Accused ‘Raccoon’ Malware Developer Fled Ukraine After Russian Invasion – Krebs on Security

A 26-year-old Ukrainian man is awaiting extradition from The Netherlands to the US on costs that he acted as a core developer for Raccoon, a well-liked “malware-as-a-service” providing that helped paying clients steal passwords and monetary information from hundreds of thousands of cybercrime victims. KrebsOnSecurity has discovered that the defendant was busted in March 2022, after fleeing necessary navy service in Ukraine within the weeks following the Russian invasion.

Ukrainian nationwide Mark Sokolovsky, seen right here in a Porsche Cayenne on Mar. 18 fleeing necessary navy service in Ukraine. This picture was taken by Polish border authorities as Sokolovsky’s automobile entered Germany. Picture: KrebsOnSecurity.com.

The U.S. Legal professional for the Western District of Texas unsealed an indictment final week that named Ukrainian nationwide Mark Sokolovsky because the core developer for the Raccoon Infostealer enterprise, which was marketed on a number of Russian-language cybercrime boards starting in 2019.

Raccoon was basically a Net-based management panel, the place — for $200 a month — clients might get the most recent model of the Raccoon Infostealer malware, and work together with contaminated techniques in actual time. Safety specialists say the passwords and different information stolen by Raccoon malware have been usually resold to teams engaged in deploying ransomware.

Working with investigators in Italy and The Netherlands, U.S. authorities seized a duplicate of the server utilized by Raccoon to assist clients handle their botnets. In accordance with the U.S. Justice Division, FBI brokers have recognized greater than 50 million distinctive credentials and types of identification (e mail addresses, financial institution accounts, cryptocurrency addresses, bank card numbers, and many others.) stolen with the assistance of Raccoon.

The Raccoon v. 1 net panel, the place clients might search by contaminated IP, and stolen cookies, wallets, domains and passwords.

The unsealed indictment (PDF) doesn’t delve a lot into how investigators tied Sokolovsky to Raccoon, however two sources near the investigation shared extra details about that course of on situation of anonymity as a result of they weren’t licensed to debate the case publicly.

In accordance with these sources, U.S. authorities zeroed in on an operational safety mistake that the Raccoon developer made early on in his posts to the crime boards, connecting a Gmail account for a cybercrime discussion board identification utilized by the Raccoon developer (“Photix”) to an Apple iCloud account belonging to Sokolovsky. For instance, the indictment features a picture that investigators subpoenaed from Sokolovsky’s iCloud account that exhibits him posing with a number of stacks of bundled money.

A selfie pulled from Mark Sokolovsky’s iCloud account. Picture: USDOJ.

When Russia invaded Ukraine in late February 2022, Sokolovsky was residing in Kharkiv, a metropolis in northeast Ukraine that may quickly come beneath heavy artillery bombardment from Russian forces. Authorities monitoring Sokolovsky’s iCloud account had spent weeks watching him shuttle between Kharkiv and the Ukrainian capital Kyiv, however on Mar. 18, 2022, his cellphone all of a sudden confirmed up in Poland.

Investigators discovered from Polish border guards that Sokolovsky had fled Ukraine in a Porsche Cayenne together with a younger blond girl, leaving his mom and different household behind. The picture on the prime of this put up was shared with U.S. investigators by Polish border safety officers, and it exhibits Sokolovsky leaving Poland for Germany on Mar. 18.

On the time, all able-bodied males of navy age have been required to report for service to assist repel the Russian invasion, and it might have been unlawful for Sokolovsky to go away Ukraine with out permission. However each sources stated investigators imagine Sokolovsky bribed border guards to allow them to move.

Authorities quickly tracked Sokolvsky’s cellphone by Germany and finally to The Netherlands, along with his feminine companion helpfully documenting each step of the journey on her Instagram account. Here’s a image she posted of the 2 embracing upon their arrival in Amsterdam’s Dam Sq.:

Authorities in The Netherlands arrested Sokolovsky on Mar. 20, and shortly seized management over the Raccoon Infostealer infrastructure. In the meantime, on March 25 the accounts that had beforehand marketed the Raccoon Stealer malware on cybercrime boards introduced the service was closing down. The parting message to clients stated nothing of an arrest, and as a substitute insinuated that the core members in command of the malware-as-a-service mission had perished within the Russian invasion.

“Sadly, because of the ‘particular operation,’ we should shut our Raccoon Stealer mission,” the group introduced Mar. 25. “Our group members who have been liable for essential parts of the product are now not with us. Thanks for this expertise and time, for day by day, sadly every thing, in the end, the top of the WORLD involves everybody.”

Sokolovsky’s extradition to the US has been granted, however he’s interesting that call. He faces one depend of conspiracy to commit pc fraud; one depend of conspiracy to commit wire fraud; one depend of conspiracy to commit cash laundering, and one depend of aggravated identification theft.

Sources inform KrebsOnSecurity that Sokolovsky has been consulting with Houston, Tx.-based lawyer F. Andino Reynal, the identical lawyer who represented Alex Jones within the current defamation lawsuit towards Jones and his conspiracy idea web site Infowars. Reynal was liable for what Jones himself known as the “Perry Mason” second of the trial, whereby the plaintiff’s lawyer revealed that Reynal had inadvertently given them a whole digital copy of Jones’s cellphone. Mr. Reynal didn’t reply to requests for remark.

If convicted, Sokolovsky faces a most penalty of 20 years in jail for the wire fraud and cash laundering offenses, 5 years for the conspiracy to commit pc fraud cost, and a compulsory consecutive two-year time period for the aggravated identification theft offense.

The Justice Division has arrange a web site — raccoon.ic3.gov — that enables guests to test whether or not their e mail deal with exhibits up within the information collected by the Raccoon Stealer service.