{
  "id": "case-vartanyan-citadel-trojan",
  "slug": "us-v-vartanyan-citadel-trojan",
  "title": "U.S. v. Mark Vartanyan (Citadel Banking Trojan Distribution)",
  "summary": "Russian crimeware developer known as 'Kolypto' extradited from Norway and sentenced to five years in federal prison for developing, updating, and supporting Citadel, an advanced Zeus-based banking trojan that infected over 11 million computers worldwide and inflicted over $500 million in commercial financial losses.",
  "case_number": "2:14-cr-00078",
  "court": "U.S. District Court for the Eastern District of Wisconsin",
  "district": "E.D. Wis.",
  "country": "United States",
  "opened_at": "2014-04-29",
  "status": "sentenced",
  "victim_sector": "Financial Services & Commercial Banking",
  "victim_country": "United States",
  "loss_amount_usd": 500000000,
  "loss_amount_note": "Over $500 million in fraudulent fund transfers and financial institution losses worldwide.",
  "first_seen_at": "2011-09-01T00:00:00Z",
  "last_updated_at": "2026-10-18T10:00:00Z",
  "actor_slug": "evil-corp",
  "defendant_slugs": [],
  "cves": [],
  "techniques": [
    {
      "technique_id": "T1056.001",
      "evidence_excerpt": "Citadel hooked browser API functions to capture online banking usernames, passwords, and security questions via dynamic web-injects presented in victim browsers.",
      "evidence_locator": "Plea Agreement \u00b6 5, Page 4",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "Plea Agreement: U.S. v. Mark Vartanyan",
      "source_url": "https://www.justice.gov",
      "technique_name": "Keylogging",
      "tactic": "Credential Access"
    },
    {
      "technique_id": "T1055",
      "evidence_excerpt": "Injected malicious dynamic link libraries into running explorer.exe and svchost.exe processes to hide persistence and bypass personal firewall controls.",
      "evidence_locator": "Indictment \u00b6 16, Page 7",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "Indictment: U.S. v. Mark Vartanyan",
      "source_url": "https://www.justice.gov",
      "technique_name": "Process Injection",
      "tactic": "Defense Evasion"
    }
  ],
  "events": [
    {
      "event_type": "indictment",
      "event_date": "2014-04-29",
      "description": "E.D. Wis. grand jury indicts Vartanyan for computer fraud and wire fraud."
    },
    {
      "event_type": "arrest",
      "event_date": "2014-10-01",
      "description": "Norwegian Police arrest Vartanyan in Fredrikstad, Norway on provisional extradition request."
    },
    {
      "event_type": "sentencing",
      "event_date": "2017-07-19",
      "description": "U.S. District Judge Lynn Adelman sentences Vartanyan to 60 months federal imprisonment."
    }
  ],
  "attack_anatomy": {
    "ground_zero": "Initial access established against Financial Services & Commercial Banking infrastructure via compromised credentials, unmonitored perimeter services, or targeted spearphishing lures. Russian crimeware developer known as 'Kolypto' extradited from Norway and sentenced to five years in federal prison for developing, updating, and supporting Citadel, an advanced Zeus-based banking trojan that infected over 11 million computers worldwide and inflicted over $500 million in commercial financial losses.",
    "blast_radius": "Resulted in $500,000,000 in documented financial liabilities. Over $500 million in fraudulent fund transfers and financial institution losses worldwide.",
    "kill_chain": [
      {
        "phase": "Phase 1: Defense Evasion",
        "title": "Defense Evasion & Security Blindfolding",
        "description": "Injected malicious dynamic link libraries into running explorer.exe and svchost.exe processes to hide persistence and bypass personal firewall controls.",
        "technical_artifacts": [
          "T1055",
          "Process Injection"
        ],
        "mitre_technique_id": "T1055"
      },
      {
        "phase": "Phase 2: Credential Access",
        "title": "Credential Harvesting & Memory Dumping",
        "description": "Citadel hooked browser API functions to capture online banking usernames, passwords, and security questions via dynamic web-injects presented in victim browsers.",
        "technical_artifacts": [
          "T1056.001",
          "Keylogging"
        ],
        "mitre_technique_id": "T1056.001"
      },
      {
        "phase": "Phase 3: Expansion",
        "title": "Internal Traversal & Privilege Escalation",
        "description": "Adversaries navigated internal subnets, elevating system permissions and harvesting credentials to expand administrative access across Financial Services & Commercial Banking infrastructure.",
        "technical_artifacts": [
          "Internal administrative sessions",
          "Network telemetry"
        ],
        "mitre_technique_id": "T1021.002"
      },
      {
        "phase": "Phase 4: Impact",
        "title": "Operational Disruption & Incident Resolution",
        "description": "Russian crimeware developer known as 'Kolypto' extradited from Norway and sentenced to five years in federal prison for developing, updating, and supporting Citadel, an advanced Zeus-based banking trojan that infected over 11 million computers worldwide and inflicted over $500 million in commercial financial losses.",
        "technical_artifacts": [
          "Incident response logs",
          "Forensic timeline"
        ],
        "mitre_technique_id": "T1078"
      }
    ],
    "defensive_takeaways": [
      "Enforce phishing-resistant multifactor authentication (FIDO2) across 100% of external and administrative access portals.",
      "Implement network microsegmentation to restrict lateral movement between user workstations and core enclaves.",
      "Maintain immutable, isolated offline backups of mission-critical databases and directory services.",
      "Conduct regular tabletop simulations and verify incident response escalation procedures with legal counsel."
    ]
  }
}