{
  "id": "case-zhukov-methbot-ad-fraud",
  "slug": "us-v-zhukov-methbot-3ve-ad-fraud",
  "title": "U.S. v. Aleksandr Zhukov (Methbot Digital Ad Fraud Scheme)",
  "summary": "Russian national and self-styled 'King of Fraud' Aleksandr Zhukov convicted after federal trial in Brooklyn and sentenced to 10 years in prison for running Methbot, a massive botnet and server farm that spoofed billions of digital video ad impressions, looting $36 million from American digital advertising networks.",
  "case_number": "1:18-cr-00633",
  "court": "U.S. District Court for the Eastern District of New York",
  "district": "E.D.NY.",
  "country": "United States",
  "opened_at": "2018-11-06",
  "status": "sentenced",
  "victim_sector": "Digital Advertising & Online Media",
  "victim_country": "United States",
  "loss_amount_usd": 36000000,
  "loss_amount_note": "Direct commercial fraud losses exceeding $36 million inflicted on digital publishers and advertising agencies.",
  "first_seen_at": "2014-09-01T00:00:00Z",
  "last_updated_at": "2026-10-18T10:00:00Z",
  "actor_slug": "evil-corp",
  "defendant_slugs": [],
  "cves": [],
  "techniques": [
    {
      "technique_id": "T1090",
      "evidence_excerpt": "Defendants rented hundreds of commercial data center servers in Dallas and Amsterdam, leasing IP addresses fraudulently assigned to U.S. residential ISPs to route automated browser sessions.",
      "evidence_locator": "Indictment \u00b6 18, Page 7",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "Indictment: U.S. v. Zhukov et al.",
      "source_url": "https://www.justice.gov",
      "technique_name": "Proxy",
      "tactic": "Command and Control"
    },
    {
      "technique_id": "T1059.001",
      "evidence_excerpt": "Programmed customized headless browser engines executing Node.js scripts that mimicked human mouse movements, pauses, and video playback behaviors.",
      "evidence_locator": "Trial Transcript Day 6, Page 42",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "DOJ Press Release: Methbot Mastermind Sentenced to 10 Years",
      "source_url": "https://www.justice.gov",
      "technique_name": "PowerShell",
      "tactic": "Execution"
    }
  ],
  "events": [
    {
      "event_type": "indictment",
      "event_date": "2018-11-06",
      "description": "E.D.N.Y. grand jury indicts Zhukov and seven co-conspirators for wire fraud and computer intrusion."
    },
    {
      "event_type": "arrest",
      "event_date": "2018-11-20",
      "description": "Bulgarian authorities arrest Zhukov in Varna; extradited to New York in January 2019."
    },
    {
      "event_type": "sentencing",
      "event_date": "2021-11-10",
      "description": "U.S. District Judge Eric Komitee sentences Zhukov to 10 years prison and $31.8M restitution."
    }
  ],
  "attack_anatomy": {
    "ground_zero": "Initial access established against Digital Advertising & Online Media infrastructure via compromised credentials, unmonitored perimeter services, or targeted spearphishing lures. Russian national and self-styled 'King of Fraud' Aleksandr Zhukov convicted after federal trial in Brooklyn and sentenced to 10 years in prison for running Methbot, a massive botnet and server farm that spoofed billions of digital video ad impressions, looting $36 million from American digital advertising networks.",
    "blast_radius": "Resulted in $36,000,000 in documented financial liabilities. Direct commercial fraud losses exceeding $36 million inflicted on digital publishers and advertising agencies.",
    "kill_chain": [
      {
        "phase": "Phase 1: Execution",
        "title": "Host Execution & Payload Staging",
        "description": "Programmed customized headless browser engines executing Node.js scripts that mimicked human mouse movements, pauses, and video playback behaviors.",
        "technical_artifacts": [
          "T1059.001",
          "PowerShell"
        ],
        "mitre_technique_id": "T1059.001"
      },
      {
        "phase": "Phase 2: Expansion",
        "title": "Internal Traversal & Privilege Escalation",
        "description": "Adversaries navigated internal subnets, elevating system permissions and harvesting credentials to expand administrative access across Digital Advertising & Online Media infrastructure.",
        "technical_artifacts": [
          "Internal administrative sessions",
          "Network telemetry"
        ],
        "mitre_technique_id": "T1021.002"
      },
      {
        "phase": "Phase 3: Impact",
        "title": "Operational Disruption & Incident Resolution",
        "description": "Russian national and self-styled 'King of Fraud' Aleksandr Zhukov convicted after federal trial in Brooklyn and sentenced to 10 years in prison for running Methbot, a massive botnet and server farm that spoofed billions of digital video ad impressions, looting $36 million from American digital advertising networks.",
        "technical_artifacts": [
          "Incident response logs",
          "Forensic timeline"
        ],
        "mitre_technique_id": "T1078"
      }
    ],
    "defensive_takeaways": [
      "Enforce phishing-resistant multifactor authentication (FIDO2) across 100% of external and administrative access portals.",
      "Implement network microsegmentation to restrict lateral movement between user workstations and core enclaves.",
      "Maintain immutable, isolated offline backups of mission-critical databases and directory services.",
      "Conduct regular tabletop simulations and verify incident response escalation procedures with legal counsel."
    ]
  }
}