immunity"· or "Bulletproof Host-
9 ing" services that Orga~zation member.s can employ to create; op-
erate, maintain and protect their own online contraband stores.
10
[3-0] · John Doe #3 became a member of the In.fraud Organization in No-
11 vember of 2010. He advertises in the Organization's forum as a
Vendor of dumps, ap.d is an operator of the "newnumbers.biz" web-
12 site, using it as an outlet to sell dumps to In.fraud members and
associates.
13
[31] Aldo Ymeraj became a member of the In.fraud Organization in No-
14 vember of 2010. He advertises in the Organization's forum as a
Vendor of dumps, and is an operator of the "niii.in" AVS, using it
15 as an outlet to sell dumps to In.fraud members and associates.
16
[32] John Doe #4 became a member of-the In.fraud Orga;nization in
17 May of 2014. He advertises in the Organization's forum as a Vendor
of dumps, and is an operator of the "Best4best.su" AVS.
18
[33] Liridon Musliu became a member of the In.fraud Organizatoin in
19 August ~f 2011. He advertises in the Organization's forum as a Ven-
dor of dumps, and operates the AVS located at the "ccstore.me,"
20 "ccstore.name," and "ccstore.ws" domains.
21 [34] John Doe #5 became a member of the In.fraud Organization in Oc-

tober of 2010. He· is an operator of the "swiped.su" and "ap-
22 proved.su" AVSes, which he used to sell dumps to other In.fraud
18
1 Organization members and associates.
2 [35] Mena Mouries Ahd El-Malak became a member of the Infraud

Organization in November of 2010. He advertises as a Vendor of
3 dumps within the Organization, and is an operator of the AVS lo-
cated at "sour~e4dumps.tv," which he used to sell dumps to other
4 Infraud Organization members an~ associates.
[36] John Doe #6 became a member of the In.fraud Organization in

January of 2011. He advertises in the Organization's forum as a
6 Vendor of dumps, and is an operator of the Avs· at "golden~
dumps.cc"
7
Purposes of the Enterprise
9. The purposes of the enterprise include, but are not limited to:
9
a. To enrich the n:iembers and associates of the Infraud Organization
10
through the unlawful trafficking in: counterfeit and illegal means of identification,
11
document-making implements, counterfeit identification documents, device-making
12
equipment, and unauthorized and counterfeit access devices to include stolen credit
13
card numbers;
14
b. To establish the Organization as the premier online destination for the·
15
purchase and sale of stolen property and other contraband, such as victims' personal
16
and financial means of identification, and forged identification documents;
17
c. To "educate" members in obtaining and using such property and con-
18
traband;
19
d. To direct traffic, primarily through.
. advertising,
. to member-owned
20
and/or operated AVSes and other websites to generate illicit proceeds, and to thereby
21
promote the In.fraud Organization as the premier online source of "reputable" ven-
22
dors and high-quaHty contraband.
19
1 e. To protect the enterprise and its membel's from detection,· apprehension
2 and prosecution by law enforcement; and
3 f. To preserve and protect the reputation, operations and profits ·of the
4 enterprise through discipline, expulsion, and other acts of retribution against non-
5 conforming members.
6 Manner and Means of the Enterprise
7 10. The manner and means by which the defendants and their associates con-
8 duct and participate in the conduct of the affairs of the enterprise include, but are
9 not limited to, the following:
10 a. Members of the enterprise utilize an online discussion forum called ''In-
11 fraud," with the slogan of "In Fraud We Trust," controlled by Infraud Organization
. '
12 Administrators, to discuss, meet, and conduct criminal activities . .Such activities·in~
13 elude the sale and purchase of stolen social security numbers,. dates of birth, ad-
14 dresses, passwords, and· other personally identifying information and property, ad-
15 vertising services to facilitate such activity, a,nd disseminating malware.
16 b. The Infraud· Administrators bestow:ed specific benefits on members to
17 include the a~ility to pay for posted advertisements for their respective AVSes, post
18 questions· related to the sale and purchase of stolen personally-identifying infor-
19 mation and property and the dissemination of malware, and obtain .free samples of
20 the "wares" of various I:Q.fraud vendors.
21 c. Me:,:n.bers <?f the enterprise and their associates are classified by various
22 roles assigned to them by the leadership of the Infraud Organization. This hierarchy
20
1 was established to maintain order, to grow the Organization's membership, ap.d to
2 facilitate the goals of the enterprise.
3 d. To enforce the rules of the enterprise, and. maintain its reputation,
4 members and associates engage in the feedback or rating of various vendors on the
5 website. The system was d~signed to maintain the quality of contraband sold via the
6 Infraud website, as well·as via associated member-owned and/or operated vending
7 websites.
8 e. The leadership of the Infraud Organization routinely policed the In-
9 .fraud forum for "rippers" and other rule-violators, in order to ensure the quality of
10 contraband sold and to protect the reputation of the general membership of the In-
11 fraud Organization.
12 .f. Members and associates strive to achieve shared anonymity, to remain
13 as anonymous as possible in order to evade law enforcement and other "real-world"
14 or "offline" consequences for their fra,udul~nt and criminal activities. To that end,
15 ~embers and associates remain anonymous even to each other. They are generally
16 referred to online and interact only via their online "nic" or "username." Members
17 and associates use any means possible to hide their identity.
18 g. 'Members and associates launder proceeds obtained through their un-
19 lawful activ1ties by using, among other methods, Liberty Reserve, Bitcoin, Perfect
20 Money, WebMoney, and other digit~ currencies, to conceal the nature of their pro-
21 ceeds and move the proceeds among enterprise members and associates.
22
21
Case 2:17-cr-00306-JCM-PAL *SEALED* Document 77 Filed 10/31/17 Page 23 of o
r h. Members of the enterprise and their associates use the In.fraud Organ-
2 ization's website to advertise and direct buyers and sellers to their own AVSes and
3 websites. This is done to col?'.lplete sales of contraband, to create repeat customers,
4 · and to elevate their status in the Organization as "reputable" vendors.
5 i.. Members of the enterprise and their associates use various means to
6 communicate, complete transactions, and establish connections, all designed to pro-
7 tect their anonymity, evad~ detection and prosecution by law enforcement, and. pro-
8 vide sectirity for the criminal organization against attacks by other riyal criminal
9 organizations. These methods may include, but are not limited to, the use of:
10 i. Various website forums and chat rooms that are controlled by
11 the In.fraud Organization for use as their on.line gathering places;
,12 u. Private messaging ("PM");
13 m. E-mail;
14 iv. ICQ chat;
15 v.· Proxies;
16 vi. Virtual priyate networks ("VPNs"); and
17 vu. Protected drop sites ("drops").
18 COUNT ONE
Racketeering Conspiracy
19
11. Paragraphs 1 through 10 of the General Allegations Section are hereby re-
20
alleged and incorporated as if fully set forth herein ..
21
22
22
1 12. From a date unknown, but from at least in· or about October 2010, up
2 through and including the date of this Indictment, both dates being approximate and
3 inclusive, within the District of Nevada and elsewhere, the defendants,
4 [1] Svyatoslav Bondarenko, a.k.a. "Obnon," "Rector," "Helkern";

[2] Sergey Medvedev, a.k.a. "Stells," "Segmed," "Serjbear";
5 [3] Amjad Ali, a.k.a. "Amjad Ali Chaudaey," "RedruMZ," "Amjad
Chaudary'';
6 [4] Roland Patrick N'Djimbi Tchikaya, a.k.a. "Darker,"
"dark3r.cvv";
7 [5] Arnaldo Sanchez Torteya, a.k.a. "Elroncoluna";
[6] Miroslav Kovacevic, a.k.a. "Goldjunge";
8 [7] Frederick Thomas, a.k.a. "Mosto," "lstunna," "Bestssn'.';
[8] Osama Abdelhamed, a.k,a. ''MrShrnofr," "DrOsama,"
9 "DrOsamal";
[9] Besart Hoxha, a.k,a. "Pizza";
10 [10] · Raihan Ahmed, a.k.a.. "Chan," "Cyber ij:acker," "Mae Tony,"
"Tony'';
11 [11] Andrey Sergeevich Novak, a:k.a. "Unicc," "Faaxxx," "Faxtrod";
[12] Valerian Chiochiu, a.k.a. "Onassis," "Flagler," "Socrate,"
12 "Eclessiastes"; ·
[13] John Doe #8, a.k.a. "Aimless88";
13 [14] Gennaro Fioretti, a.k.a. "DannyLogort," "Genny Fioretti";
[I~] Edgar Rojas, a.k.a. "Edgar Andres Viloria Rojas," "Guapo,"
14 "Guapo1998," "Onlyshop";
[16] John Telusma, a.k:a. "John Westley Telusma," "Peterelliot,"
15 "Pete" 1'Pette"· · ·
' ' .
[17] Rami Fawaz, a.k.a. "Rami Imad Fawaz," "Validshbp," "Th3d,"
16 "Zatcher," "Darkeyes";
[18] Muhammad Shiraz, a.k.a. "Moviestar,"·"Leslie";
17 [19] Jose Gamboa, a.k.a. "Jose Gamboa-Soto," "Rafael101," "Member-
plex2006," "Knowledge";
18 [20] Alexey Klimenko, a.k.a. "Grandhost";
[21] Edward Lavoile, a.k.a. "Eddie Lavoie," "Skizo," "Eddy Lavoile";
19 [22] Anthony Nnamdi Okeakpu, a.k.a. ~'Aslikel," "Aslike," "Money-
mafia," "Shilonng"; .
20 [23] Pius Sushil Wilson, a.k.a. "FDIC," "TheRealGuru," "TheReal-
GuruNYC," "RealGuru," "Polson," "Infection," "Infected"; .
21 [24] Muhammad Kha,n, a:k.a. "CoolJ2," "CoolJ," "Secureroot," "Secur- ·
. erootl," "Secureroot2," "Mohammed Khan";
22 [25] John Doe #7, a.k.a "Muad'Dib";
23
Case 2:17-cr-00306-JCM-PAL *SEALED* Document 77 Filed 10/31/17 Page· 25 of 50
1· [27] David Jonathan Vargas, a.k.a. "Cashmoneyinc," "A.vb," "Poony,"

"Renegadell," "DvdSVrgs";
2 [28] J<;>hn Doe #2, a.k.a. "a.k.a. ;
3 [30] John Doe #8, a.k.a. ''Scotish";
[31] Aldo Ymeraj, a.k.a. "Nill.in," "Kubanezi," ''Yankeeman";
4 [32] John poe #4, a.k.a. "Best4Best," "Wazo," "Modmod," "Alonel,"
"Shadow" "Banderas" "Banadou:ra"·
[33]
' ' /
Liridon Musliu, a.k.a. i'Ccstore," "Bowl," "Hulk";
5
[34] John Doe #5, a.k.a. "Deputat,": a.k.a. "ZoOmer";
6 [35] Mena Mouries Abd El-Malak, a.k.a. "Source," "Mena2341,''
"MenaSex"
7 [36] John Doe #6, a.k.a. "Goldenshop," "Malov'';
8 together with others known and unknown 'to the grand jury, being persons employed
·9 by and associated with the Infraud Organization, an enterprise as described more
10 fullY: above, which engaged in, and the activities of which affected, interstate and
11 foreign commerce, did know~gly, willfully, and· unlawfully combine, conspire, con-
12 federate, ari.d agree with one another to violate 18 U.S.C. § 1962(c), that is, to con-
13 duct and participate, directly and indirectly, in the conduct of the affairs of said en-
14 terprise tbroug~ a pattern of racketeering activity, as defined in 18 U.S.C. §§· 1961(1)
15 and (5), consisting of multiple acts indictable under the following provisions of fed-
16 eral law:
17 a. 18'U.S.C. § 1028, fraud and related activity in connection with identifi-
18 cation documents, authentication features, and information; and
19 h. 18 U.S.C. § 1029~ access device fraud; and
20 c. 18 U.S.C. § 1343, fraud by wire, radio, or television; and
21 d. 18 U.S.C. § 1344, bank fraud; and
22 e. 18 U.S.C. §.1543, forgery or false use of passport.
24
Case 2:17-cr-00306-JCM-PAL *SEALED* Document 77 · Filed 10/31/17 Page 26 of O ·
1 13. It was a part of the conspiracy that each defendant' agreed that a conspirator
2 would commit at least two acts of racketeering activity in the conduct of the affairs
3 of the enterprise.
4 Overt Acts
5 14. In furtherance of the conspiracy and to a~hieve the object· and purposes
6 thereof, the defendants, and others known and unknown to the grand jury, per-
7 formed or caused to be performed the following overt acts, among others, in theDis-
8 trict of Nevada, and elsewhere:
9 14.1 On or about October 14, 2010, Bondarenko [1] officially opened
10 the In:fraud website for business and announced it to potential members, .promising
11 In.fraud as a "comfortable and safe" place to "bring together professional people for
12 who carding and hacking become a lifestyle."
13 14.2 On or about November 11, 2010, Shiraz [18] posted. an adver-
14 tisement on the Infraud forum, offering credit card dumps for sale to In.fraud mem-
15 hers and associates and providing his ICQ UIN for contact information. ·
16 14.3 ·on or about November 12, 2010, Bondarenko [1] posted the
17 rules of the Infraud Organization that governed member conduct.
18 14.4 On or about November 12, 2010, Bondarenko [1] prohibited
19 any advertising on the Infraud site except that approved by the leadership.
20 14.5 On or about November 12, 20iO, Bondarenko [1] announced
21 that he was the Administrator and Medvedev [2] was the designated escrow service
22 ·provider for the Infraud Organization.
25
Case 2:17-cr-00306-JCM-PAL *SEALED* Document 77 Filed 10/31/17 Page 27 of 50 ·
1 14.6 On or about November 30, 2010, Kovacevic [6] posted an ad-
2 vertisement on the Infraud Organization forum, calling himself the "Plastic, Tem-
3 plate & Scans King," and offerin~ those items for sale to Infr~ud membership.
4 14. 7 On or about December 25, 2010, Medvedev [2] po.sted details
5 about the official "Escrow" service provider for the Infraud Organization-himself-
6 ·and the price associated with his services for Infraud members.
7 14.8 Oil or about January 7, 2011, John Doe #2 [28] recruited an
8 individual to become a drop for merchandise.
9 14.9 On or about January 11, 2011, Bondarenko [1] listed members
10 that had been banned from accessing the Infraud Organization forum.
11 14.10 On or about February 1, 2011, Ymeraj (31] posted two compro-
12 mised credit card dumps on the Infraud forum as a sample of his wares.
13 14.11 Be~een on·or 11bout Fe~ruary 2, 2011 through on or about Feb-
14 ruary 23, 2011, ·Medvedev's [2] escrow service was used by two In.fraud members
15 to complete a criminal transaction.
16 14.12 On or about February 24, 2011, N'Djimbi Tchikaya [4] pur-
17 chased 10 compromised credit card numbers from Unindicted co-conspirator CC.
18 14.13 On or about March 6, 2011, Shiraz [18] posted two free dumps
19 for the use of Infraud members and associates on the Infraud forum.
20 14.14 On or about March 9, 2011, Bondarenko [1] pi:ohibited mem-
21 bers from buying and selling stolen access devices and other contraband belonging
22 to victims within the Commonwealth of Independent States, a.k.a. Russia.
26
1 14.15 On or about·March 25, 2011, Doe #3 [30) posted three compro-
2 mised credit card dumps on the Infraud forum as a sample of bis wares ..
3 14.16 On or about April 23, 2011, Doe #4 [32] sent dozens of compro-
4 mised credit card dumps to Unindict~d Co-conspirator AA.
5 14.17 In or about May, 20~1, Abdelhamed [8] pµrchased multiple
6 compromised credit card numbers from Fawaz [17], to include a compromised credit"
7 card number from an individual residing in Nevada.
8 14.18 Or about May 22, 2011, Doe #8 [13] posted an advertisement
9 selling United Kingdom bank logins. On or about M~y 26, 2011, Doe #8 [13] indi-
. 10 cated he had 795,000 HSBC logins available.
.. 11 14.19 On or ab.out May 30, 2011, Gamboa [19] advertised credit card
12 skimmers for sale to Infraud members and associates, as well as bis post-sale sup-
13 port services for purchasers, on the Infraud forum.

I
·14 14.20 On or about July 10, 2011, Doe #4 [32] sent numerous compro-
15 mised credit card numbers to Unindicted Co-conspirator AA.
16 14.21 On or about July 27, 2011, Unindicted Co-conspirator Q pur-
17 chased a credit card skimmer from Gamboa [19].
18 14.22 On or about July 28, 2011, Unindicted Co-conspirator Mor-
1,9 dered co.unterfeit identification from Kovacevic [6].
20 14.23 On or about August 11, 2011, Unindicted Co-conspirator M
21 ordered counterfeit identification from Kovacevic [6].
22
27
1 14.24 ·on or about August 18, 2011, Telusma [16] received in excess
2 of 15 compromised credit card numbers from Unindicted Co-conspirator A.
3 14.i5 On or about August 30, 2011, Gamboa [19] sold a credit card
4 skimmer to Unindicted Co-conspirator D.
5 14.26 On _or about September 3, 2011, Musliu [33] advertised his
6 online store on the Infraud website.
7 14.27 On or about September 12, 2011, Doe #8 [13] sent the fyll bank
8 login information of an individual to Unindicted Co-conspirator P vi.a email.
9 14.28 On or about September 15, 2011, Unindicted Co-conspirator.
10 A sent Telusma [16] in excess of 15 compromised credit card dumps VIa email.
11 14.29 On or about September 19, 2011, Klimenko [20] advertised his
12 "Abuse Immunity" hosting services on the Infraud forum, offering to host illicit web-
13 sites for In:fraud members and associates.

. .
14 14.30 On or about October 3, 2011, Ymeraj [31] advertised on the In-
· 15 :fraud forum his fulls website, ''bastard.su," which sold credit card fulls to In.fraud
16 · members and associates.
17 14.31 On or about October 8, 2011, Doe #2 [28] posted an advertise-
18 ment on the Organization forum offering drop services to the Infraud membership. ·
19 14.32 On or about October 9, 2011, Unindicted CO-:conspirator X
20 purchased in excess of 15 CVVs from Doe #7 [34].
21 14.33 On or about October 11, 2011, Ymeraj [31] posted 10 c?mpro-
22 mised PayPal logins on·the In:fraud forum for use byln:fraud members.
28
1 14.34 On or about October 11, 2011, Bondarenko [1] posted dozens of
2 compromised PayPal login credentials to the Infraud forum for members.
3 14.35 On or about November 10, 2011, Doe #1 [26] posted free dumps
4 for Infraud members as a sample of bis wares.
5 14.36 On or about November 11, 2011, Doe #3 [30] posted two compro-
6 mised credit c~d dumps for Infraud members as a sample·ofhis wares.
7 14.37 From on or about November 13, 2011 to on or about June 13,
8 2013, Thomas [7] ran an AVS that provided a "look-up" service of compromised so-
9 cial security. and date of birth personally-identifying information.
10 · 14.38 On or about November 18, 2011, Unindicted Co-conspirator
11 N used Thomas' (7) automated PU search to unlawfully obtain the personally-iden-
12 tifying information of R.Q.N., R.F.K., A.J.S., and other individuals.
13 14.39 On or about Novembe~ 28, 2011, Bondarenko [1] began a
14 thread on the Infraud forum for moderators to ·document any members they elected
15 to ban from the forum and their reasons for doing so.
16 14.40 On or about December 22, 2011, Sanchez Torteya [5]- sent in
17 exces.s of 15 compromised credit cards to Unindicted Co-conspirator E.
18 14.-41 On or about January 13, 2012, Hoxha [9] posted in Unindicted
19 Co-conspirator.'F.s Infraud vendor advertisement, vouching for bis products and
20 stating that Unindicted Co-conspirator Fis "the best guy ever."
21 14.42 On or about January 13, 2012, Lavoile [21] sent more than 500
22 compromised credit card numbers to Unindicted Co-conspirator G.
29
1 14.43. On or about January 18, 2012, N'Djimbi Tchikaya [4] posted
2 an advertisement for his online store, "d4rksys.cc" on the Infraud forum. In the adM
3 vertisement; he indicated he had "high. quality" credit card dumps, compromised
4 PayPal accounts, and other types of "Hacked Stuffs" for sale.
5 14.44 On or about February 14, 2012, Ali [3] vouched for Fawaz's [17]
6 online dumps store, "validshop.su," in a post on the Infraud forum.
7 14.45 On or about March 7, 2012, Sanchez Torteya [5] sent·in excess
8 of 15 compromised credit card numbers to Hoxha [9] in order for Hoxha .[9] to
9 transfer those numbers onto plastic for use.
10 14.46 On or ·about March 23, .2012, Fi.oretti [14] posted 10 comproM
11 mised ~redit card dumps for the use of other members on the Infraud forum.
12 14.47 From on or about April 26,' 2012 to on or about March 1, 2013,
. 13 Vargas [27] purchased 31 CVVs from Doe #5 [34].
14 14.48 On or about March 30, 2012 to on or about April 18, 2012, Mus-
15 liu [33] 9ffered for sale on his AVS "ccstore" in excess of 15 compromised .credit card·
16 numbers belonging to individuals residing in Nevada.
17 14.49 On or about April 14, 2012, Bond3.Fenko [1] set uniform adverM
18 tising prices for vendors in the Infraud Organization.
19 14.50 From on or about April 24, 2012 t<.> on or about May 7, 2012,
20 Ali(3] purchased in excess of 130 compromised credit card dumps from Musliu [33].
21 14.51 From on or about April 26, 2012 to on or about March 1, 2013,
22 Un.indicted Co-conspirator Ypurchased in excess of 30 CVVs from Doe# 5 [34].
30
1 14.52 From on or abo1:1,t May 31, 2012, to on or about July 23, 2012,
2 Okeakpu [22] purchased 6 compromised credit card fulls; including the personally-
3 identifying information of the victims, from Doe #8 [18].
4 14.53 On or about June 8, 2012, Shiraz [18] posted two free dumps for
5 the use of'Infraud members and associates to the Infraud forum.
6 14.54 On or about June 27, 2012, Unindicted Co-conspirator L l;lSed
7 Thomas' [7] automated.lookup system to unlawfully obtain the personally-identµ'y-
8 ing information of S.C.C., D.J.S., J.H.W., and other individuals.
9 14.'55 On or about July 7, 2012, Khan. [24] advertised on the Infraud
10 forum for his dumps checking service, "dumpscheck.us," and solicited business from
11 Infraud members and associates needing to check their dumps.
12 14.56 On or about July 7, 2012, Khan [24] advertised on the Infraud
13 forum, offering credit card counterfeiting equipment for sale.
14 14.57 On.or about July 10, 2012,. Unindicted Co-conspirator U pur-
15 cl;iased checking services from Khan [24].
16 14.58 On·or·about July 31, 2012, Unindicted Co-conspirator T pur- ·
17 chased checking services from Khan [24].
18 14.59 On or about August 9, ~012, Vargas [27] purchased two CVVs
19 :from Musliu [33].
20 14.60 On or about August 16, 2012 to on or about Septemb~r 4, 2012,
21 Medvedev's [2] escrow service was used by Doe #7 [25] and another Ix;rlraud mem-
22 ber to complete a criminal transaction.
31
1 14.61 On br about September ~' 2012, Bondarenko [1] set out the
2 process by which new vendors would become verified within the Infraud Orgat;riza-
3 tion. Bondarenko [1] mandated that, prior. to verification, would-be vendors must
4 provide samples to the Infraud leadership of contraband that they intended to sell,
5 in order for the leadership to ensure the quality of the wares. .
6 14.62 On or about October 16, 2012, Vargas [27] advertised for bis
7 ''World Wide Travel Agency" on the In.fraud forum, offering to fraudulently book
8 flights, rental cars, hotels, and seats at United States concerts and sporting events
9 for Infraud members at a fraction of their actual price.
10 14.63 On or about October 28, 2012, Doe #7 [25] advertif:?ed on the In-
11 fraud
.
forum, offering dumps of VISA, MasterCard,
.
American Express, and
. .
Discover.
12 credit card account numbers for sale to Infraud members.
13 14.64 On or about October 31, 2012, Ymeraj [31] contacted "SiteAd-
14 min" on the Infraud forum via private message requesting the purchase of banner
15 advertisement space on the forum for a one-month period.
16 14.65_ In or about November, 2012, Unindicted Co-conspirator V
17 purchased compromised credit card dumps from Doe #7 [25].
18 14.(?6 On, about, during and between November 8, 2012, and January
19 19, 2015, Unindicted Co-conspirator B purchased 21 dumps from El-Malak[35].
20 14.67 On or about January 23, 2013, Ahmed [10] received in excess of
21 1300 compromised PayPal account logins from Unindicted Co-conspir~tor H.
22
32
1 14.68 On or about January 26, 2013, Wilson (23] purchased a co:rn.pro-

. .
2 mised credit card from the AVS operated by Musliu (33].
3 · 14.69 On or about February 6, 2013, Shiraz (18] posted a list of card-
4 ing websites to t.he Infraud Forum and stated ''best is infraud.cc".
5 14. 70 On or about March 3, 2013, Fioretti (14] sent funds via Liberty
6 Reserve for CVVs that he bought from Ahmed (10].
7 14.71 On or about March 12, 2013 to on or about May 10, 2015, Unin-
8 dieted Co-conspirator Z purchased coin.promised credi~ card dumps from El-Ma-
9 lak [35].
10 14.72 On or about March 25, 2013, Hoxha [9] received in excess of.15
11 compromised credit cards from Unindict~d Co-conspirator 0.
12 . 14. 73 On; about, during and between April 3, 2013, and May 20, 2013,
13 Rojas [15] used Medvedev's (2] money exchanging service.
14 14.74 On or about April 10, 2013,. Klimenko [20] began hosting the
15 website "n~wnumbers.biz," which belonged to Infraud member Doe #3 [30] and
16 served as an outlet for Doe #3 [30] to sell d:umps to Infraud members and associates.
17 14.75 On or about April 13, 2013 to on or about April 17, 2013, Doe #2
. .
18 [28] utilized an individual unknown to the grand jury as a drop for merchandise. .
19 14. 76 On or about April 15, 2013, Hoxha [9] received in excess of 15
20 compromised credit card dumps from Unindicted Co-conspirator 0.
21
22
33
1 14. 77 On or about April 16, 2013, John Doe #1 [26] posted in excess
2 of 15 compromi~ed credit card dumps on the Infraud forum as a sample for Infraud
3 members.
4 .14. 78 On or about April 23, 2013, Chiochiu [12] posted

. .
a Craigslist
5 email-scraping PHP script on the Infraud Organization forum.
6 14.79 On or about April 26, 2013, Doe #3 [30] advertised on the In-
. .
7 fraud forum for his dumps website, "newnumbers.biz," which acted as an outlet for
. .
8 Doe.#3 [30] to sell credit card dumps to Infraud members and associates.
9 14.80 On or about April 27, 2013, Unindicted Co-conspirator H sent
10 Ahmed [10] in excess of 40 compromised credit card numbers.
11 14.81 On or about May 14, 2013, Chio.chiu [12] posted a link to down-
12 load a RAM cr~dit card skimmer to the Infraud Organization forum.
13 14.82 On or about'May 16, 2013, Unindicted Co-conspirator S sent
14 Okeakpu [22] in excess of 15 compromised credit card dumps via email.
15 14.83 On or about ~uly 10, 2013; Novak [11] posted an a~vertisement
16 on the Infraud forum for his credit card dumps website, "uniccshop.ru." That same
17 day, in the same thread, forum administrator Bondarenko [1] stated that No-
18 vak [ll]'s advertisement has been paid for through Juiy 10, 2014.
19 14.84 On or about August 12, 2013, Unindicted Co-conspirator R
20 sent Lavoile [21] compromised credit card dumps.
21 14.85 On or about September 5, 2013, Unindicted Co-conspirator Ii
22 sent Lavoile [21]. compromised credit card dumps.
34
Case 2:17-cr-00306-JCM-PAL *SEALED* Document 77 Filed 10/31/17 Page 36 of O
1 14.8.6 On or about September 16, 2013, Doe #8 [13] sent compromised
2 credit card data to another In.fraud member.
3 14.87 On or about October· 26, 2013, Rojas [15] purchased a compro-
4 mised credit card from Musliu [33].
5 · 14.88 On or about October 29, 2013, Leopard [29] began handling the
q· website traffic for an AVS selling compromised credit card dumps, which was owned
7. by Unindicted Co-conspirator W.
8 14.8~ On or about November 3, 2013, Leopard [29) began hosting the
9 website "tonymontana.cc," which belonged to Infraud member Doe #1 (26] and
10 served as an outlet for Doe #1 [26] to sell dumps to Infraud members and associates .
11 . 14.90 On or about November 25, 2013, Wilson [23) purchased three
12 compromised credit cards from the AVS operated by Musliu [33].
13 14.91 On or about February 24, 2014 to on or about February 27, 2014,
14 Doe #2 (28] corresponded via email with an i:p.dividual who was acting as a drop for
15 merchandise.
16 14.92 On or about March 1, 2014, Hoxha [9] responded to a request
17 on the Infraud forum by Unindicted Co-conspirator A for quality Visa and Ma's-
18 terCard large and small holograms, indicating that Unindicted Co-conspirator A
19 should contact Hoxha [9].
20 14.93 On or about March 13, 2014, Abdelhamed [8] posted 50 dumps
. 21 in response to a complaint on the forum by an Infraud member that Abdel-
22 hamed's [8] dumps were low quality.
35
Case 2:17-cr-00306-JCM-PAL *SEALED* Document 77 Filed 10/31/17 · Page 37 of 50
1 14.94 On or about April 17, 2014, N'Djimbi Tchikaya 14] instructed
2 Torteya [5] on how to join bis AVS that was advertised on the Infraud forum and
3 the cost associated with joining it via private message.
4 14;.95 On or about May.3, 2014, Doe #4 [32] advertised on the Infraud
5 forum, proclaiming "We are glad to provide you best dumps services in market!!" and
6 espousingthat he had ~'only'' United States dumps.
7 14.96 On or about May 6, 2014, Doe #4 [32] updated bis advertisement
8 via a post in the forum, listing inventory from.various States, and boasting that he
9 had "120K USA updates" covering "Visa Master Amex, Discover."
10 14.97 On or about May 24, 2014, Unindicted co-conspirator EE
11 posted in Doe #3's [30) vendor t~ead on the Infraud forum, inquiring if there was
12 a way that he could be added to Doe #S's [30] dumps shop.
13 14.98 On or about July 15, 2014, Wilson [23] posted an advertise-
14 ment on the Infraud forum soliciting sales of credit card fulls from other .In.fraud
15 members, stating they were needed immediately and offering prompt payment.
16 14.9.9 On or about September .3, 2014, Ali [3] posted 30 stolen CVVs
17 on the lnfraud foru~ as a sample of his wares for members to view and use.
18 14.100 On or about September 3, 2014, Hoxha [9] posted in Unin-
19 dieted Co-conspirator DD's vendor advertisement thread on·the Infraud for.um,
20 warning him not to copy Hoxha's [9] own vendor advertisement from elsewhere on
21 the forum.
22
36
1 14.101 On or about September 9, 2014, Chiochiu [12] posted infor-
2 mation on thelnfraud Organization forum about how to make a RAM skim.mer.
3 14.102 On or about October 131 . 2014, Fawaz [17] sent an email to
4 Ali [3] with his vendor advertisement ·indicating that 700 "fulls" and 3000 "cards"
5 had been added to his AVSes.
6 14.103 On or about November 10, 2014, Kovacevic [6] advertised to
7 the Infraud forum for "scan kits" ·to manufacture fraudulent documents.
8 14.104 On or about November 17, 2014, Un~ndicted Co-conspirator
9 S sent Okeakpu [22] in excess of 15 compromised credit card dumps.
10 14.105 On or about December 12, 2014, Ali[3] posted in excess of 15
11 dumps for members to the Infraud forum.
12 14.106 On or a°Qout December 23, 2014, Ahmed [10] received in excess
13 of 1300 compromised PayPal account logins from Unindicted C0-0onspirator H.
14 .14.107 On or about January 19, 2015, Klimenko [20] began hosting.
15 the website "torcarders.cc," which belonged to Unindicted Co-conspirator J and
16 served as his/her outlet to sell dumps to In.fraud members and associates.
17. 14.108 On or about March 2, 2015 to April 21, 2015, Gamboa [19]
18 discussed the sale of.skimmers to various Infraud members via private message.
19 14.109 On or about March 26, 2015, Tehisma [16] requested via pri-
. 20 vate message that Bondarenko [1] ban another lnfraud member for "ripping" him
21 on a deal.
22
37
1 14.110 On or about April 16, 2016, Medvedev [2] posted to the In-
2 fraud forum explaining that Bondarenko [1] had gone missing, and that
3 Medvedev [2] was now "admin and owner" of the Infraud Organization.
4 14.111 · On or about July 22, 2016, Medvedev [2] posted to the Infraud
5 forum ID:dicating that the Organization, now had an "open invite" policy, and that
6 members would be able to secure invitations for their associates ·into the Infraud
7 Organization, provided that the would-be new members met minimum standards.
.8 14.112 On or about January 23, 2017, Doe #6 (36] posted an adver-
9 tisement to the Infraud forum stating that he was "r.eady to introduce [his] private
10 service" that he had been working on for over four years. It promised dumps that
11 were "high quality, fresh, and guarantee 90%+ valid."
12 14..113 On or about July 12, 2017, John Doe #6 [36] posted updates
13 to his Infraud vendor adyertisement.
14 14.114 On or about August i, 2017, John Doe #6 [36] sold in excess
15 of 15 compromised credit card dumps belonging to Nevada cardholders from his/her
16 AVS "goldenshop.cc" to an undercover agent for Homeland Security Investigations
17 ("HSI").
18 14.115 On or about August 2, 2017, Novak [11] sold 15 compromised
19 ~redit card dumps belonging to Nevada cardholders from his AVS "unicc.at" to an
20 undercover agent for Homeland Security Investigations ("HSI").
21
22
38
1 14.116 On or abo~t August 4, 2017, Novak [11] .sold 54 compromised
2 credit card dumps for Nevada cardholders frqm his AVS "unicc.at" to an undercover
3 agent. for Homeland Security Investigations ("HSI").
4 14.117 On or about August 8, 2017, John Doe #6 (86] sold in excess
5· of 15 compromised credit card dumps belonging to Nevada cardholders from his AVS
6 "goldenshop.cc", to an undercover agent for Homeland S~curity Investigations
7 ("HSI").
9 All in violation of 18 U.S.C. § 1962(d).
10 COUNTS TWO THROUGH FOUR

Possession of Fifteen or More Counterfeit and
11 Unauthorized Access Devic~s
12 On or about each of the dates set forth below, in the District of Nevada,
1.3 and elsewhere,
14 [2i Sergey Med:vedev, a.k.a. "Stells," "Segmed," "Serjbear"; and
15 [11] Andrey Sergeevich Novak a.k.a. "Unicc/' "Fa~xx," "Fax-
16 trod";
17 Defendants herein,_ together with and aiding and abetting·one another and others,
18 known and unknown, knowingly and with intent to defraud, did possess fifteen
19 (15) or more unauthorized access devices, that is stolen credit and debit card ac-
20 count numbers issued to persons other than the defendants, in and affecting inter~
21
22
39
1 state and foreign commerce·, with each instance set forth below constituting a sepa-
2 rate violation of Title 18, United States Code, Sections 1029(a)(3), and (c)(l)(A)(I);
3 and Title 18 United States Code, Section 2, as follows:
4 Count Dates Approximate No. Devices
5 TWO August 2, 2017· 15
6 THREE August 4, 2017 54
7 FOUR August 8, 2017 57
s·
9 COUNTS FIVE THROUGH SEVEN
10 Unauthorized Access Devices
11 On or about each of the dates set forth belqw, in the District of Nevada,
12 and elsewhere,
13 [2] S.ergey Medvedev, a.k.a. "Stells," "Segmed," "Serjbear"; and
15 · Defendants herein,· together with and aiding and abetting one another and others,
16 known and unknown, knowingly ~nd with intent to defraud, did possess (15) or
17 more unauthorized access devices, that is stolen credit and debit card account
18 numbers issued to persons other than the defendants, in and affecting interstate
19 and foreign commerce, with each ~stance set forth below constituting a separate
20 violation of Title 18, United States Code, Sections 1029(a)(3), and (c)(l)(A)(l); and
21 Title 18 United States Code, Section 2, as follows:.
22
40
Case 2:17-cr-00306-JCM-PAL *SEALED* Document 77 · Filed 10/31/17 Page 42 of 50
1 Count Dates Approximate No. Devices
2 FIVE August 2, 2017 17
3 SIX August 4, 2017 16
4 SEVEN August 8, 2017 17
6 COUNT EIGHT
Possession of Fifteen or More Counterfeit
7 and Unauthorized Access Devices
8 In or about February, 2015, in the District of Nevada, and elsewhere,
9 [2] Sergey Medvedev, a.k.a. "Stells," "Segmed," "Serjbear";. and
10 [34] John Doe #5; a.k.a. "Deputat," a.k.a. "ZoOmer";
11 Defendants herein, together with and aiding and abetting one another and others,
12 known and unknown, knowingly and with intent to defraud, did possess (15) or
13 more unauthorized access devices, that is stolen credit and debit card account
15 and foreign commerce, with each instance set forth below constituting a separate
16 violation of Title 18., United States Code, Sections. 1029(a)(3), and (c)(l)(A)(I); and
17 Title· 18 United States Code, Section 2.
18 I I I
19 I I I
20 I I I
21 I I I
22 I I I
41
1 COUNT NINE
2 Unauthorized Access Devices
3 In or about June, 2014, in the District of Nevada, and elsewhere,
4 [2] Sergey Medvedev, a.k.a. "Stells," "Segmed," "Serjbear"; and
5 [33] Liridon Musliu, a.k.a. "Ccstore," "Bowl," "Hulk";
6 Defendants herein, together with and aiding and abetting one another and others,
7 known and unknown, knowingly and with intent to defraud, did possess (15) or
8 more unauthorized access devices, that is stolen credit and debit card ac.count
10 and foreign commerc~, with each instance set forth below constituting a separate
11 violation.of ritle 18, United States Code, Sections 1029(a)(3), and (c)(l)(A)(I); and
12 Title 18 United States Code, Section 2.
13 I I I
14 I I I
15 I I I
16 I I I
17 I I I
18 I I I
19 I I I
20 I I I
·21 I I I
22 I I I
42
1 FORFEITURE ALLEGATION ONE

Racketeering Conspiracy
2
3 15. The allegations contained in Count One of this Criminal Indictment are
4 hereby realleged and incorporated herein by reference for. the purpose of alleging
·5 forfeiture pursuant to Title 18, United States Code, Section 1963(a)(l), (a)(2), and
6 (a)(3); Title 18, United States Code, Section 1028(g) and (h); Title 18, United States
7 Code, Section 1029(c)(l)(C) and 1029(c)(2); Title 18, United States Code, Section
8 98l(a)(l)(C) with Title 28, United States Code, Section 246l(c); Ti~le 18, United
9 States Code, Section 982(a)(2)(A); Title 18, United States Code, Section 982(a)(2)(B);
10 Title 18, United States Code; Section 982(a)(6)(A)(ii)(I) with 982(a)(6)(B); and Title
11 18, United States Code, Section 982(a)(6)(A)(ii)(II) with 982(a)(6)(B). ·
12 16. Upon conviction of the felony offense charged ~n Count One of this Crim-
·13 inal Indictment,
14 [1] Svyatoslav Bondarenko, a.k.a. "Obnon," "Rector," "Helkern";

.[2] Sergey Medvedev, a.k.a. "Stell~," "Segmed," "Serjbear";
15 [3] Amjad Ali, a.k.a. "Amj'ad Ali Chaudary," "RedruMZ," "Amjad
Chaudary'' ·
16 [4] Roland Patrick N'Djimbi Tchikaya, a.k.a. ":Parker," "dark3r.cvv";
[5] Arnaldo Sanchez Torteya, a.k.a. "Elrqncoluna";
17 [6] Miroslav Kovacevic, a.k.a. "Goldjunge";
[7] Frederick Thomas, a.k.a. "Mosto," "lstunna," "Bestssn";
18 [8] Osama Abdelhamed, a.k.a. ''Mr$hrnofr," "DrOsama," "DrOsa-mal";
[9] Besart Hoxha, a.k.a. "Pizza";
19 [10] Raihan Ahmed, a.k.a. "Chan," "Cyber Hacker," "Mae Tony," "Tony";
[11] Andrey Sergeevich Novak, a.k.a. "Unicc," "Faa.xxx," "Faxtrod";
20 [12] Valerian Chiochiu, a.k.a. "Onassis," "Flagler," "Socrate," "Eclessi-
astes";
21 [13] John Doe #8, a.k.a. "Aimless88";
[14] Gennaro Fioretti, a.k.a. "DannyLogort," "Genny Fioretti";
22 [15] Edgar Rojas, a.k.a. "Edgar Andres Viloria Rojas," "Guapo,"
"Guapo1998," "Onlyshop";
43
Case 2:17-cr-00306-JCM-PAL *SEALED* Document 77 i:;:iled 10/31/17 Page 45 of 50
1 [16] John Telusma, a.k.a. "John Westley Telusma," "Peterelliot," "Pete,"

"Pette";
2 [17] Rami Fawaz, a.k.a. "Validshop," "Th3d,'' "Zatcher," "Darkeyes";
[18] Muhammad Shiraz, a:k.a. "Moviestar," "Leslie";
3 [19] Jose Gamboa, a.k.a. "Jose Gamboa,Soto," "Rafael Garcia," "Ra-
faellOl," "Mem-berplex2006," "Knowledge";
4 [20] Alexey Klimenko, a.k.a. "Grand.host";
[21] Edward Lavoile, a.k.a. "Eddie Lavoie," "Skizo," "Eddy Lavoile";
5 [22] Anthony Nnamdi Okeakpu, a.k.a. "Aslikel'," "Aslike," "Money-ma-
fia"
, "Shilonng"·' '
6 [23] Pius Sushi! Wilson, a.k ..a. "FDIC," "TheRealGuru," "TheReal-

GuruNYC," "RealGuru," "Polson," "Infection," "Infected";
7 [24] Muhammad Khan, a.k.a. "CoolJ2," "CoolJ," "Secureroot," "Se-cur-
erootl," "Secureroot2," "Mohammed Khan";
8 [25] · John Do.e #7, a.k.a ''Muad'Dib";
9 [27] David Jonathan Vargas, a.k.a.."Cashmoneyinc," "Avb," "Poony,"
"Renegadell,'' "DvdSVrgs";
10 [28] John Doe #2, a.k.a. "a.k.a. ;
11 [30] John Doe #3, a.k.a. "Scotish"; .
[31] Aldo Ymeraj, a.k.a. "Nili:in," "Kubanezi," "Yankeeman";
12 [32] John Doe #4, a.k.a. "Best4Best," "Wazo," "Modmod," "Alonel,"
"Shadow," "Banderas," "Banadoura";
13 [33] Liridon Musliu, a.k.a. "Ccstore," "Bowl," "Hulk";
[34] John Doe #.5, a.k.a. "Deputat," a.k.a. "ZoOmer";
14 [35] Mena Mouries Abd El-Malak, a.k.a. "Mina Morris," "Source,"
"Mena2341," ''MenaSex,"
16 defen~ants herein, shall.forfeit to the United States (1) any interest acquired
17 or·maintained in violation of Title 18, United States Code, Section 1962; (2) any
18 interest in; security of; claim against; or property or contractual right of any kind
19 affording a source of influence o~er; any enterprise established, operated, con-
20 trolled, conducted, or participated in the conduct.of, in violation of Title 18, United
21 States Code, Section 1962; and (3) any property constituting, or derived from, any
22
44
1 proceeds obtained, directly or indirectly, from ra:cketeeririg activity.in violation of
2 Title 18, Unit.ed States Code, Section 1962;
3 defendants herein, shall forfeit to the United States, all illicit authentication
4 features, identification documents,. doqument-making implements, or means of
5 identification in violation of Title 18, United States Code, Section 1028;
6 defendants herein, shall forfeit to the United States, any personal property
7 used or intended to be used to commit the violations of Title 18, United States Code,
8 Section 1029;
9 defendan~s herein, shall forfeit to the United States, any property, real or
10 personal, which constitutes or is derived from proceeds traceable to violations of
11 Title 18, United States Code, Sections 1028, 1028A(a)(l) with 1028A(c)(4), (c)(5),
12 and (c)(7), 1029, 1343, 1344, or 1543, specified unlawful activities as defined in Title
13 18, United States Code, Sections 1956(c)(7)(A) and 1961(1)(B), or Title 18, United
14 States Code, Section 1962(c) and (d), conspiracy to commit such offenses;
15 defendants herein, shall forfeit to the 1'.]nited States, any property constitut-
,
16 ing, or derived from, proceeds obtained directly or in~ectly., as the result ofviola-
17 tions of Title 18, United States Code, Sections 1343 and 1344, affecting a financial
18 institution, or Title, 18, United States Code, Section 1962(6) and (d), conspiracy to
19 violate such offenses;
20
21
22
45
1 defendants herein, shall forfeit to the United States, any property constitut-
2 ing, 9r derived from, proceeds obt~ed directly or indirectly, as the result of viola-
s tions of Title· 18, United States Code, Sections 1028 and 1029, or Title 18, United
4 States Code, Section 1962(c) and (d), conspiracy to violate such offenses;
5 defendant herein, shall forfeit to the United States, any property real or per-
6 -sonal that constitutes, or is derive~ from or is traceable to the proceeds obtained
7 directly or indirectly from the commission of violations of Title 18, United States
8 Code, Sections 1028 and 1543, or Title 18, United States Code, Section 1962(c) and
9 (d), conspiracy to violate such offense; and
10 defendant herein, shall 'forfeit to the United States, any property real or per-
11 sonal that is used to facilitate, or is intended to be used to facilitate, the commission
12 of violations of ·Title 18, United States Code,. Sections 1028 and 1543., or Title 18,
13 United States Code, Section 1962(c) and (d), conspiracy to violate such offenses;
14 spet!ific property to be identified pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);
15 and
16 an in personam criminal forfeiture money judgment including, but not lim-
17 ited to, at least
18 Bondarenko [l], to be calculated pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);

Medvedev [2], to be calc~ated pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);
19 Ali [3], to be calculated pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);
Tchikaya [4], $500,000;
20 Torteya [5], to be calculated-pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);
Kovacevic [6], $50,000; ·
21 Thomas [7], $186,000;
Abdelhamed [8], to be calculated pursuant to Fed. R. Crim; P. 32.2(b)(2).(C);
22 Hoxha [9], to be calculated pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);
Ahmed [10], $1,200,000;
46
1 Novak [11], $2,700,000;

Chiochiu [12], to be calculated pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);
2 Doe #8 [13], to be calculated pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);
Fioretti [14], $70,000;
3 Rojas [15], to be calculated pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);
Telusma [16], to .be calculated pursuant ·to Fed. R. Crim. P. 32.2(b)(2)(C);
4 Fawaz [17], .to be calculated pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);
Shiraz [18], $326,000;
5 Gamboa [19], $100,000;
Klimenko [20], $150,000;
6 Lavoile [21], $30,000;
Okeakpu [22], $50,000;
7 Wilson [28], to be calculated pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);
Khan [24], $400,000;
8 Doe #.7 [25], $300,000;
John Doe #1 [26], $1,000,000;
9 Vargas [27], $355,QOO;
John Doe #2 [28], .$48,000;
10 Leopard [29], $70,000;
John Doe #3 [30], $1,400,000;
11 Ymeraj [31], $675,000;
John Doe #4 [32], to be calculated pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);
12 Musliu [33], $277,725,552.33; ·
John Doe #5 [34], $279,612,110.41;
13 El-Malak [35], to be calculated pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);
John Doe #6 [36], to be calculated pursuant to Fed. R. Crim. P. 32.2(b)(2)(C);
14
15 (all of which constitutes property) .
16 .17. If any property being subject to forfeiture pursuant to Title 18, Unite.d
17 States Code, Section 1963(a)(l), (a)(2), and (a)(3); Title 18, United States Code, Sec-
18 tion 1028(g) and (h); Title 18, United States Code, Section 1029(c)(l)(C) and
19 1029(c)(2); Title 18, United States Code, Section 98l(a)(l)(C) with Title 28, United
20 States Code, Section 2461(c); Title 18, United States Code, Section 982(a)(2)(A); Ti-
21 tle 18, United States Code, Section 982(a)(2)(B); Title 18, United States Code, Sec-
22 tion 982(a)(6)(A)(ii)(I) with 982(a)(6)(B); and Title 18, United States Code, Section
Case 2:17-cr-00306-JCM-PAL *SEALED* Document 77 Filed 10/31/17 Page 49 of O
1 982(a)(6)(A)(ii)(1I) with 982(a)(6)(B), as a result'of any act or omission of the defendw
2 antsw ·
3 a. cannot he located upon the exercise of due diligence;
4 b. has been transferred or sold to, or deposited with, a third party;
5 c. has been placed beyond the jurisdiction of the court;
6 d. has been substantially diminished in value; or
7. e. has been commingled with other property which cannot be divided withw
8 out difficulty;
9 it is the intent of the United States of America, pursuant to Title 18, United States
10 Code, Section 1963(m), to seek forfeiture of any properties of the defendants for the
11 property listed above and the in pers~nam criminal forfeiture money judgments
12· listed above.
13 I I I
14 I I I
15 I I I
· 16 I I I
17 I I I
18 I I I
19 I I I
20 I I I
21 I I I
22· I I I
48
1 All pursuant to Title 18, United States Code, Section 9.81(a)(l)(C) with Title
2 28,· United States Code, Section 2461(c); Title 18, United States Code, Sections·
3 982(a)(2)(A) and 982(a)(2)(B), 982(a)(6)(A)(ii)(I) and 982(a)(6)(A)(ii)(II) with
4 982(a)(6)(B), 1028A(a)(l) with 1028A(c)(4), (c)(5), and (c)(7), 1028(g) and (h);
5 1029(c)(l)(C) and 1029(c)(2), 1963(a)(l), (a)(2), and (a)(3); Title 18, United States
6. Co'de, Sections 371, 1028, 1028A, 1029, 1029(b)(2), 1343, 1344, 1349, 1543, 1962(c)
7 and (d); and Title 18; United States .Code, Section 1963(m).
9 DATED: this 31st day of October, 2017
10 A TRUE BILL:
11 ISi
FOREPERSON OF THE GRAND JURY
12
13
STEVEN W. MYHRE
14 Acting·United States Attorney
15 ~~=====---,-~~~
16 CHAD W. MCHENRY
Assistant United States Attorney
17 :Oistrict of Nevada
18 DAVID A. JAFFE
Acting Chief, Organized Crime and Gang Section
19 U.S. Department of Justice
21 KELLYPEARSON
Trial Attorney
22 Org~zed Crime and Gang Section
United States Department of Justice
49

Infraud Indictment

Uploaded by

Copyright:

Available Formats

Infraud Indictment

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Infraud Indictment

Uploaded by

Copyright:

Available Formats

Case 2:17-cr-00306-JCM-PAL *SEALED* Document 77 Filed 10/31/17 Page 2 of 50

1 STEVEN W. MYHRE OCT 3 1 2017

9 Representing the United States of America

18 [2] Sergey Medvedev, 18 U.S.C. § 1029(a)(3): Possession of 15

1 [4] Roland Patrick N'Djimbi

5 [61 Miroslav Kovacevic,

9 [8] Osama Abdelhamed,

13 [10] Raihan Ahmed,

16 [11] Andrey Sergeevich Novak,

1 [14] Gennaro Fioretti,

3 .[16] Edgar Rojas,

6 [16] John Telusma,

9 [17] Rami Fawaz,

18 [20] Alexey Klimenko,

1 [22] Anthony Nnamdi Okeakpu,

9 [24] Muhammad Khan,

13 [25] John Doe #7,

20 [28] John Doe #2;

22 [29] Marko Leopard,

3[31] Aldo Ymeraj,

10 [33] Liridon Musliu,

1 FIRST SUPERSEDING INDICTMENT

2 THE GRAND JURY CHARGES THAT:

4 These General Allegations are realleged and incorporated by reference in

5 Count One (Conspiracy to Engage in a Racketeer Influenced Corrupt Organization).

15 operates in the District of Nevada and elsewhere.

16 2. A primary purpose of the Infraud Organization is to promote and grow in-

20 personally-identifying information, stolen financial and banking information, and

22 Infraud Organization's discus"Sion forum.

3 a. "AVS" or "automated vending site" are used to describe automated

5 In:fraud members to purchase and sell illicit goods.

6 b. "Bulletproof. Hosting" and "Abuse Hosting'' are services provided

10 uct ("Ponzi") schemes, online gambling, and malware distribution infrastructure.

11 c. "Carded travel services'' are services wherein the vendor books

15 vendor a fraction of the face value of the items booked-typically, 20~30%.

16 d. "Carding" refers to the general concept of purchasing retail items with

19 information, and is presented. to a store's cashier by the offender: Often, various

21 used by members of a carding organization to describe themselves.

2 typically contains all of a cardholder's information except for information encoded on

6 f.. · "Dumps" are coin.promised credit card account data.·

7 g. "D1:'op" can have several different meanings depending on the context

8 in which it is used, but generally refers to a location or individual able to securely

11 h. "Forum'' and "Website" are terms used interchangeably to describe

15 j. "ICQ" is a free instant messaging electronic communication service, or :

18 k. "Internet Protocol address," and "IP address," refer to a network

1 I. ''Liberty Reserve" was an online .currency utilized by Infraud mem-

3 tifying information, malware and. the services associated with such.

4 m. ''Malware" is hostile or intrusive software that can be used to com-

5 promise end-user PCs and smartphon~s or retail point-of-sale ("POS'') systems,

7 · personally-identifying information and financial data, to gather intelligence for later

8 use in a fraud scheme, or to electronically and unlawfully monitor victims.

9 n. "PHP" stands for "PHP: ·Hypertext Preprocessor," and is a program-

10 ming/scripting language commonly used to create interactive websites, such as

11 AVSes, as well as other Internet-related tools and applications.

12 o. ''PM" means "Private Message." These are .any non-public messages

14 p. "Proxy'' and "Proxy Server" describe a computer that acts as an in-

15 termediary in a client's Internet connection, relaying that client's Internet request.

19 between a pr·oxy .server and its client is unencrypted.

20 q. "Ripper" refers to a vendor of illicit goods of poor. quality, or one who

Case 2:17-cr-00306-JCM-PAL SEALED Document 77 Filed 10/31/17 Page 2 of 50