Post on 03-Jun-2018
8/12/2019 GameOver Zeus - Pittsburgh Indictment
1/25
Case 2:14-cr-00127-AJS Document 1 Filed 05/19/14 Page 1 of 25
IN THE UNITED STATES DSTRICT COURT
FOR THE WESTERN DSTRCT OF PENNSYLVANA
UNITED STATES OF AMERCA Crmna No /'-( zv
(8 U S C 37 343
030 (a) (2) , 030 (c) (2) (B)
EVGENY BOGACHEV344 57 (a) an 5 6 () (1) (B) )UER SEAL
IICTMENT
Th gran ury chargs
ntroucton
FILED
MAY 1 204
CLERK U.S DIRT OUR
WEST. DIS OF PENNSYLVAN
At a tms matra to ths Inctmnt unss
othrws ag
program
) Macous softwar
sgn to srupt
( "mawar ) s a softwar
computr opratons gathr
snstv nformaton gan accss to prvat computr systms
or o othr unwant acton on a computr systm Common
xamps of mawar ncu vruss worms Trojan horss
rootkts kyoggrs spywar an othrs
2) Kystrok oggng s th acton of rcorng (or
oggng) th kys struck on a kyboar Ths acton s usuay
on surrpttousy by a computr program ( kyoggr) to
captur th kys typ on a computr wthout th typsts
knowgMawar that uss kystrok oggng oftn w
prov th captur kystroks to th nvua who caus th
ma war to b nsta or to a pac sgnat by th
nvua Through kystrok oggng nvuas ar ab to
obtan onn bankng crntas as soon as th usr of th
8/12/2019 GameOver Zeus - Pittsburgh Indictment
2/25
Case 2:14-cr-00127-AJS Document 1 Filed 05/19/14 Page 2 of 25
nfct computr ogs nto thr account Aftr obtanng ths
nformaton ths nvuas can accss th vctms onn
bank account an xcut unauthorz ctronc funs transfrs
( "EFT ) such as Automat Carng Hous ( "ACH ) paymnts or
wr transfrs to accounts that thy contro
3) Wb njcts ntrouc (or njct) macous
computr co nto a vctms wb browsr wh th vctm
browss
ssson
th Intrnt an "hjacks th vctms Intrnt
Dffrnt njcts ar us for ffrnt purposs
Som wb njcts ar us to spay fas onn bankng pags
nto th vctms wb browsr to trck th vctm nto ntrng
onn bankng nformaton whch s thn captur by th
nvua mpoyng th wb njct
4) "Bot whch s short for "robot s a computr
that has bn nfct by mawar an os tasks at th
mawars rcton
1 Ectronc funs transfrs ( "EFT) ar th xchang an
transfr of mony through computr-bas systms usng thIntrnt ACH paymnts aow th ctronc transfrrng offuns from on bank account to anothr bank account wthn th
ACH ntwork wthout any papr mony changng hans Th ACH
ntwork s a ntwork of partcpatng postory fnanca
nsttutons across th Unt Stats an th ntwork provs
for ntrbankng carng of ctronc paymnts Bcaus ACH
paymnts rqur th ntwork to car th transacton th funs
ar not mmaty avaab Wr transfrs aso aow
ctronc transfrrng of funs from on bank account to
anothr bank account wthout any papr mony changng hans i
howvr unk ACH paymnts w transfrr funs armmaty avaab
2
8/12/2019 GameOver Zeus - Pittsburgh Indictment
3/25
Case 2:14-cr-00127-AJS Document 1 Filed 05/19/14 Page 3 of 25
) A "botnt is a ntwork of bots It is a
coction of bots that ar connct to ach othr an that can
communicat with ach othr through som ntwork architctur
6) Prtopr ntworking is an avanc
cntraiz ntworking architctur n comman an contro
ntworks computrs in th ntwork ar connct to a cntra
srvr Whn a computr wants to communicat with anothr
vic in th ntwork, it communicats with th cntra srvr
an th cntra srvr thn communicats with th othr vic
n pr-to-pr ntworks th computrs ar connct ircty
to othr computrs in th ntwork omputrs can communicat
with othr computrs in th ntwork without th us of a
cntraiz srvr.
7) Zus is mawar spcificay sign to automat
th thft of confintia prsona an financia information
such as onin banking crntias from infct computrs
through th us of kystrok ogging an wb incts.
8) Pr-toPr Zus aso known as GamOvr Zus
is a mor sophisticat variant of th Zus mawar that
utiizs prto-pr ntworking for its botnt. Pr-toPr
Zus was vop bas on th origina Zus co. Lik Zus
Prto-Pr Zus is spcificay sign to automat th thft
of confintia prsona an financia information through th
us of kystrok ogging an wb injcts
3
8/12/2019 GameOver Zeus - Pittsburgh Indictment
4/25
Case 2:14-cr-00127-AJS Document 1 Filed 05/19/14 Page 4 of 25
) "hhng a fraud technque ued by coputer
attacker n an attept to acqure entve nforaton uch a
uernae paword and other account credenta by endng
electronc a (eal) or other electronc councaton
whch faley ca to be fro an etabhed egtate entty
One type of phhng ea drect the uer to cck on a
hypernk n the ea By clckng th nk the vct
caue the ntaaton of aware wthout the vct' conent
or knowedge
0) The Natona Autoated Clearng Houe Aocaton
( "NACHA) anaged the deveopent adntraton and
governance of the ACH network Although NACHA not drectly
nvoved n ACH payent t provde the operatng rue of the
ACH network and overee the ACH network
) A "ue or "oney ue a peron who receved
toen fund nto ther bank account and then oved the oney
to other account or wthdrew the fund and tranported the
fund overea a ugged bulk cah
12) NC Bank wa a fnancal nttuton nured by
the Federa Depot Inurance Corporaton It wa engaged n
the bune of provdng the ean to do eectronc fund
tranfer
ennyvana
It wa headquartered n the Wetern Dtrct of
and offered onlne bankng ervce through
4
8/12/2019 GameOver Zeus - Pittsburgh Indictment
5/25
Case 2:14-cr-00127-AJS Document 1 Filed 05/19/14 Page 5 of 25
coputer erver ocated n the Wetern Dtrct of
ennyvana
3) Hayte Renforced atc wa a bune
ocated n the Wetern Dtrct of ennyvana
4) The defendant EVGENY BOGACHEV wa a redent
of Rua He wa an adntrator of the eertoeer Zeu
botnet
SCHEME AND ARTIFICE
5) Fro n and around Septeber 20 the exact date
beng unknown to the grand ury and contnung to the preent
n the Wetern Dtrct of ennyvana and eewhere the
defendant EVGENY BOGACHEV and coconprator known and
unknown to the grand ury dd deve and ntend to deve a
chee and artfce to defraud and to obtan oney and property
by ean of atera fae and frauduent pretene
repreentaton and proe by ung the unauthorzed
ntaaton of aware on vct coputer to tea or attept
to tea on of doar fro nuerou bank account n the
Unted State and eewhere and to tranfer the toen fund
overea
defendant
16) It wa a part of the chee and artfce that the
EVGENIY BOGACHEV and coconprator known and
unknown to the grand ury ent phhng ea through the
5
8/12/2019 GameOver Zeus - Pittsburgh Indictment
6/25
Case 2:14-cr-00127-AJS Document 1 Filed 05/19/14 Page 6 of 25
Internet that faey repreented to be egtate ea fro
egtate copane aocaton and organzaton
1) It wa further a part of the chee and artfce
that the defendant EVGENY BOGACHEV and coconprator known
and unknown to the grand jury created the phhng ea to
frauduenty nduce recpent to cck on a hypernk faey
repreented to be a egtate nk contanng bune or
perona nforaton when n truth and fact t ntaed
aware wthout the ea recpent' conent or knowedge
8) It wa further a part of the chee and artfce
that the defendant EVGENIY BOGACHEV and coconprator known
and unknown to the grand jury wthout authorzaton ntaed
and caued the ntaaton of the eer-toeer Zeu aware on
Internet-connected vct coputer
) t wa further a part of the chee and artfce
that the eer-toeer Zeu aware wa degned to autoate the
theft of confdenta perona and fnanca nforaton uch
a onne bankng credenta The eer-toeer Zeu aware
factated the theft of confdenta perona and fnanca
nforaton by a nuber of ethod For exape the eerto-
eer Zeu aware ay obtan uch nforaton through keytroke
oggng Aternatvey the eertoeer Zeu aware ay aow
coputer ntruder to hjack a coputer eon and ue web
6
8/12/2019 GameOver Zeus - Pittsburgh Indictment
7/25
Case 2:14-cr-00127-AJS Document 1 Filed 05/19/14 Page 7 of 25
nect to preent a fake onne bankng webpage to trck a uer
nto enterng perona and fnanca nforaton
20) It wa further a part of the chee and artfce
that the defendant EVGENIY BOGACHEV and coconprator known
and unknown to the grand ury ued the eertoeer Zeu
aware on nfected coputer to capture the uer' confdenta
perona and fnanca nforaton uch a onne bankng
credenta by keytroke oggng or by h ackng the coputer
e on and preentng a web nect e fake onne bankng
webpage
2) It wa further a part of the chee and artfce
that the defendant EVGENIY BOGACHEV and coconprator known
and unknown to the grand ury ued the captured nforaton
wthout authorzaton to faey repreent to bank that the
Defendant and coconprator were vct or epoyee of
vct who have authorzaton to acce the vct' bank
account and to ake eectronc fund tranfer fro the
vct' bank account
22) It wa further a part of the chee and artfce
that the defendant EVGENIY BOGACHEV and coconprator known
and unknown to the grand ury ued the captured bankng
credenta to caue bank to ake unauthorzed wre tranfer
ACH payent or other eectronc fund tranfer fro the
8/12/2019 GameOver Zeus - Pittsburgh Indictment
8/25
Case 2:14-cr-00127-AJS Document 1 Filed 05/19/14 Page 8 of 25
victi' bank account without the knowedge or conent of the
account hoder
23) It wa further a part of the chee and artifice
that the defendant EVGENIY BOGACHEV and coconpirator known
and unknown to the grand ury ued oney ue to receive the
wire tranfer the ACH payent or other eectronic fund
tranfer fro the victi' bank account
24) It wa further a part of the chee and artifice
that the defendant EVGENIY BOGACHEV and coconpirator known
and unknown to the grand ury ued the oney ue to further
tranfer the toen fund to utiatey reach the contro of the
Defendant and hi coconpirator overea
25) It wa further a part of the chee and artifice
that on or about October 8 20, the defendant EVGENIY
BOGACHEV and coconpirator known and unknown to the grand
ury engaged in intertate and foreign wire counication over
the Internet by ending to an epoyee at Hayite Reinforced
Patic who wa ocated in the Wetern Ditrict of
Pennyvania a phihing eai which faey aeged that aid
counication originated fro NACHA and which frauduenty
induced the epoyee to cick on a aiciou hyperink faey
repreented to be a egitiate ink containing inforation
concerning a canceed ACH payent when in truth and fact it
intaed aware without the epoyee' conent or knowedge
8
8/12/2019 GameOver Zeus - Pittsburgh Indictment
9/25
Case 2:14-cr-00127-AJS Document 1 Filed 05/19/14 Page 9 of 25
26) t wa furter a part of te cee and artfce
tat on or about October 8 20 n te Wetern Dtrct of
ennylvana te defendant EVGENIY BOGAHEV and co
conprator known and unknown to te grand ury caued aware
to be ntaed wtout autorzaton on an Internet-connected
coputer ued by Hayte Renforced latc
2) t wa furter a part of te cee and artfce
tat on or about October 20 20 n te Wetern Dtrct of
ennylvana te defendant EVGENIY BOGAHEV and co-
conprator known and unknown to te grand ury ued te
ntalled aware to ack wtout autorzaton a coputer
eon of an epoyee at Hayte Renforced atc and to
nert wtout autorzaton a web nect e a fake onne
bankng webte n order to obtan te onne bankng
credenta of tree Hayte Renforced latc epoyee known
to te grand ury a NK S and AE
28) t wa furter a part of te cee and artfce
tat on or about October 20 20 te defendant VGENIY
BOGAHEV and coconprator known and unknown to te grand
ury ued te frauduenty obtaned onne bankng credenta
to faley repreent to N Bank tat Defendant and co
conprator were peron autorzed to acce te onlne
bankng account of Hayte Renforced atc and to caue or
9
8/12/2019 GameOver Zeus - Pittsburgh Indictment
10/25
Case 2:14-cr-00127-AJS Document 1 Filed 05/19/14 Page 10 of 25
attept to caue the tranfer of fund out of Hayte
Renforced atc' bank account antaned wth NC Bank
2) It wa further a part of the chee and artfce
that on or about October 20 2011, n the Wetern Dtrct of
ennyvana the defendant EVGENIY BOGACHEV and co
conprator known and unknown to the grand jury frauduenty
caued the eectronc tranfer of $18234.3 fro a NC Bank
account beongng to Hayte Renforced atc to a oney
ue' bank account under the nae of Lynch Enterpre LLC and
antaned at SunTrut Bank n Atanta Georga
30) It wa further a part of the chee and artfce
that on or about October 21 20 the defendant EVGENIY
BOGACHEV and coconprator known and unknown to the grand
jury ued the oney ue aocated wth Lynch Enterpre LLC
to execute the eectronc tranfer of the toen fund to bank
account ocated n Great Brtan
0
8/12/2019 GameOver Zeus - Pittsburgh Indictment
11/25
Case 2:14-cr-00127-AJS Document 1 Filed 05/19/14 Page 11 of 25
..
_ _ _ _. -
COU ONE
(Conspiracy)
The grad jury further charge:
31) aragraph 1 through 30 above of the troducto
ad Scheme ad Artfce are hereby reaeged ad corporated by
referece here a f fuy tated
32) From ad aroud September 2011, the exact date
beg ukow to the grad jury ad cotug to the preet
the Weter Dtrct of eyvaa ad eewhere the
defedat EVGENIY BOGACHEV kowgy ad wfuy dd
copre combe cofederate ad agree wth other pero
kow ad ukow to the grad jury to commt the foowg
offee agat the Uted State:
a) to tetoay acce a computer wthout
authorzato ad exceedg authorzato ad thereby obta
or attempt to obta formato from a protected computer
whch offee wa commtted furtherace of a crma act
voato of Tte 18 Uted State Code Secto 1343 ad
1344 ad wa commtted for the purpoe of prvate faca
ga voato of Tte 8 Uted State Code Secto
1030 a) (2) C) ad 103 0 c) (2) B) ;
b) to kowgy caue the tramo of a program
formato code ad commad ad a a reut of uch
coduct tetoay caue damage ad attempted to caue
damage wthout authorzato to a protected computer ad the
offee dd caue ad f competed woud have caued damage
1
8/12/2019 GameOver Zeus - Pittsburgh Indictment
12/25
Case 2:14-cr-00127-AJS Document 1 Filed 05/19/14 Page 12 of 25
affectng 0 or ore protected coputer durng a oneyear
perod n voaton of Tte 8 Unted State Code Secton
030 (a) (5) (A) and 030 (c) (4) (B) ;
(c)to deve and ntend to deve a chee and
artf ce to defraud bunee and ndvdual and to obtan
oney fro thee bune e' and ndvdual' bank account and
property that confdental peronal and fnancal
nforaton by ean of atera fale and fraudulent
pretene repreentaton and proe and for purpoe of
executng uch chee and artfce to trant and caue to be
trantted by ean of wre councaton n ntertate and
foregn coerce certan wrtng gn gnal and
pcture whch affected fnanca nttuton n volaton of
Ttle 8 Unted State Code Secton 343;
(d) to knowngy execute and attept to execute a
chee and artfce to defraud a fnanca nttuton and to
obtan any of the oney fund credt aet ecurte
and other property owned by and under the cutody and contro
of a fnancal nttuton by ean of ateral fae or
fraudulent pretene repreentaton and proe n volaton
of Tte 8 Unted State Code Secton 344; and
(e) to knowngly engage and attept to engage n
onetary tranacton affectng ntertate and foregn coerce
by and through a fnanca nttuton n crnaly derved
property of a value greater than $0000 ad property beng
12
8/12/2019 GameOver Zeus - Pittsburgh Indictment
13/25
Case 2:14-cr-00127-AJS Document 1 Filed 05/19/14 Page 13 of 25
derived from a specific unlawful activity that is an act that
is indictable under Title 18 United States Code Sections 1343
and 1344 as more particularly described in paragraphs 1 through
23 and paragraphs 25 through 29 knowing that the property
involved in the financial transactions represented the proceeds
of some form of unlawful activity in violation of Title 18
United States Code Section 1957 (a)
OVERT ACTS
33) In furtherance of the conspiracy and to effect
the objects of the conspiracy the defendant EVGENY BOGACHEV
and other persons both known and unknown to the grand jury did
commit and cause to be committed the following overt acts
among others
elsewhere:
in the Western District of Pennsylvania and
(a) On or about October 18 2011 the defendant and
co-conspirators sent to an employee at Haysite Reinforced
Plastics a phishing email purporting to be from NACHA and
fraudulently inducing the employee to click on a malicious
hyperlink which was falsely represented as a legitimate link
(b) On or about October 18 2011 the defendant and
co-conspirators
authorization
Plastics
caused
on a
malware to be installed without
computer used by Haysite Reinforced
13
8/12/2019 GameOver Zeus - Pittsburgh Indictment
14/25
Case 2:14-cr-00127-AJS Document 1 Filed 05/19/14 Page 14 of 25
c On or about October 20 2011 the defendant and
coconspirators used the maware to hijack a computer session of
an empoyee at Haysite Reinforced Pastics and inserted a fake
onine banking website
d On or about October 20 2011 the defendant and
coconspirators used the maware and the fake onine banking
website to request different empoyees at Haysite Reinforced
Pastics to enter their onine banking credentias
e On or about October 20 2011 the defendant and
coconspirators used the instaed maware to obtain the onine
banking credentias of three Haysite Reinforced Pastics
empoyees known to the grand jury as NK SC and A
f On or about October 20 2011 the defendant and
coconspirators used the frauduenty obtained onine banking
credentias to fasey represent to PNC Bank that defendant and
his coconspirators were authorized to access onine banking
accounts of Haysite Reinforced Pastics
g On or about October 20 2011 the defendant and
coconspirators caused or attempted to cause the transfer of
funds out of the Haysite Reinforced Pasics' bank accounts
maintained with PNC Bank
h On or about October 20 2011 the defendant and
coconspirators caused the transfer of $19 8234 93 from a PNC
Bank account beonging to Haysite Reinforced Pastics to a money
14
8/12/2019 GameOver Zeus - Pittsburgh Indictment
15/25
Case 2:14-cr-00127-AJS Document 1 Filed 05/19/14 Page 15 of 25
mues bank account under the name of Lynch Enterprises LLC that
was maintained at Sunrust Bank in Atanta Georgia
() On or about October 0 011 the defendant and
co-consprators caused the transfer of $175756 1 from a PNC
Bank account beongng to Hayste Reinforced Plastcs to a bank
account for a ewery store that was mantaned at Herad
Natona Bank n New York New York
() On or about October 1 011 the defendant and
co-consprators used a money mue to cause the transfer of
$8.00 whch was fraudulently obtaned from Hayste
Reinforced Pastcs and PNC Bank from a Sunrust Bank account
belongng to Lynch Enterprises LLC to a bank account located n
Great Brtain
(k) On or about October 1 011 the defendant and
co-conspirators used a money mule to cause the transfer
$88550 00 whch was frauduently obtaned from Haysite
Reinforced Plastcs and PNC Bank from a Sunrust Bank account
beonging to Lynch Enterprses LLC to a bank account located in
Great Britan.
n iolaton of itle 18 United States Code Secton
371
15
8/12/2019 GameOver Zeus - Pittsburgh Indictment
16/25
Case 2:14-cr-00127-AJS Document 1 Filed 05/19/14 Page 16 of 25
COU TO
(Wire Fraud)
he grand ury further charges:
34) aragraphs 1 through 33 aboe are hereby
realleged and incorporated by reference herein as if fully
stated
3) On or about October 18, 2011, in the estern
District of ennsylania and elsewhere the defendant EVGENIY
BOGACHEV for the purpose of executing and attempting to
execute the scheme and artifice to deraud and to obtain
property from others that is control of a computer and banking
credentials by means of material false and fraudulent
pretenses representations and promises well knowing at the
time that the pretenses representations and promises were
false and fraudulent when made as set orth aboe in aragraphs
1 through 1 and paragraphs 2 through 26 knowingly did
transmit and cause to be transmitted in interstate and foreign
commerce by means of a wire communication from the I address
188 121 144 240, which was then located in the Islamic Republic
of Iran to the I address 12 168 010, which was then located
in Erie ennsylania and belonged to Haysite Reinforced
lastics certain writings signs signals and pictures that
is a phishing email that falsely purported to be from NACHA
that falsely represented that an ACH paent had been canceled
and that falsely represented that a hyperlink within the email
16
8/12/2019 GameOver Zeus - Pittsburgh Indictment
17/25
Case 2:14-cr-00127-AJS Document 1 Filed 05/19/14 Page 17 of 25
wa a egiimae ink conaining informaion concerning a
canceed ACH paymen
n vioaion of Tie 18 Unied Sae Code, Secion
343
8/12/2019 GameOver Zeus - Pittsburgh Indictment
18/25
Case 2:14-cr-00127-AJS Document 1 Filed 05/19/14 Page 18 of 25
CO THREE
(Cmputer Frud)
The grand jury further charges:
36) Paragraphs 1 through 33 above are hereby
reaeged and incorporated by reference herein as if fuy
stated
37) On or about October 0 011 within the Western
District of Pennsyvania the defendant EVGENY BOGACHEV
intentionay accessed a computer beonging to Haysite
Reinforced Pastics without authorization and thereby obtained
information that is onine banking credentias of Haysite
Reinforced Pastics from empoyees known to the grand jury as
NK SC and AE from a protected computer and the offense was
committed for purpose of private financia gain and was
committed in furtherance of a crimina act in vioation of the
aws of the United States that is Tite 18 United States
Code Sections 1343 and 1344
n vioation of Tite 18 United States Code Sections
103 0 a) ) and 1 030 c) ) B) .
18
8/12/2019 GameOver Zeus - Pittsburgh Indictment
19/25
Case 2:14-cr-00127-AJS Document 1 Filed 05/19/14 Page 19 of 25
COTS FOUR THROUGH TWELVE
(Bank Fraud)
he grand ry frther charges:
38) aragraphs 1 throgh 33 above are hereby
reaeged and incorporated by reference heren as if fy
stated
39) n or abot the dates set forth beow in the
District of Western ennsyvania and esewhere the defendant
EVGENY BGACHEV having devised and intended to devise the
scheme and artfce to defrad NC Bank and to obtan moneys and
fnds owned by and nder the cstody and contro of NC Bank by
means of matera fase and fradent pretenses
representatons and promses we knowng at the tme that the
pretenses representatons and promises wod be and were fase
and fradent when made dd knowngy execte and attempt to
execte the foregong scheme and artifice by casng and
attemptng to case the transfer of fnds with each transfer
and attempted transfer being a separate cont of ths
ndictment as described beow
Count On or about Date Execution
he transfer of $98, 23493 ot of aNC Bank accont beonging to Hayste
Renforced astcs to an accont4 ctober 20, 2011 elonging to Lynch Enterprises LLC
he transfer of $175, 756 91 ot of a
NC Bank accont beongng to Haysite
ctober 20, 2011 Renforced astcs to an accont5 elongng to R&R Jeweers
ctober 20, 20 he attempted transfer of $39, 84 27
6 ot of a NC Bank accont beongng
19
8/12/2019 GameOver Zeus - Pittsburgh Indictment
20/25
Case 2:14-cr-00127-AJS Document 1 Filed 05/19/14 Page 20 of 25
to ayste Refored Pasts
Te attempted trasfer of $494 58
Otober 20 20 out of a PNC Bak aout beogg
7 to ayste Refored Pasts
Te attempted trasfer of $4982 5
out of a PNC Bak aout beogg
Otober 20 20 to ayste Refored Pasts8 Pasts
Te attempted trasfer of $984 4
Otober 20 20 out of a PNC Bak aout beogg
9 to ayste Refored Pasts
Te attempted trasfer of $4924
Otober 20 20 out of a PNC Bak aout beogg
0 to ayste Refored Pasts
Te attempted trasfer of $4 975 2
Otober 20 20 out of a PNC Bak aout beogg
to ayste Refored Pasts
Te attempted trasfer of $75 50Otober 20 20 out of a PNC Bak aout beogg
2 to ayste Refored Pasts
I voato of Tte 8 Uted States Code Seto
44
20
8/12/2019 GameOver Zeus - Pittsburgh Indictment
21/25
8/12/2019 GameOver Zeus - Pittsburgh Indictment
22/25
Case 2:14-cr-00127-AJS Document 1 Filed 05/19/14 Page 22 of 25
COT FOURTEEN
(Money Laundering)
Te grand ury furter carges
42) Paragraps troug 33 and paragraps 38 troug
3 above are ereby reaeged and incorporated by reference
erein as if fuy stated
43) On or about October 2 20 in te Western
District of Pennsyvania and esewere te defendant EVGENIY
BOGACHEV did knowingy engage in a monetary transaction
affecting interstate and foreign commerce in criminay derived
property wit a vaue greater tan $0000 wic property was
derived from specified unawfu activity in tat te defendant
EVGENIY BOGACHEV caused funds frauduenty obtained from
Haysite Reinforced Pastics and PNC Bank as carged in Count
Four in te amount of $88550 00 to be witdrawn and
transferred by wire from an account in te name of ync
Enterprises LLC maintained at SunTrust Bank to an account in
te name of an individua known to te grand ury as G A P
maintained at Nationa Westminster Bank PLC in London Great
Britain knowing tat te transaction invoved funds tat were
derived from a crimina offense wen in fact said funds were
derived from vioations of Tite 8 nited States Code Section
344
In vioation of Tite 8 nited States Code Sections
5 (a) and 5 6 (i) () (B)
22
8/12/2019 GameOver Zeus - Pittsburgh Indictment
23/25
Case 2:14-cr-00127-AJS Document 1 Filed 05/19/14 Page 23 of 25
.FORFEITURE ALLEGATIONS
44) The grand jury reaeges and incorporates y
reference the aegations contained in Counts One through
Fourteen of this ndictment for the purpose of aeging criminal
forfeiture pursuant to Tite 8 United States Code Sections
982 (a) () 982 (a) (2) (A) 982 (a) (2) (B) 982 (a) (4) and
98 (a) () (C) Tite 28 United States Code Section 24 (c) and
Tite 2 United States Code Section 853 (p)
45) As a resut of the commission of the vioations
charged in Counts One and Three the defendant EVGENY
BOGACHEV did acquire property that constitutes and is derived
from the proceeds otained directly and indirecty from such
vioation therey sujecting said property to forfeiture to the
United States of America pursuant to Tite 8 United States
Code Section 982 (a) (2) (B)
4) As a resut of the commission of the vioations
charged in Counts Four through Teve the defendant EVGENY
BOGACHEV did acquire property that constitutes and is derived
from the proceeds otained directly and indirectly from such
vioation therey sujecting said property to forfeiture to the
United States of America pursuant to Title 8 United States
Code Section 982 (a) (2) (A)
47) As a resut of the commission of the vioations
charged in Counts Thirteen through Fouteen the defendant
23
8/12/2019 GameOver Zeus - Pittsburgh Indictment
24/25
Case 2:14-cr-00127-AJS Document 1 Filed 05/19/14 Page 24 of 25
EVGENIY BOGACHEV did acquire property rea or persona that
was inoled in such iolation or was traceabe to such property
thereby sub ecting said property to forfeiture to the nited
States of America pursuant to Tite 18 nited States Code
Section 82 (a) (1)
48) As a result of the commission of the ioations
charged in Counts One and wo the defendant EVGENIY BOGACHEV
did acquire property that constitutes and is deried from the
proceeds obtained directy and indirectly from such ioation
thereby sub ecting said property to forfeiture to the nited
States of America pursuant to itle 18 nited States Code
Section 81 (a) (1) (C) and itle 28 nited States Code Section
2461 (c) .
4) If through any acts or omission by the defendant
EVGENIY BOGACHEV any or a of the property described in
paragraphs 44 to 48 aboe (hereinafter the "Subect Properties)
(a) Cannot be located upon the eercise of duediligence
(b) Has been transferred sold to or deposited with
a third person
(c) Has been paced beyond the urisdiction of the
Court
(d) Has been substantially diminished in alue or
(e) Has been comminged with other property whichcannot be subdiided without difficulty
24
8/12/2019 GameOver Zeus - Pittsburgh Indictment
25/25
States AttorneyNO 34524
Case 2:14-cr-00127-AJS Document 1 Filed 05/19/14 Page 25 of 25
the nted States ntends to seek forfeture of any other
property of the defendant up to the vaue of the Subect
Propertes forfetabe above pursuant to 28 S C Secton
2461 (c) whch ncorporates Tte 21 nted States Code
Secton 853 (p)
A True B
25