U.S. v. Maksim Boiko (QQAAZZ Cyber Laundering Network)
Key Facts
- Legal Status: SENTENCED in U.S. District Court for the Western District of Pennsylvania.
- Primary Target Sector: Financial Institutions, Ransomware Victims.
- Documented Financial Loss: $20.0 million.
- 1 verified MITRE ATT&CK techniques substantiated with verbatim court excerpts.
Incident Overview
Russian cryptocurrency trader and Instagram influencer who operated as a high-level money launderer for QQAAZZ, an all-in-one cashout network servicing Dridex, Trickbot, and BitPaymer ransomware gangs.
Root Cause & Infiltration Vector
Initial access established against Financial Institutions, Ransomware Victims infrastructure via compromised credentials, unmonitored perimeter services, or targeted spearphishing lures. Russian cryptocurrency trader and Instagram influencer who operated as a high-level money launderer for QQAAZZ, an all-in-one cashout network servicing Dridex, Trickbot, and BitPaymer ransomware gangs.
Operational Impact & Financial Blast Radius
Resulted in $20,000,000 in documented financial liabilities. Laundered tens of millions of dollars stolen from corporate victims via hundreds of dummy shell bank accounts across Europe.
Executive Risk Checklist
- 1. Are 100% of external and administrative access portals protected by phishing-resistant MFA?
- 2. Is network microsegmentation enforced between user workstations and core database enclaves?
- 3. Have immutable offline backups and incident escalation procedures been validated within 90 days?
Incident Execution & Kill-Chain Lifecycle
Sequential reconstruction of intrusion stages from initial infiltration to resolution.
Operatives established unauthorized footholds within target Financial Institutions, Ransomware Victims environments through stolen credentials or perimeter appliance exploitation.
Adversaries navigated internal subnets, elevating system permissions and harvesting credentials to expand administrative access across Financial Institutions, Ransomware Victims infrastructure.
Russian cryptocurrency trader and Instagram influencer who operated as a high-level money launderer for QQAAZZ, an all-in-one cashout network servicing Dridex, Trickbot, and BitPaymer ransomware gangs.
Standard of Care Remediation & Hardening
Empirical engineering takeaways and preventative controls derived from this incident.
Procedural & Incident Timeline
Boiko arrested in Miami, Florida, with $3.8 million in seized cryptocurrency.
Pleads guilty to conspiracy to commit money laundering in federal court in Pittsburgh.
Sentenced to time served and ordered to forfeit over $3.8 million in illicit cryptocurrency.
Named Defendants & Operatives
| Defendant | Nationality | Status | Prison Term | Restitution | Notes |
|---|---|---|---|---|---|
| Maksim Boiko | Russian Federation | sentenced | Pending | $3 | QQAAZZ cybercrime laundering network conspirator; sentenced to time served and $3.8M forfeiture. |
Substantiated MITRE ATT&CK Techniques
| Technique ID | Technique Name & Tactic | Primary Source Evidence Excerpt | Locator | Verification |
|---|---|---|---|---|
| T1090 | Proxy Command and Control | "QQAAZZ used hundreds of bank accounts opened in the names of fake shell companies to rapidly layer stolen wire funds before converting them into Bitcoin." | Indictment ¶ 16, Page 9 | reviewed |