Target Sector: Financial Services & Banking
Court filings, technical advisories, and SEC Form 8-K enforcement disclosures documenting cyber intrusions against organizations in Financial Services & Banking.
Key Facts
- 34 documented prosecution and advisory matters targeting Financial Services & Banking.
- Cumulative reported financial losses exceed $20.0 billion.
- 15 of 34 cases reached conviction, guilty plea, or final sentencing.
- Tracked actors include LockBit Ransomware Group, Evil Corp, Lazarus Group, Wizard Spider.
Documented Incidents (34)
U.S. v. Khoroshev et al. (LockBit Ransomware Operation)
Comprehensive global law enforcement takedown (Operation Cronos) of LockBit ransomware infrastructure, unmasking creator Dmitry Khoroshev (LockBitSupp) and multiple active affiliates who extorted over $500 million from thousands of victims.
U.S. v. Yakubets & Turashev (Evil Corp / Dridex Banking Malware)
Leader and core administrator of Evil Corp charged with deploying Bugat/Dridex banking malware and ransomware, stealing dozens of millions of dollars from bank accounts of municipalities, school districts, and businesses.
U.S. v. Park Jin Hyok (Lazarus Group / Chosun Expo)
Department of Justice charges North Korean state-sponsored programmer with the 2014 Sony Pictures hack, the 2017 global WannaCry ransomware outbreak, and the $81 million Bangladesh Bank cyber heist.
U.S. v. Albert Gonzalez (TJX & Heartland Payment Systems)
Mastermind of the largest credit card theft operation in history at the time, hacking TJX Companies, BJ's Wholesale Club, OfficeMax, and Heartland Payment Systems, stealing over 130 million payment cards.
U.S. v. Andrei Tyurin (JPMorgan Chase Data Breach)
Russian hacker who penetrated JPMorgan Chase and eleven other major U.S. financial institutions and media companies, stealing personal data belonging to over 100 million customers to fuel securities pump-and-dump schemes.
U.S. v. Paige Thompson (Capital One Cloud Breach)
Former Seattle cloud engineer who identified misconfigured web application firewalls to gain unauthorized access to Capital One's Amazon Web Services storage buckets, exfiltrating 106 million customer credit card applications.
U.S. v. Anatoly Legkodymov (Bitzlato Cryptocurrency Laundering)
Founder of Hong Kong-registered cryptocurrency exchange Bitzlato charged with laundering over $700 million in ransomware and darknet market illicit proceeds, serving as a primary financial conduit for Hydra Market.
Operation Cookie Monster (Genesis Market Takedown)
Coordinated multinational takedown of Genesis Market, the world's most prominent illicit broker of stolen digital browser fingerprints, cookies, and compromised account credentials.
U.S. v. Minh Quoc Nguyen (ChipMixer Cryptocurrency Mixer)
Operator of ChipMixer, one of the dark web's largest unlicensed cryptocurrency mixing services, charged with laundering more than $3 billion in Bitcoin associated with ransomware, North Korean state hackers, and darknet drug markets.
U.S. v. Alla Witte & Vladimir Dunaev (Trickbot Malware Group)
Key software developers and coders of the transnational Trickbot cybercrime group charged with infecting millions of victim computers with banking trojans and facilitating Conti/Ryuk ransomware deployments against hospitals.
U.S. v. Marcus Hutchins (Kronos Banking Malware)
British malware researcher who previously halted the global WannaCry ransomware outbreak charged with authoring the Kronos banking trojan and UPAS kit years earlier as a teenager.
U.S. v. Aleksandr Brovko (Botnet Parsing & Credential Sales)
Russian national who developed automated scripts to parse botnet logs, extracting financial information and account credentials from thousands of victim computers and marketing them on cybercrime forums.
U.S. v. Sergey Medvedev et al. (Infraud Organization)
Global cybercrime enterprise operating under the slogan 'In Fraud We Trust' with over 10,000 members, trafficking in stolen identities, counterfeit documents, compromised credit cards, and banking trojans.
U.S. v. Brett Johnson (ShadowCrew Cybercrime Syndicate)
Pioneering cybercriminal known as 'The Original Internet Godfather' who built and operated ShadowCrew, the prototypical dark web marketplace for trafficking in stolen identities and credit card data.
U.S. v. Max Ray Vision (Iceman / CardersMarket)
Former white-hat computer security analyst turned master cybercriminal who operated CardersMarket, hacking rival criminal forums to steal their user databases and monopolize illicit credit card trafficking.
U.S. v. Denis Gennadievich Kulkov (Try2Check Card Checking Service)
Creator of Try2Check, the preeminent criminal card-checking platform that processed tens of millions of card verification requests annually for cybercriminals buying stolen credit cards.
U.S. v. Maksim Boiko (QQAAZZ Cyber Laundering Network)
Russian cryptocurrency trader and Instagram influencer who operated as a high-level money launderer for QQAAZZ, an all-in-one cashout network servicing Dridex, Trickbot, and BitPaymer ransomware gangs.
U.S. v. Artem Radchenko (SEC EDGAR Insider Trading Hack)
Ukrainian cybercriminals who hacked into the SEC EDGAR corporate filing test system, exfiltrating non-public quarterly earnings reports for hundreds of publicly traded companies before their official release to generate $4.1 million in illegal insider trades.
U.S. v. Ilya Lichtenstein & Heather Morgan (Bitfinex Hack & Laundering)
Conviction of Ilya Lichtenstein and Heather Morgan for executing the 2016 hack of the Bitfinex virtual currency exchange, stealing 119,754 Bitcoins (valued at $4.5 billion at arrest), and laundering the funds through complex cryptocurrency mixers and darknet markets.
U.S. v. Wu et al. (Equifax PLA Unit 54th Research Institute)
Four military officers with the Chinese People's Liberation Army (PLA) 54th Research Institute charged with hacking into Equifax networks, stealing trade secrets, and exfiltrating personally identifiable information (PII) of roughly 147 million American citizens.
Target Corporation Point-of-Sale Data Breach (Fazio Mechanical Ingress)
Landmark retail cyberattack where attackers penetrated Target internal corporate networks using stolen billing portal credentials from a third-party refrigeration and HVAC vendor, subsequently deploying BlackPOS memory scraping malware to steal 40 million credit card numbers and 70 million customer records.
State of Florida v. Graham Ivan Clark (Twitter VIP Bitcoin Hijack)
17-year-old hacker orchestrated a spearphishing and social engineering scheme targeting Twitter employees, gaining access to internal administrative customer service tools and hijacking 130 high-profile verified accounts (including Joe Biden, Barack Obama, Elon Musk, and Apple) to promote a fraudulent Bitcoin giveaway.
Snowflake Enterprise Credential Stuffing & Customer Cloud Thefts
Financially motivated threat actor collective UNC5537 systematically infiltrated over 165 corporate customer tenants hosted on Snowflake (including Ticketmaster, Santander Bank, Advance Auto Parts, and LendingTree). Attackers leveraged infostealer malware logs dating back years against enterprise user accounts that lacked multi-factor authentication and IP network allowlists, exfiltrating billions of consumer records.
MOVEit Transfer Mass Zero-Day Extortion Campaign
Mass cyber extortion campaign exploiting a zero-day SQL injection vulnerability (CVE-2023-34362) in Progress Software MOVEit Transfer appliances, exfiltrating personal records of over 90 million individuals across 2,700 organizations without encrypting files.
U.S. v. Fujie Wang et al. (Anthem 78.8M Patient Record Breach)
Chinese state-affiliated threat actors conducted spearphishing campaigns against Anthem health insurance subsidiaries, deploying customized backdoors to penetrate enterprise data warehouses and exfiltrate 78.8 million personal health and identity records.
U.S. v. Evgeniy Mikhailovich Bogachev (GameOver Zeus & CryptoLocker)
Federal indictment of Russian syndicate leader Evgeniy Bogachev for operating GameOver Zeus, a peer-to-peer banking trojan, and CryptoLocker, the first mass-market cryptoviral ransomware, stealing over $100 million with an unprecedented $3 million FBI Rewards for Justice bounty.
Prudential Financial ALPHV BlackCat Cloud Tenant Compromise
Material cybersecurity breach of Fortune 100 life insurer Prudential Financial, wherein ALPHV/BlackCat threat actors breached corporate administrative workstations and accessed cloud tenant data, filed under the four-day SEC Form 8-K Item 1.05 reporting mandate.
First American Financial Title Insurance Cybersecurity Incident
Severe computer intrusion forcing First American Financial Corporation to shut down core title insurance, real estate transaction banking, and closing systems nationwide, causing nationwide mortgage settlement delays, disclosed under SEC Form 8-K Item 1.05.
Log4Shell Ubiquitous Remote Code Execution Crisis (CVE-2021-44228)
Universal zero-day vulnerability in Apache Log4j (Log4Shell) where arbitrary JNDI lookup strings (${jndi:ldap://...}) processed by logger components permitted unauthenticated remote code execution, triggering mass scanning and exploitation across billions of enterprise cloud servers by nation-state actors and ransomware syndicates worldwide.
SEC v. SolarWinds Corp. & CISO Timothy G. Brown (Securities Fraud)
Landmark civil enforcement action brought by the SEC charging SolarWinds and its Chief Information Security Officer with securities fraud and internal accounting control failures, alleging company statements to investors overstated cyber defenses while internal executive communications conceded critical password and perimeter vulnerabilities.
U.S. v. Roman Storm & Alexey Pertsev (Tornado Cash $1B Heist)
Landmark federal criminal indictment in the Southern District of New York against founders of the Tornado Cash cryptocurrency mixer for conspiracy to commit money laundering and sanctions violations, knowingly facilitating over $1 billion in illicit transactions including hundreds of millions stolen by North Korea's state-sponsored Lazarus Group.
Operation Duck Hunt (QakBot Botnet Infrastructure Takedown)
Historic international law enforcement operation led by the FBI that dismantled the notorious QakBot (QBot) modular banking trojan and botnet infrastructure infecting over 700,000 computers worldwide, seizing 52 servers and executing a court-authorized payload to uninstall the malware from victim endpoints.
U.S. v. Mark Vartanyan (Citadel Banking Trojan Distribution)
Russian crimeware developer known as 'Kolypto' extradited from Norway and sentenced to five years in federal prison for developing, updating, and supporting Citadel, an advanced Zeus-based banking trojan that infected over 11 million computers worldwide and inflicted over $500 million in commercial financial losses.
International Sanctions on Aleksandr Ermakov (Medibank Breach)
First joint cyber sanctions package deployed cooperatively by Australia, the United States, and the United Kingdom against Russian national Aleksandr Ermakov for orchestrating the catastrophic 2022 Medibank Private breach, stealing and weaponizing medical files of 9.7 million patients on dark web leak channels after extortion was refused.