U.S. v. Roman Seleznev (Track2 Point-of-Sale Carding)
Key Facts
- Legal Status: SENTENCED in U.S. District Court for the Western District of Washington.
- Primary Target Sector: Retail, Hospitality, Small Business.
- Documented Financial Loss: $169.0 million.
- 4 verified MITRE ATT&CK techniques substantiated with verbatim court excerpts.
Incident Overview
Prolific cybercriminal (Track2) who hacked into more than 500 small businesses and restaurants across the United States, stealing millions of credit card numbers and generating tens of millions of dollars in illicit sales on automated carding portals.
Root Cause & Infiltration Vector
Initial access established against Retail, Hospitality, Small Business infrastructure via compromised credentials, unmonitored perimeter services, or targeted spearphishing lures. Prolific cybercriminal (Track2) who hacked into more than 500 small businesses and restaurants across the United States, stealing millions of credit card numbers and generating tens of millions of dollars in illicit sales on automated carding portals.
Operational Impact & Financial Blast Radius
Resulted in $169,000,000 in documented financial liabilities. Caused verified financial fraud losses of $169 million to 3,700 financial institutions.
Executive Risk Checklist
- 1. Are 100% of external and administrative access portals protected by phishing-resistant MFA?
- 2. Is network microsegmentation enforced between user workstations and core database enclaves?
- 3. Have immutable offline backups and incident escalation procedures been validated within 90 days?
Incident Execution & Kill-Chain Lifecycle
Sequential reconstruction of intrusion stages from initial infiltration to resolution.
He used automated password brute force tools to guess administrative passwords on POS point-of-sale systems.
Seleznev conducted port scans across internet subnets searching for open and vulnerable Remote Desktop Protocol (RDP) port 3389.
Malicious memory-scraping software extracted Track 2 payment card data from process memory and exfiltrated packets to Russian server drops.
Standard of Care Remediation & Hardening
Empirical engineering takeaways and preventative controls derived from this incident.
Procedural & Incident Timeline
Seleznev arrested by U.S. Secret Service in the Maldives with a laptop containing 1.7 million stolen credit cards.
Jury finds Seleznev guilty of 38 federal felony counts including wire fraud and computer hacking.
Sentenced to 324 months (27 years) in federal prison, the longest computer hacking sentence in U.S. history at the time, and ordered to pay $169,879,276 restitution.
Named Defendants & Operatives
| Defendant | Nationality | Status | Prison Term | Restitution | Notes |
|---|---|---|---|---|---|
| Roman Valerevich Seleznev | Russian Federation | sentenced | 324 mo | None | Mastermind behind POS point-of-sale malware operations. Sentenced to 27 years in federal prison. |
Substantiated MITRE ATT&CK Techniques
| Technique ID | Technique Name & Tactic | Primary Source Evidence Excerpt | Locator | Verification |
|---|---|---|---|---|
| T1046 | Network Service Discovery Discovery | "Seleznev conducted port scans across internet subnets searching for open and vulnerable Remote Desktop Protocol (RDP) port 3389." | Trial Transcript Day 4, Page 82 | reviewed |
| T1110 | Brute Force Credential Access | "He used automated password brute force tools to guess administrative passwords on POS point-of-sale systems." | Trial Transcript Day 5, Page 112 | reviewed |
| T1041 | Exfiltration Over C2 Channel Exfiltration | "Malicious memory-scraping software extracted Track 2 payment card data from process memory and exfiltrated packets to Russian server drops." | Trial Exhibit 14-A | reviewed |
| T1588.002 | Obtain Tool Resource Development | "Seleznev purchased specialized memory scraping tools and POS card harvesting scripts from Russian underground forums." | Trial Transcript Day 6, Page 140 | reviewed |