U.S. v. Sergey Medvedev et al. (Infraud Organization)
Key Facts
- Legal Status: SENTENCED in U.S. District Court for the District of Nevada.
- Primary Target Sector: Financial Services, Consumer Credit, Retail.
- Documented Financial Loss: $568.0 million.
- 1 verified MITRE ATT&CK techniques substantiated with verbatim court excerpts.
Incident Overview
Global cybercrime enterprise operating under the slogan 'In Fraud We Trust' with over 10,000 members, trafficking in stolen identities, counterfeit documents, compromised credit cards, and banking trojans.
Root Cause & Infiltration Vector
Initial access established against Financial Services, Consumer Credit, Retail infrastructure via compromised credentials, unmonitored perimeter services, or targeted spearphishing lures. Global cybercrime enterprise operating under the slogan 'In Fraud We Trust' with over 10,000 members, trafficking in stolen identities, counterfeit documents, compromised credit cards, and banking trojans.
Operational Impact & Financial Blast Radius
Resulted in $568,000,000 in documented financial liabilities. Caused actual financial losses of over $568 million to financial institutions and cardholders.
Executive Risk Checklist
- 1. Are 100% of external and administrative access portals protected by phishing-resistant MFA?
- 2. Is network microsegmentation enforced between user workstations and core database enclaves?
- 3. Have immutable offline backups and incident escalation procedures been validated within 90 days?
Incident Execution & Kill-Chain Lifecycle
Sequential reconstruction of intrusion stages from initial infiltration to resolution.
Infraud operated escrow systems enabling cybercriminals to buy and sell verified high-balance administrative account credentials.
Adversaries navigated internal subnets, elevating system permissions and harvesting credentials to expand administrative access across Financial Services, Consumer Credit, Retail infrastructure.
Global cybercrime enterprise operating under the slogan 'In Fraud We Trust' with over 10,000 members, trafficking in stolen identities, counterfeit documents, compromised credit cards, and banking trojans.
Standard of Care Remediation & Hardening
Empirical engineering takeaways and preventative controls derived from this incident.
Procedural & Incident Timeline
Medvedev arrested in Bangkok, Thailand, with over 100,000 Bitcoins in digital wallets.
Pleads guilty to RICO conspiracy in federal court in Las Vegas.
Sentenced to 120 months (10 years) in federal prison.
Named Defendants & Operatives
| Defendant | Nationality | Status | Prison Term | Restitution | Notes |
|---|---|---|---|---|---|
| Sergey Medvedev | Russian Federation | sentenced | 120 mo | None | Infraud Organization leader sentenced to 10 years in federal prison. |
Substantiated MITRE ATT&CK Techniques
| Technique ID | Technique Name & Tactic | Primary Source Evidence Excerpt | Locator | Verification |
|---|---|---|---|---|
| T1078 | Valid Accounts Defense Evasion | "Infraud operated escrow systems enabling cybercriminals to buy and sell verified high-balance administrative account credentials." | Indictment ¶ 14, Page 7 | reviewed |