maximum 9 Case Document 47-2 Filed 07 27 18 Page 2 of 33 Presentedto- the Court by the foreman of the Grand Jury in Open Court in the presence of the Grand Jury and FILED in the US DISTRICT COURT at Seattle Washington W COOL Clerk By - Deputy UNITED STATES DISTRICT COURT FOR THE WESTERN DISTRICT OF WASHINGTON AT SEATTLE - UNITED STATES 0F AMERICA - No CR1-7-276RSL Plam ff SUPERSEDIISIGETDICTMENT FEDIR HLADYR aka Fedor Gladyr aka Fedir Oleksiyovych Gladyr - aka Gladyr Fedir Oleksiyovych aka Gladyr Fedor Oleksiyovich aka Fedor aka das aka Fyodor aka AronaXus Defendant I The Grand Jury charges that 7 DEFINITIONS 1 7 IP Address An Internet Protocol address or simply address IS a unique numeric address used by devices such as computers on the Internet An IP address is a series of four numbers each in the range 0-255 separated by periods egg 104 250 138 210 Every device attached to the Internet must be assigned an IP address 7 7 I so that Internet traf c sent from and directed to that device may be directed properly Superseding Indictment United States v HIadyr - - UNITED STATES ATTORNEY No CR17-276RSL 1 - 700 STEWART STREET SEATTLE WASHINGTON 98101 7 206 553- 7970 uncommon-mm N Case Document47-2 Filed 07 27 18 Page ofi33 from it's'source to its destination Most Internet service providers control a range of IP addresses - 2 1 Server A server is a COmputer that provides services for other cemputers connected to it Via a network or the Internet The Computers that use the serVer services A are sometimes called clientsf Servers can be physically located anywhere with a A A network connection that may be reached by the clients for example it is not uncommon - i for a server to be located hundreds or even thousands of miles away frOm the client computers A server may be either a physical or virtual machine A physical server is a piece of computer hardware con gured as a server with its oW11 pewer source central I processing unit s and associated sOftwa re A virtual server is typically one of many servers that operate on a single physical server Each virtual server shares the hardware 3 3 resources of the physical server but the data residing on each virtual server is segregated from the data on other virtual serVe'rs that reside on the same physical machine 3 Malware Malware lS malicious computer Code running on a computer Relative to the oWner authorized user of that computer malware is computer cede that 13 7 7 running on the system that is unauthorized and present on the System without the user - consent Malware can be designed to do a variety of things including logging every keystroke on a computer stealing nancial information or user credentials passwords or usernames or commanding that computer to become part of a network of robot Or bot computers known as a botnet In addition malware can be used to transmit data from the infected cemputer to another destination on the Internet as identi ed by an IP address Often times these destination IP addresses are computers controlled by cyber criminalsThe Carbanak malwarez Carbanak is the name 'giVen by computer security researchers to a particular malicious softWare malware program Carbanak has been used to re'mOtely access computer's without authorization The 'Carbanak malWaIf allows an attaCker to spy on another person s computer andrernotely control the I computer Carbanak can record videos of the victim s computer screen and send the Superseding Indictment United States Hladyr - UNITED STATES ATTORNEY No A 7 700 STEWART STREET SUITE 5220 SEATTLE 98101 206 553-71970 Case Document-472 Filed 07 27 18 Page 4 of 33 recordings back to the attacker 'It can also let the attacker use the Victim computer to 7 attack other Computers and to steal les from the victim computer and install other malware All of this can be dene without the legitimate user s knowledge or permiSsion 5 - Bot A bet computer is a computer that has been infected With seine kind 7 of malicious software or code and 1s thereafter subject to control by someone other than the true oWner The true owner of the infected computer usually remains able to use the computer as he did before it was infected althOugh speed or performance maybe compromised 7 I 7 I 6 Botnet A botnet is a network of compromised computers known as bots thata're under the control of a cybercriminal or bot herder The bots are harnessed by the bot herder through the surreptitious'installation of malware that provides i the bot herder with remote access to and control or the compromised cemputers A 'botnet may be used en masse in a coordinated fashion to deliver a Variety Of Internet- based attacks including attacks brute force pastord attacks the transmission of spam emails the transmission of phishing emails and hosting communication networks it for cybercriminals e acting as a proxy server for email communications 7 Phishing Phishing 1s a criminal scheme 1n which the perpetrators use mass email messages and or fake Websites to trick people into providing information such -- as network Credentials usernames and passwords that may later begused to gain access to a victim s systems Phishing schemes Often utilize social engineering techniques similar toitradition'al con-artist techniques in Order to trick victims into- believing they are providing their information to a trusted vendor customer or Other acquaintance Phishing emailsare also often used to trick a Victim into clicking on documents or links that contain malicioirs software that will cempromise the victims computer system I 8 Spear Phishing Spear phishing rs a targeted form of phishing directed towards a Speci c individual organization or business Although often intended to steal Superseding Indictment United States v Hladyr 1 I 730 ISHED sug s 52 - 7 TEWART N0 275RSL 3 SEATTLE WASHINGTON 98101 206 553-7970 ooqoxm-wah- owooqmm-hwmma Case 2 17ecr-00276-RSM Document 47-2 Filed 07 27 18 Page 5 off33 data for malicious purpoSes cybercriminals may also'use spear phishing schemes-to install malware 011 a targeted user s computer i 9 Social Engineering Social engineering is a skill developed over time by people who seek to acquire protected information through manipulation of social- I relationShips People who are skilled 1n social engineering can convince key individuals I to divulge protected information or access credentialsithat the social engineer deems valuable to the achievement of his or her aims 10 Pen-Testing Penetration testing or pen-testing is the practlce of testing a 9 computer system network or computer application to nd vulnerabilities that an attacker 1 2 may exploit 1 Conspiracy to Commit Wire and Bank Fraud 1 OFFENSE 11 The allegations set forth in Paragraphs 1 through 10 of this Superseding Indictment are re-alleged and incorporated as if fully set forth herein 12 -I Beginning at a time unknown but no later than September I201 5 and continuing through on or after January 10 20198 at Seattle within the -WesternI District of Washington and elsewhere FEDIR OLEKSIYOVYCH HLADYR aka Fedor Gladyr aka _ Fedir Qleksiyovych IGladyr Gladyr Fedir Gladyr Fedor Oleksiyovich aka I Fedor aka aka Fyodor aka ArIonaXus and others if known and unknown to the Grand Jury did-knowingly and willfully combine conspire confederate and agree together to commit Offenses against the United States to Wit 4 a 3 to knowingly and willfully devise and execute and attempt to I execute a scheme and artifiCe to defraud and for obtaining money and property by means of materially false and fraudulent pretenSes representatibns and promises and 1n executing and attempting to execute this scheme and arti ce to knowingly cause to be transmitted in interstate and foreign Commerce by means of wire communication '0ertain - Superseding Indictment United States Hladyr - I - 737 UNITED STATES ATTORNEY I No 4 I I 700 STEWART $112331 5111135220 SEATTLE WASHINGTON 98101 206 553 47 970 qumUI-bm Nl I Case Document 47-2 Filed 07 27 18 Page 6 of 33 '7 'signs signals and sounds as further described below in violation of Title 18 UIiited_ States Code Section 1343 b to knowingly and willfully devise and execute and attempt to exeCute a scheme and arti ce to defraud nancial institutions as de ned by Title 18 United States Code Section 20 and to obtain moneys funds and credits under the 7 7' custody and control of the nancial institutions by means of materially false and fraudulent pretenses representations and promises in violation of Title 18 United States Code Section l344 1 and 2 II OBJECTIVES OF THE CONSPIRACY l3 Defendant FEDIR OLEKSIYOVYCH HLADYR and others 101an and unknown to the Grand Jury were part of a nancially motivated cyberCriininal conspiracy knOWn' variously as FIN7 the Carbanak Group and the Navigator Group referred to herein as FIN7 consists of a group of criminal actors engaged in a sephisticated malware campaign targeting the computer systems of businesses primarily in the restaurant gaming and hospitality industries among others I 7 14 The objectives of the conspiracy included hacking into protected computer networks using malicious software hereinafter malware designed to provide the conspirators with unauthorized access to and control of victim computer systems The objectives of the conspiracy further included conducting surveillance of victim computer 7 networks and installing additional malware on victim computer netw0rks for the purpose i ii of establishing persistence stealing money and property including payment credit and debit card track data nancial information and proprietary and non-public information The objectives of the censpiracy further included using and selling the stolen data and information for nancial gain in a variety of ways including but not limited to using stolen paymentcard data to actress the i United States and in foreign countries Superseding Indictment United States v Hladyr 7 UNHED STATES - No 7-276RSL- 5 700 STEWART STREET 31111135220 3mm WAsmNoroN 931-01 206 55317970 - omk th-W Ni d 7 Case Document 47-2 Filed 07 27 18 Page 7-of33v MANNER AND MEANS OF THE CONSPIRACY 15 The manner and means used to accOmplish the conspiracy included the following a FIN 7 developed and employed various malware designed to in ltrate compromise and gain control of the computer systems of Victim companies operating in the United States and elsewhere including within the Western District of 1 Washington IN 7 established and operated an infrastructure of servers located 1n various countries through which FIN 7 members Coordinated activity to further the scheme This infrastructure included but was not limited to the use of command and control servers accessed through custom botnet control panels that With 1 7' and controlled compromised computer systems of victrm companies b IN 7 created a front company doing business as Combi Security to facilitate the malware scheme by seeking to make the scheme 3 illegal conduct appear legitimate Combi Security purports to Operate as a computer security pen testing company based 1n Moscow Russia and Haifa Israel As part of advertisements and public intemet pages for Combi Security FIN7 portrayed Combi Security as a legitimate penetration testing enterprise that hired itself out to businesses for the purpose of testing their computer security systems I 7 Under the guise of a legitimate computer seCurity company FIN7 doing business as Combi Security recruited individuals with computer programming skills falsely claiming that the prospective employees would be engaged 111' legitimate I pen-testing of Client computer networks I11 truth and in fact as Defendant and his FIN7 co cOnspirators well knew Combi Security was a front company used to hire anddeploy hackers who were given tasks in furtherance of the conspiracy FIN7 targeted victims inthe Western District of elsewhere using phishing techniques to distributemalware designed to gain unau iorized' access to take control of and ex ltrate data from the computer systems of various businesses targeted victims include more than 120 identi ed companies with-- Superseding Indictment United States v Hladyr i UNITED STATES ATTORNEY No CR17-276RSL- 6 700 STEWART STREET Sum 5220 WASHINGTON 98101 - 206 553 4970 I Case DocUment47-2 Fil'e d 07 27 18 Page 8111 33 thousands of individual locations of operation throughout the United States including but not limited to the following representative victim companies 1 i 7 Victim l referenced herein is the Emerald Queen Hotel and Casino EQC a hotel and casino owned and operated by a federally recognized Native American Tribe with locations in Pierce County within the Western District of Washington ii Victim- 2 referenced herein IS a - public corporation headquartered 111 Seattle within the Western District of Washington with operations throughOut the United States and elseWhe re Victim-3 referenced herein is Chipotle MeXican Grill 3 I U S L-based restaurant chain with thouSands of locations in the United States including in the western District of Washington and in Canada and multiple EurOpean countries I iv VictiI1n-4 I referenced herein lS a U S - - based pizza parlor chain with hundreds of locations predominantly in the Western United States including in the Western District of Washington i Iv Victim- 5 referenced herein lS BECU a U S -based I federally insured credit union headquartered in the Western District of Washington I vi Vieti-m- 6 referenced herein lS Jason s Deli a U -based casual delicatessen restaurant chain with hundreds of locations in the United States II vii Victim 7 I referenced herein is - an automotive retail and repair chain with hundreds of locations in the United States including in the Western District of Washington Victim-8 referenced herein is Red Robin Gourmet Burgers and Brews Red Robin a S based Casual dining restaurant Chain founded in the Western District of Washington with hundreds of locations in the United States including in the Western District of Washington Superseding Indictment United States v Hladyr UNITED STATES-ATTORNEY I No CR17- 7 I - I 700 SEATTLE WASHINGTON 98101 - 206 553 7970 Case Document 47-2 Filed 07 27 18 Page 9 of 33 ix Victim-9 referenced herein is some Drive-in Sonic a U S -based drive-in fast-food chain with thousands of locations In the United States including 1n the western District of WashingtOn I I x Victim 10 referenCed herein 1s Taco John s a U S -based fast-food restaurant chain with hundreds of locations 1n the United States including 111 the Western District of washington e FIN7 typically initiated its attacks by delivering directly and through intermediaries a phishing email with an attached malicious le using wires in interstate and fereign commerce to an employee of the targeted victim company The attached malicious le usually was a Microsoft Word doc or 3 19 or Rich Text File rtf document with embedded malware FIN 7 used a variety of malware delivery mechanisms in its phishing attachments including but not limited to Weaponized Microsoft Word macros malicious Object Linking and Embedding OLE objects malicious visual basic scripts or avaScript and malicious embedded shortcut les LNK les In some instances the phishing email or attached le contained a link to malware hosted on servers controlled by FIN7 The phishing email through false representations and pretenses iraudulently induced the Victim company employee to open the attachment i i or click on the link to activate the malware For example when targeting a hotel chain the purported sender of the phishing email might falsely Claim to be interested in making I a hotel-reServation By way of further example when targeting a restaurant chain the purported sender of the phishing email might falsely claim to be interested in placing a fl - catering order or making a complaint about prior food service at the restaurant f In certain phishing attacks FIN7 directly and through interrnediaries sent phishing emails to personnel at victim companies who had uniquel- access to internal preprietary and non public company information including but not limited to emplOyees involved with making filings with the United States Securities and Exchange Commission These emailsiused an email address that spoofed an - Superseding Indictment United States v Hladyr - I - UNITED STATES ATTORNEY No CR17-276RSL 8 - 700 STEWART 5220' - - SEATTLE WASHINGTON 98101 206 553-7970 m oxm-th r-dowooxlmm-hmboeo Case DoCument 47-2 Filed 07 27 18 Page 10 of 33 email address associated With the electronic ling system and induced the recipients to activate the malware contained in the emails attachments I g In many of the FIN7 attacks a FIN7 member or someone hired by FIN7 speci cally for such purpose would also call the victim company using wires in interstate or fereign commerce tolegitimizl-e the phishing email and cenvince the victim company employee to open the attached document using social engineering techniques t For example when targeting a hotel chain or a restaurant chain a conspirator would 1 make a follow-up call falsely claiming that the details of a reservation request -catering _ 7 - order or customer complaint could be found in the le attached to the preViOus ly - delivered email to induce the employee at the victim company to read the phishing email open the attached le and activate the malware h If the recipient activated the phishing email attachment or clicked on the link the recipient would unwittingly activate the malware and the computer 0n 7 which it was opened would become infected and Connect to One or more command and control sewers controlled by FIN7 to report details of the newly infected computer and download additional malware The command and control- infrastructure relied upon various servers in multiple countries including but not limited to the United States typically leased using false information - such as alias names and ctitious information i FIN 7 typically would install additional malware including the Carbanak malware to connect to additional FIN 7 command and control servers to establish remote control of the victim computer j OnCe a victim 3 computer was Compromised FIN 7 wOuld incorporate the compromised machine or hot into a botnet 7 k FIN7 designed and used a custom botnet centre panel to manage and issue commands to the compromised machines Once a Victim company s computers were incorporated into the PIN 7 betnet and remotely controlled by malware the group used this remote control and access to among other things install and manage additional mal'ware Superseding Indictment United States v Hladyr UNITED STATES ATTORNEY 700 STEWART STREET SUITE 5220 No 9 SEATTLE WASHINGTON 98101 206 553-7970 Case Document 47-2 Filed-O7 27 18 Page 111017 333 conduct surveillance map and navigate the compromised computer network Compromise additional computers ex ltrate les and send and receive data For instance FIN 7 often conducted surveillance on the victim s computer ne'twOrk by among Other capturing screen shots and videos of v1ct1m computer workstations that provided the conspirators with additional inforniation about the Vietim company ComputernetWOI k i I and non-public credentials for both generic company accelmts and for actual- company employeesIn 1N7 used its acceSs to the Victim 5 computer network and information gleaned from Surveillance of the victim s computer systems to install additional malware designed to target and extract particular information and property of value including payment card data and proprietary and non-public infermation For instance FIN7 often utilized various off-the shelf software and Custom malWare and a - combination- thereof to eXtract and transfer data to a loot folder on one or more servers controlled by FIN7 FIN7 frequently targeted victim companies with customers who use payment cards while making legitimate point-of-sale purchases such as victim cempanies in the restaurant gaming and hospitality industries In those cases FIN7 con gured malWare to extract copy and compile the payment card data and then to transmit the data from the victim computer systems to servers controlled by 0 I For example between approximately March 24 2017 and April I8 2017 FIN7 harvested payment card data from point-of-sale devices at certain Victim-3 1 - restaurant locations including dozens of locations 111 the Western District of Washington p FIN7 stole millions of payment card numbers many of which'have been offered for sale through Vending sites including but not limited to Joker s Stash thereby attempting to generate millions of dollars of- illicit pre ts q The payment card data were Offered for sale to allow purchasers to falsely represent themselves as authorized users of the stolen payment cards and to use the stolen payment card information to purchase goods and services in fraudulent Superseding Indictment United States Hladyr - - 1 UNITED STATES ATTORNEY No 10 - 7 700 STEWART STREET Surra5220 - - SEATTLE WASHINGTON 98101 206 553-7970 scooqoxmihmimihn Case Document47-2 Filed 07 27 18 Page'12'of33 transactiOns throughout the United States and the world including oVer the Internet 3 resulting in millions of dollars-in losses to and and banks including nancial institutions as de ned in Title 18 United States Code Section '20 For example on or about March 10 2017 stolen payment card data related to accounts held at Victim-5 a nancial institution headquartered 1n the Western District of Washington compromised through the computer network intrusion of a vlctim company was used to make unauthorized purchases at a merchant 1n Puyallup Washington r FIN7 members employed various techniques to conceal their identities including simultaneously utilizing various leased servers that had been leased using false subscriber information in multiple countries I s FEDIR OLEKSIYOVYCH I-ILADYR served as a high level systems administrator for FIN7 who maintained serVers and cominunication channels used by the organization For example FIN 7 members requested FEDIR OLEKSIYOVYCH I-ILADYR to grant them access to servers used by FIN7 to facilitate the malware scheme FEDIR OLEKSIYOVYCH HLADYR also played a management role 1n the scheme by delegating tasks and by providing instruction to other members of the scheme I FIN7 members typically comniunicated with one another and others thrOugh private cominunication channels to further their malicious activity Among other channels FIN 7 conspirators communicated using Jabber an instant messaging Service that allows members to communicate across multiple platforms and that supports end-to- end i i u For example in Jabber communications with other FIN7 members a co conspirator D F using his alias hotdima referenced using malWare 1n co nnectiOn with several speci c victim compameS discussed using the administrative Control panels 1 to receive data from compromised computers and identi ed several pen testers working at his direction I Superseding Indictment-l United States v Hladyr 2' UNITED STATES ATTORNEY No 1 1 - - 700 STEWART Smnr SUITE 5220 SEATTLE WASHINGTON 98101 A 206 553 7970 Case Document 47-2 Filed 07 27 18 Page 131of 33 7 V FIN 7 members often communicated through a private HipChat server HipChat 1s a group chat instant messaging and file-sharing program FIN7 members used its HipChat server to collaborate on malware and victim business intrusions to interview potential reoruits and to upload and share ex ltrated data such as stolen payment card data As a system administrator FEDIR OLEKSIYOVYCH I HLADYR created HipChat user accounts for FIN 7 members that allowed them to acCess II the server i FEDIR OLEKSIYOVYCH HLADYR also created and participated in multiple HipChat rooms with other FIN 7 members and participated in the uploading and organization of stolen payment card data and malware For example on or about March 14 2016 FEDIR OLEKSIYOVYCH HLADYR uploaded an archive that contained numerous data les created by malware designed to steal data from point-cf- sale systems that precess payment cards The les contained payment card numbers stolen from a victim comp any that had publicly reported a security breach that resulted 1n the compromise of tens of thousands of payment cards By way of further example FEDIR OLEKSIYOVYCH HLADYR also set up and used a HipChat room titled MyFile in which he was the only participant and to which he uploaded malware used by FIN7 and stelen payment card information I x FIN7 conspirators used numerous email accounts hosted by a varietyI of providers 1n the United States and elsewhere which they O en registered using Ifalse subscriber infermation I I I y IN7 conspirators frequently used the pro_ ect management software IRA hosted on private virtual servers in various countries to coordinate their malicious activity and to manage the assorted network intrusions FIN 7 members typically created a proj ect and then associated issues with the preject each issue akin to an issue directory or folder for a victim company which they used to collaborate and share 1 I details of the intrusion to post victim company intelligence such as network mapping infermation and to store and share ex ltrated data Superseding Indictment United States v Hladyr - UNITED STATES ATTORNEY No 12 700 STEWART Some 5220 SEATTLE WASHINGTON 98101 206 55347970 Case Document 47-2 Filed 07 27 18 Page 14 of 33 For example on about September 7 2016 FEDIR OLEKSIYOVYCH HLADYR created an issue for Victim-6 to which FIN7 conspirators posted les centaining internal Credentials for the victim company 8 computer networkfurther example on multiple occasions in January 2017 00 conspirator D F and others posted to the IN 7 fissue created for Victim-7 information about the victim company internal network and uploaded ex ltrated data - including stolen employee credentials Similarly on or about April 5 2017 co conspirator F created an issue for another victim company Victim-9 and uploaded stolen user credentials from the Victim company i bb- FIN 7 conspirators knew that the scheme would inVolve the use of wires in both interstate and foreign commerce to accomplish the objectives of the scheme For example the Defendant and his FIN 7 co-conspirators knew that execution 1 of the scheme necessarily caused the transmission of wire communications between the United States and one or more servers controlled by IN7 located 111 foreign countries All 1n violation of Title 18 United States Code Section 1349- COUNTS 2-15 Wire Fraud - 16 _The allegations set forth 1n Paragraphs 1 through 15 of this Superseding Indictment are re-alleged and incorporated as if fully set forth herein I SCHEME AND ARTIFICE To DEFRAUD l7 Beginning at a time Unknown but no later than September 2015 and continuing through 011 or after January 10 2018 at Seattle Within the Western DiStrict of _Washington and elsewhere HLADYR and others known and unknown to the Grand Jury deyised'and intended to devise a scheme and arti ce'to defraud and to obtain money and property by means of materially false and fraudulent pretenses representations and promises Superseding Indictment United States v Hladyr 7 UNITED STATES ATTORNEY No 13 STREET Sorta 5220 SEATTLE WASHINGTON 98101 206 553-7970 Document 47-2 Filed 07 27 18 Page 15 of 33' 18 The essence of the scheme and arti ce to defraud Was to obtain unauthorized access into and control of the computer netWOrks of victims thrOugh deceit - and materially false and fraudulent pretenses and representations through the installation it I and use of malware designed to facilitate among other things the installation of additional malware the sending and receiving of data and the surveillance of the victims computer networks The object of the scheme and arti Ce to defraud was to steal money and property of value including payment card data and proprietary and 11911 public information which was and could have been sold and used for nancial gain II MANNER AND MEANS OF SCHEME TO DEFRAUD I 19 The manner and means of the scheme and arti ce to defraud are set forth Paragraph 15 of Count of this Superseding Indictment I I111 EXECUTION OF SCHEME T0 DEERAUD 20 On or about the dates set forth below Within the Western District of Washington and elsewhere FEDIR OLEKSIYOVYCH I-ILADYR and others known and unknown to the Grand Jury having devised a scheme and arti ce to defrand and to obtain money and property by means of materially false and fraudulent pretenses representations and promises did knowingly transmit and cause to be transmitted writings signs Signals pictures and sounds for the purpose 0f executing such scheme by means of wire Communication in interstate and foreign commerce ineluding the following transmissions Email from justgetravel@yahoo com - which traveled through a server Victim-1 7 located outside the State of Pierce County _Washington to a Victim '1 employee located within the State of 2' I August8 2016 Washington superseding Indictment United States Hladyr A 7 i I UNITED STATES ATTORNEY No 14 I I - 700 STEWART STREET SUITE 5220 SEATTLE WASHINGTON 98101 206 55377970 00 NJ t-d Case Document 47-2 Filed 07 27 18 Page 16 of 33 Email from frankjohnson@re ntal traVelcom which traveled through a Victim-1 server locatedoutside the State of 7 August 8 2016 Pierce County Washington to a Victim-1 employee 7 1 - located Within the State of 1Washington Electronic cemrnunication between a - Victim-1 7 server lecated outside the State of August 8 2016 Pierce Coun Washington and Victim-1 5 computer - ty system located Within the State of Washington Email puiporting to be from a government account Which traveled Victim- 2 through a server located outside the February 21 2017 Seattle State of Washington to a Victim-2 employee loCated within the State of Washington Electronic communibation between a i I Vic tim 2 server located outside the State of February 23 2017 Seattle Washington and V1ct1m-2 s computer system located Within the State of Washington i Electronic cominunication betWeen a 7 V1ct1m 3 4120 196th St SW server located outs1de the State of March 24 2017 7 and V1ct1m 3 s computer ulte 1 50 - system located w1th1n the State of 7 Washington - 1 Electronic communication between a 7 Victim 3 server located outside the State of March 25 2017 7 '1415 Broadway washington and Victim-3 s computer Seattle system located within the State of Washington ElectrOnic communication between a Victim-3 server located outside the State of 7 March 25 2017 800 156th Ave NE Washington and Victim-3 computer - 7 BelleviJe s ystem located Within the State of Washington a UNITED STATES ATTORNEY Superseding Indictment United States Hladyr No 15 700 STEWART STREET SUITE 5220 SEATTLE 98101 206 553 7970- Case 2 17-cr-00276l-RSM Docume'nt'47-2 Filed 07 27 18 Page 17 of 33' - Electronic communication between a 7 I 7 Victim 3 server located outSide the State of 10 - March 25 2017 4Bellis Fair Pkwy - Washington and Victim-3 3 computer - - 7 Bellingham 7 system located within the State of Washington - - 7 Electronic communication betWeen Gilman server located outside the State of 11 7 March 25 2017 Blvd Suite A Washington and V1ct1m 3 scornpute r ISsaquah system located within the State of Washington 7 Victim-3 - Electronic communication between a 3 7 515 SE Everett server located outs1de the State of 12 March 27 2017 Washington and V10t1m-3 5 computer- - - - all Way Smte B Everett - - system located Within the State of Washington Vietim-3 Electronic oommunication between a 22704 SE 4th St server located outside the State of 13 April 11 2017 Washington and V1ct1m-3 s computer ulte 210 Samm amish' system located within the State of washington Email from oliver_palmer@yahoo com - Which 4 - - Victim-4 traveled through a server located 3 14 Apnl 11 2017 - Renton outside the State'of Washington to a Victim-'4 employee located within the State of WashingtOn Electronic communication between a Victim-5 merchant lecated within the State of 15 March 10 2017 Pu 11 and a payment processor - ya up server 10oated outside the State of Washington All 1n violation of Title 18 United States Code Seetion 1343 Superseding Indictment United States v Hladyr UNITED STATES ATTORNEY 2700 STEWART STREET Surra5220 WASHINGTON 98101 206 553-7970 Case Document 47-2 Filed 07 27 18 Page 18 of 33 COUNT 16 Conspiracy to Commit Computer Hacking I 21 The allegations set forth in Paragraphs 1 through 20 of this Superseding Indictment are re-alleged and incorporated as if fully set forth herein I - OFFENSE 22 Beginning at a time unknoWn but no later than September 2015 and continuing through on or after January 10 2018 at Seattle Within the Western District of Washington and elsewhere FEDIR OLEKSIYOVYCH HLADYR and others known and unknown to the Grand Jury did knoWingly and willfully cembine conspire confederate and agree together to commit offenses against the United States to wit 1' - a to knowingly and with intent to defraud access a protected computer without authorization and exceed authorized access to a protected computer and by means of such conduct further the intended fraud and obtain anything of value exceeding $5 000 00 1n any luyear period in violation of Title 18 United States Code Sections 1030 a 4 and and b to knowingly cause the transmission of a program information A 1 code and and as a result of such conduct intentionally cause damage without authorization to a protected computer and the offense caused loss to one or more persons 1 during a 1-year period aggregating at least $5 000 00 1n value and damage affecting 10 or A more protected computers during a l-year period in violation of Title 18 United States Code Sections 1030 a 5 A and 1 II OBJECTIVES OF THE CONSPIRACY 23 The objectives of the conspiracy included hacking into protected computer networks using maIWarIe designed to provide the conspirators With Unauthorized access I to and control of victim computer systems The objectives of the conspiracy further included conduCting surveillance of victim computer networks and installing additiOnal' malware on the victim computer networks for the purposes of establishing persistence and stealing payment card track data nancial information and proprietary private and Superseding Indictment United States Hladyr - - UNITED STATES ATTORNEY a - 700 STEWART sinner 5mm 5220 No 276RSL 17 SEATTLE WASHINGTON98101 206 553 7970 Case Document 47-2 Filed 07 27 18 Page 19 of 33' non-public information with the intention of using and Selling Such stolen items either 7 I directly or indirectly for nancial gain The objectives cf the conspiracy further I included installing malware that would integrate victim computers into a botnet that I allowed the conspiracy to control alter and damage compromised Computers - MANNER AND MEANS OF THE CONSPIRACY 24 The manner and means used to accomplish the conspiracy are set forth in Paragraph 15 of Count 1 of this Superseding Indictment IV OVERT ACTS 7 25 In furtherance of the conspiracy and to achieve the objects thereof FEDIR OLEKSIYOVYCH HLADYR and others known and unknown to the Grand Jury did commit and cause to be cOminitted the following overt acts among others in the Western District of Washington and elserhere I a FEDIR OLEKSIYOVYCH HLADYR served as a high-level systems administrator for FIN 7 who maintained servers and cominunication channels used by the organization including administrating HipChat rooms and the uploading and organization of stolen payment card data and malware For example I -- i On or about March 14 2016 FEDIR OLEKSIYOVYCH HLADYR uploaded to a HipChat room shared with another 1N7 member an archive that contained numerous data les centaining payment card numbers stolen from a victim company that had publicly reported a security breach that reSulted 1n the loss of tens of thousands of payment cards ii - On or about April 8 2016 FEDIR OLEKSIYOVYCH HLADYR created a HipChat room called My_ Files to which he had exclusive access and later uploaded data for approximately 100 stolen payment cards 7 On or about July 19 2016 FEDIR OLEKSIYOVYCH HLADYR posted in a HipChat room accessible to other FIN7 members les related to a i victim company including multiple soreenshots fromr'one or more victim Company Superseding Indictment United States Hlaafyr i - UNITED STATES ATTORNEY '700 STEWART STREET SUITE 5220 - SEATTLE WASHINGTON 98101 - 206 553-7970 Case Document 47-2 Filed 07 27 18 Page 20 of 33 computers that showed among other things internal company information and an administrator password iv On or abOUt November 22 2016 FEDIR OLEKSIYOVYCH HLADYR uploaded to his My_ Files HipChat reom a le containing data for stolen I paymentcards b Co-conspirator D F served as a high- -Ieve1 pen- of one- - tasked with nding vulnerabilities that an attacker may exploit who managed Other pen- testers responsible for breaching the security of victims computer systems For example i Co conspirator D F created and managed issues on private JIRA server relating to intrusions of multiple victim companies including but not limited to Victim-7 and Victim-9 to which FIN7 members shared and stored intrusion information and ex ltrated data ii _Us ing 3 private Jabber server co consp irator D F communicated under the alias hotdima with other FIN7 members regarding his hacking efforts and his payment for such efforts I I Co conspirator D F accessed and controlled compromised computer systems through custom control panels c 1 The conspiracy compromised illegally accessed had unauthorized communications with and ex ltrated proprietary private and non-public victim data and i information from the computer systems of- the Victim-l a hotel and casino in the - Western District of Washington For instance i On or about August 8 2016 the conspiraCy directly and through intermediaries used the aCcount just__ etravel@yahoo com to send a phishmg email with thejsubject to an employee of Victim-1 located 1 11Tacoma Washington with an attached Microsoft Word document that contained malWareV The email contained materially false representations designed to induce the targeted employee to open enable the malware and compromise the computer system Superseding Indictment United States Hladyr I - UNITED STATES N0 19 2700 5220 SEATTLE WASHINGTON 98101 20195534970 Case Document47-2 Filed 07 27 18 Page-21 of33 ii On or about August 8 2016 the conspiracy directly and through intermediaries used the account frankjohnSon@revital travel com to send a 1 phishin'g email with the subject order to an employee of Victim-1 located 111 Tacoma Washington With an attached Microsoft word document that contained malware The email contained materially false representations designed to induce the targeted employee to enable the malware and compromise the computer system - _Under the control of the censpiracy malware a compromised computer of Victim-1 communicated with a command and centrol server located 1n 3 foreign country For instance from August 2016 to August 9 2016 and from August 24 2016 to August 31 2016 a compromised Victim-l computer logged apprOximately 3 639 communications with various URLs all starting With revital- travel eom at an IP address hosted 1n Russia H- I d The conspiracy compromised illegally accessed had utiauthoriZch communications With and ex ltrated proprietary private and non-public victim data and 7 information from the computer systems of Victim-6 a restaurant chain with locations 1n multiple states For instance 1 On or about August 25 2016 the conspiracy directly and- through intermediaries used the account revital travel @yahoo com to send a phishing email to an employee of Victim 6 with an attached Microsoft Word document that contained malware The email contained materially false representations designed to induce the targeted employee to enable the maIWare and compromise the computer systemabout September7 2016 FEDIR OLEKSIYOVYCH HLADYR created an issue on the conspiracy s private JIRA serverSpecifically related to Victim-6 One or more FIN '7 members posted les Containing internal credentials for i the Victim 6 cemputer network I A i 7 be The conspiracy compromised illegally accessed had unauthdrized communications with and ex ltrated proprietary private and non-public victim data and Superseding Indictment United States Hladyr UNITED STATES ATTORNEY No 20 7 - - 700 STEWART STREET 3111155220 semenmsamcron 98101 - 206 5534 970 Case Document 47-2 Filed 07 27 18 Page 22 of 33 inforniatiOn firom the computer systems of Victim-7 an automotive retail and repair chain with hundreds of locations in multiple states including Washington For instance i i 011 or about January 18 2017 a FIN7 member created an 1 issue 011 the conspiracy 3 private JIRA server speci cally related to Victim-7 That FIN7 member and co Conspirator D F posted results from several netWork mapping tools used on Victim-7 5 internal networkabout January 20 2017 a FIN7 member posted ex ltrated data including multiple usernames and pass-words with the title Server I Passwords to the Victim-7 JIRA issue - On or about January 23 and January 24 2017 co-conspirator' F posted information about Victim-7 s internal netWork and uploaded a le centaining multiple IP addresses and information abOut Victim 7 servers to the Victim-7 JIRA issueabout January 27 2017 co-eonspirator 1 F uploaded to the Victim 7 issue a le containing over 1 000 usernaines and passwords for generic company accounts and employee accounts The potentially compromised _7 acCounts related to approximately 700 Victim-7 locations throughout the United States including approximately 12 locations located in the state of Washington ii 7 f The conspiracy compromised illegally accessed had unauthOrized communications with and exiiltrated proprietary private and 110n public Victim data and if i information from the computer systems of Victim 2 a corporatiOn headquartered 111 Seattle Washington For instanceabout February 21 2017 the conspiracy directly and through intermediaries used an account purporting to be lings@sec gov but actually 3th by secureservernet to send a' phishingemail toan employee of Victim-2 located in Seattle Washington With an attaChed MiCrosoit Word document that contained malware The email falsely purported to relate to a corporate ling with the SEC and contained Superseding Indictment I United States v Hladyr UNITED STATES ATTORNEY No 276RSL- 21 A 700 STEWART STREET 81111135220 206 553-7970 Case Document 47-2 Filed 07 27 18 Page 23 of 33 0 materially false representations designed to induce the targeted employee to open the file enable the malvvare and compromise the computer system I ii From on or about February 21 2017 to approximately March 3 2017 the conspiracy illegally accessed and had communications with the of Victim-Z located 111 Seattle washington For instance betWe en about February 23 2017 and February 24 2017 the victim computer made outgoing I connections to and transferred internal data without authOrization to an IP address 7 located 1n a foreign country 1 011 or about February 24 2017 a FIN7 member posted to a IRA issue created for- Victim 2 a screenshot from the targeted employee s computer at Victim-2 Which showed among other things an internal Victim-2 webpage available only to emplOyees with a valid user account iv Similarly a IFIN7 member posted to the Victim-2 JIRA issue a text le containing the usernames and passwords of the targeted Victim-2 employee including his her- personal email account LinkedIn account and personal - -- yr A I investment and nancial institution accounts I g I -- The conspiracy compromised illegally accessed had unauthorized communications with and ex ltrated proprietary private and non-public Vietim data and information from the computer systems of Victim-3 11 restaurant chain with thouSands ofII locations including the State of Washington From apprOximatelIy March 24 2017 to April 18 2017 the conspiracy accessed computer systems of Victim 3 and implanted malware designed to harvest payment card data from cards used on point of sale device's at restaurant locations nationwide including approximately 33 locations Within the Western District of Washington h - The conspiracy compromised illegally accessed had unauthOrized communications with and Iexfiltrated proprietary private and non-public victim data and information from the computer systems of Victim 8 a restaurant Chain with hundreds of locations in multiple states including ashington For instance Superseding Indictment United States v I adyr 5 7 UNITED STATES - - 7 v 700 STEWART STREET SUITE 5220 N0 CR17-276RSL- 22 I - SEATTLE Wasnmoron 98101 206 553 7970 00 l a Case IDocu'ment 47-2 Filed 07 27 18 PageI24 of 33' i On or about March 27 2017 the conspiracy directly and through intermediaries used the account ray donovan84@yahoo com to send a phishing email to a Victim 8 employee With an attached Microsoft Word document that contained malware The email falsely purported to convey a Customer complaint and centained additional materially false representations designed to induce the targeted employee to enable the maIWare and compromise the computer system ii On or about March 29 2017 a FIN7 member created an issue on the conspiracy private server speci cally related to Victim-8 and posted results from several network mapping tools used on Vietim-S Is internal network the pointI of-sale software management solution used by Victim-8 and a username and password to the Victim-I8 JIRA issue The software management tecl allows a I company to manage point-of-sale systems at multiple locations The IN7 member also 1' uploaded several screenshots presumably from one or more victim computers at Victim- 8 which showed amongother things the user logged into Victim-8 s account for the software management toolabout April 6 2017 21 FM member uploaded to the Victim-8 JIRA issue - a le containing hundreds of usernames and passwords for -- 7 approximately 798 Victim-8 locatiOns including 37 locations located 1n the State of Washington The le included network information telephone communications and locations of alarm panels within restaurantsabout April 7 2017 a FIN7 member uploaded to the Victim 8 issue a similar le containing numerous usernames and passWords for Victim-8 locations vi 011 or about May 5 2017 3 FIN7 member uploaded to the Victim 8 issue a le containing le directories on a compromised computer Vii 011 or about May 8 2017 a FIN7 member uploaded to the Victim-8 JIRA I issue ex ltrated les related to a password management system from a Superseding Indictmenti United States v HIadyr UNITED STATES ATTORNEY I No CR1M7-276RSL 23 81111115220 SEATTLE WAsmnorcN 98101 2'06 553-7970 on or about March 31 2017 11 FIN7 member pested a link to i Case Document 47-2 Filed 07 27 18 Page 25 of733 compromised computer which c'ontained the credentials usernames and passwords of a particular employeeor abOut May 15 20 17 a FIN7 member uploaded to the Victim-8 JIRA issue screenshots of a compromised computerthat Showed the employee accessing Victim48 s security infrastructure management software Same employee s credentials i The conspiracy compromised illegally accessed had unauthorized communicatiOns with and private and non-public Vietim data and information from the computer Systems of one or more locations of Victim-9 a fast-food restaurant chain With thousands of locations throughout the United States including i WaShington For instance a i i On various dates the conspiracy directly and through intermediaries sent phishing emails With an attached le that contained malware to multiple Victim 9 locations For instance on or about April 7 2017 the conSpiracy used the account oliver__palmer@yahoo com to send a phishing email to a Victim '9 location in the State of Oregon The email contained materially false representations designed to induce the targeted employee to open the le enable the malware and compromise the 7 I 1' computer system i i i ii 011' or about April 5 2017 eo-conSpirator D F created an a issue on the conspiracy 3 private JIRA server speci cally related to Victim-9 One or more IN7 members posted usernames and passwords for Victim 9 locations including a Victim-9 location 1n Vancouver Washington 3 The conspiracy compromised illegally accessed had unautho zed communications with and eX ltrated proprietary private and non public victim data and information from the computer systems of one or morelocatiOns of Victim-4 a pizza parlor chain With hundreds of locations including in Washington For instance 7 i On or about April 11 2017 the conspiracy directly and through intermediaries used the account Oliver _pa1mer@yahoo com to send a phishing Superseding Indictment United States v Hladyr UNITED STATES ATTORNEY No CR1 7 276RSL 24 r700 STEWART STREET SUITE 5220 - SEATTLE Wasnmoron 98101 206 553-7970 Case Document 47-2 Filed 07 27 18 Page 26 of 33 email With the subject claim to an employee of a Vietim 4 located 1n Renton Washington with an attached Rich Text Format rtf document that contained malware The email falsely purported to convey a customer complaint and contained additional materially false representations designed to induce the targeted employee to enable the malware and compromise the computer system - ii On or about April 11 2017 the conspiracy directly and through intermediaries used the account ol1ver_palmer@yahoo com to Send a phishing email with the subject an emplOyee of a Victim-4 located 1n Vancouver Washington with an attached Rich Text Format rtf document that contained malware The email falsely purported to convey a customer complaint and contained additional materially false representations designed to induce the targeted employee to enable the malware and compromise the computer system i I 9 On or about May 25 2017 the conspiracy directly and through intermediaries used the account Adrian 1987cl'ark@yahoo com to send a phishing email with the subject takeout order to an employee of a Victim-4 located 1n or around Spokane Washington with an attached Rich Text Format rtf document that contained malware The email falsely stated that the sender had a large takeout order and contained additional materially false representations designed to induce the targeted employee to enable the malware and compromise the computer system k The conspiracy compromised illegally accessed had unauthorized communications with and ex ltrated proprietary private and non-public victim data and information trim the computer systems of one or more locations of Victim-10 a faste food restaurant chain with hundreds of 10Catio ns 1n various states including Washington For instance it i i on or about May 24 201 7 a FIN7 member created an issue 7 on the conspiracyis priVate JIRA server speci cally related to Victim-10 One or more FIN7 members pested information relating to the intrusion cf compnter systems'anid Superseding Indictment United States v Hladyr 1 11mm STATESAITORNEY No CR17-276RSL- 25 700 STEWART SEATTLE WASHINGTON 9810 206 553-7970 pCase Document 47-2 Filed 07 27 18 Page 27 of 3-3 exfiltrated data including les containing passwords and Screenshots from one or more compromised cempnters 1 I ii On or about June 12 2017 the conspiracy directly and through intermediaries used the accoilnt Adrian 1987c1ark@yahoo com to send a phishing email with the subj ect order catering to an emplOyee of a Victim-10 located in Iowa with an attached Rich Text Format rtf document that contained maIWare The email falsely stated that the sender had a catering order for the following day and contained additional materially false representations designed to induce the employee to - enable the malware and compromise the computer system From on or about June 12 2017 to a date mow the I conspiracy illegally accessed and had communications with the computer systems of the Victim-10 located 1n Iowa For instance the conspiracy transferred without authorization the proprietary private and non-public victim data and information including usernames and passwords to a JIRA server managed by FIN7 located 111 a foreign countryAll 111 violation of Title 18 United States Code Section 371 COUNTS 17- 19 Accessing a Protected Computer 111 Furtherance of Fraud 26 The allegations set forth 1n Paragraphs 1 through 25 of this Supersedmg - Indictment are re- alleged and incorporated as if fully set forth herein _ I 27 On or about the dates listed below Within the Western of Washington and elsewhere FEDIR OLEKSIYOVYCH HLADYR and others known and unknown to the Grand Jury knOWingly and with intent to defraud accessed a I protected computer withOut- antherization and in excess of authorized access and by i i '7 means of such conduct furthered the intended fraud and lobtai'ned something of 'Valiie speci cally payment card data and proprietary and non-public information Whereby the object of the fraud and the thing obtained consisted of more than the use of the computers and the value of such use was more than $5 000 111a l yejar period as listed below 7 - Superseding Indictment United States v I adyr UNITED STATES ATTORNEY No CR17 276RSL- 26 - 1 WASHINGTON 98101 206 553 7970 Case D0cument47 2 Filed 07 27 18 Page-28 of33 if 17 August 8 2016 throughW 18 February 21 2017 through March 3 2017 'ViCti'm-Z 19 March 24 2017 through April 18 2017 Victim-3 All 1n violation of Title 18 United States Code Sections 1030 a 4 103001 1030 c 3 A and 2 - 22 Intentional Damage to a Protected Computer 28 The allegations set forth 1n Paragraphs 1 thIOugh 27 of this Superseding Indictment are re alleged and incorpOrated as if fully set forth herein 29 On or about the dates listed below within the Western Distn'ct of Washington and-elseWhere FEDIR OLEKSIYOVYCH HLADYR and others known 7 and unknown to the Grand'Jury knowingly caused the transmission of a program 7 information code and command and as a result of such conduct intentionally caused damage without authorization to a protected computer speci cally the protected computer system of the victim listed below and the offense caused loss to One or more 1 persons during a leyear period aggregating at least $5 000 00 in value and- ii damage affecting 10 or moreprotected computers during a l-year period 20 August 8 2016 through October 4 2016 Victim-1 21 February 21 2017 through March 3 2017 Victim-2 22' March 24 2017 through April 18 2017 Victim-3 All 1n violation of Title 18 United States Code Sections 1030 a 5 A 1030 1 1030 c 4 B and 2 l Superseding Ind1ct1nent United States v Hladyr 3 1 UNITED STATES ATTORNEY No CR17-276RSL- 27 700 STEWART STREET 31111115220 WASHINGTON 98101 206 553 4970 Case I Document 47-2 Filed'Q7 27 18 Page 29 0133 COUNT 23 1 Access Device Fraud 30 The allegations set forth in Paragraphs 1 through 29 of Superseding Indictment are re- alleged and incorporated as if fully set forth herein 31 Beginning at a time unknown and continuing through on or after January 10 2018 within the Western District of and elsewhere EDIR OLEKSIYOVYCH HLADYR and others known and unknown to the Grand Jury I and with intent to defraud possessed fteen or more counterfeit and i unauthorized access deviCes namely payment card data account numbers and Other means of accOunt access that can be used alone and 1n conjunction with another aCceSs device to Obtain money goOds services and any other thing of value and that can be used to initiate atransfer of funds said activity affecting interState and foreign All In violation of- Title 18 United States Code Sections 1029 c 1 A and2 CCOUN-T 24 I Aggravated Ident1ty Theft 32 The allegations set forth 1n Paragraphs 1 through 31 of this Superseding I - Indictment are 're-alleged and incorporated as if fully set forth herein I I 33 Beginning at a time unknown but no earlier than on or about February 21 2017 and no later than March 3 2017 - and- continuing through on or after Noyember 21 2017 at Seattle within the western District of Washington and elsewhere FEDIR OLEKSIYOVYCH HLADYR and others known and unknown to the Grand Jury did knowingly transfer possess -and_ use vVithout lawful authority a means of identi cation of another person to wit the name username and password of a real person J an U S 1028A c that 18 conspiracy to commit wire and bank fraud 1n Violation of 18 S C 1349 as charged 1n Count 1 and wire fraud in violation of 18 U S C 1343 as I Superseding Indictment United States v Hladyr 7 - UNITED STATES ATTORNEY 700 STEWART STREET SUITE 5220 - SEATTLE WASHINGTON 98101 206 553-7970 CO '4 4h Ln 1 1 Case 47-2 Filed 07 27 18 Page 30 of 33' charged in Counts 5 and 6 knowing that the means of identi cation belonged to another actual personviolation of Title 18 United States Code Sections 1028A a and 2 I I Aggravated Identity Theft 34 I The allegations set forth in Paragraphs 1 through 33 of this Supersedlng Indictment are re-alleged and incorporated as if fully set forth herein 35 Beginning at a time unknown but no later than on or about May 8 2017 and continuing through on or after November 21 2017 within the Western District of Washington and elsewhere FEDIR OLEKSIYOVYCH HLAIDYR and others known and unknown to the Grand Jury did knowingly transfer possess and use without lawful authority a means of identi cation of another person to wit the name employee credentials username and password of a real person M an employee of Victini-8 during and in relatiOn to a felony violation enumerated in 18 U S 1028A c that is conspiracy to commit wire and bank fraud 1n violation of 18 U S C 1349 as charged- in 3th 1 knowing that the means of identi cation belonged to anOther actual person All 1n violation of Title 18 United States Code Seetions '1028A a and 2 COUNT26 7 SS Aggravated Identity Theft 3 6 The allegations set forth 1n Paragraphs 1 through 35 of this Superseding Indictment are re-alleged and incorporated as if fully set forth herein 37 Beginning at a time unknown but no later than on or about January 27 2017 and Continuing through on in after- November 21 2017 within the Western District of Washington andlelsewhere EDIR OLEKSIYOVYCH HLADYR and others 1910 I and unknown to'the Grand Jury did knowingly transfer possess and use without law il authority a means of identi catiOn of another person to wit the name username and password of real personsand D employees of 1 Victim-7 during and in relation to a felony violation enumerated 18 U S C Superseding Indictment United States v wadyr - UNITED STATES ATTORNEY No CR17-276RSL 29 - 700 51111115220 WASHINGTON 98101 206 5534970 Case Document 47-2 Filed 07 27 18 Page 31 of 33 1028A c that IS conspiracy to commit wire and bank fraud - 111 Violation of 18 U S C 1349 as charged 1n Count 1 k_nowing that the means of identi catiOn belonged to another actual person All in Violation of Title 18 United States Code Sections 1028A a and 2 FORFEITURE ALLEGATION 38 The allegations contained in Counts lthrough 15_of this Sup-erSeding 7 Indictment are hereby reallegedand incorporated by reference for the purpose of alleging 7 I forfeitures pursuant to Title '18 United States Code Section 981 a and Title 28 United States Code Section 2461 b Upon conViction of any of the offenses charged 1n Counts 1 through 15 the defendant EDIR OLEKSIYOVYCH HLADYR shall forfeit to the United States any property real or personal which constitutes or is derived from proceeds traceable to such offenses including but not limited to a judgment for a sui'n of money representing the property described in this paragraph - 39 The allegations contained 111 Counts 16 through 22 of this Superseding Indictment are hereby realleged and incorporated by reference for the purpose of alleging ferfeitures pursuant to Title 18 United States Code Sections 982 a 2 B and 1030 1 Upon conViction of any of the offenses charged 111 Counts 16thrOugl1 22 the defendant FEDIR OLEKSIYOVYCH HLADYR shall forfeit to the United States any property constituting or derived from proceeds the defendant obtained directly or indirectly as the result of 'such offenses and shall also forfeit the defendant s interest in any personal property that was used or intended to be used to commit or to facilitate the commission of such offenses including but not limited to a judgment for a sum of money representing the property described 1n this paragraph 40 The allegations contained 1n Count 23 of this superseding Indictment are hereby realleged- and incorporated by reference for the purpose of alleging forfeiture-s pursuant to Title 18 United States Code Sections 981 a 1 C and 1029 cr 1 C and Title 28 United States Code SectiOn 2461 e Upon conviction Of the offense charged in f Count 23 the defendant FEDIR OLEKSIYOVYCH HLADYR shall forfeit to the -- Superseding Indictment United States v Hladyr I UNITED STATES ATTOIWEY No CR17 276RSL- 3o 700 Smwaars'mser SEATTLE WASHINGTON 98101 206 553-7970 oolaxt cnmh-wMI G cog-oxme-mmpg Case Document 47-2 Filed 07 27 18 Page 32 of 33 United States any property real or personal Whichlconstitutes-or is derived from proceeds traceable to such offenSe and Ashall also forfeit any personal property used or 7 I intended to be used to commit such offense including but not limited to a judgment for a 1 sum of money representing the property described In this paragrath I Substitute Assets 41 If any of the property described above as a result of any act or omission of I I the defendant - i I cannot be located upon the exercise of due diligence a 1b has been transferred or sold to or deposited with a third party to has been placed beyond the jurisdiCtion of the court d has been substantially diminished in value or e has been commingled with other property which cannOt be divided A without dif culty - Superseding Indictrnent United States v H1adyr UNITED ATTORNEY No 31 - 700 STREET SUITE 5220' SEATTLE WASHINGTON 98101 12095534970 Case Document 47-2 Filed 07 27 18 Page 33 of 33 DATED ANNETTE L HA United States Atto ey LQ ANDREW C FRIEDMAN Assistant United States Attorney CIS Ass tant United Stas sAttorney L Assistant United States Attorney Trial Attorney Computer Crime and Intellectual Property Section Superseding Indictment United States v Hladyr No 276RSL- 32 A TRUE BILL the United States of America shall be entitled to forfeiture of substitute property pursuant to Title 21 United States Code Section 853 p as ineorporated by Title 28 United States Code Section 2461 c 125 3 Signature of ForeperSOn redacted pursuant to policy of the Judicial Conference FOREPERSON UNITED STATES ATTORNEY 700 STEWART STREET SUITE 5220 SEATTLE WASHINGTON 98101 206 553-7970