Proxy (T1090): Real Cases
MITRE Definition ↗Key Facts
- ATT&CK Technique Identifier: T1090.
- Tactical Phase: Command and Control.
- Substantiated in 9 primary court prosecution and advisory cases.
- Linked records cite judicial dockets, plea agreements, or federal advisories.
Verified Evidentiary Case Records (9)
U.S. v. Anatoly Legkodymov (Bitzlato Cryptocurrency Laundering)
Founder of Hong Kong-registered cryptocurrency exchange Bitzlato charged with laundering over $700 million in ransomware and darknet market illicit proceeds, serving as a primary financial conduit for Hydra Market.
"Bitzlato operated with negligible anti-money laundering controls, advertising that users could open accounts with no identity verification via Tor."
U.S. v. Minh Quoc Nguyen (ChipMixer Cryptocurrency Mixer)
Operator of ChipMixer, one of the dark web's largest unlicensed cryptocurrency mixing services, charged with laundering more than $3 billion in Bitcoin associated with ransomware, North Korean state hackers, and darknet drug markets.
"ChipMixer chopped up Bitcoin deposits into fixed small denomination chips and redistributed them through multiple dummy wallets to defeat blockchain tracing."
U.S. v. Tyler Barriss (Serial Swatting / Wichita Incident)
Perpetrator of dozens of fraudulent emergency 911 calls and bomb threats across the United States for hire, culminating in a fatal police shooting in Wichita, Kansas, over a Call of Duty video game dispute.
"Barriss routed VoIP phone communications through anonymous proxies and spoofing apps to simulate local caller ID numbers during emergency calls."
U.S. v. Rui-Siang Siew (Incognito Market Darknet Extortion)
Owner and operator of Incognito Market who facilitated over $100 million in illicit darknet transactions before orchestrating an exit scam and extorting registered vendors and buyers with doxxing threats.
"Operated hidden onion services over the Tor network equipped with automated cryptocurrency escrow mechanisms."
U.S. v. Maksim Boiko (QQAAZZ Cyber Laundering Network)
Russian cryptocurrency trader and Instagram influencer who operated as a high-level money launderer for QQAAZZ, an all-in-one cashout network servicing Dridex, Trickbot, and BitPaymer ransomware gangs.
"QQAAZZ used hundreds of bank accounts opened in the names of fake shell companies to rapidly layer stolen wire funds before converting them into Bitcoin."
U.S. v. Ross Ulbricht (Dread Pirate Roberts / Silk Road)
Historic trial and life sentencing of Ross William Ulbricht, creator and operator of Silk Road, the internet's first comprehensive darknet market using Tor and Bitcoin.
"Ulbricht built Silk Road as a hidden service on the Tor network to conceal server IP addresses and protect buyer and seller anonymity."
U.S. v. Evgeniy Mikhailovich Bogachev (GameOver Zeus & CryptoLocker)
Federal indictment of Russian syndicate leader Evgeniy Bogachev for operating GameOver Zeus, a peer-to-peer banking trojan, and CryptoLocker, the first mass-market cryptoviral ransomware, stealing over $100 million with an unprecedented $3 million FBI Rewards for Justice bounty.
"GameOver Zeus replaced traditional centralized command servers with a decentralized peer-to-peer protocol resilient to single-point DNS sinkholing."
U.S. v. Gal Vallerius (Dream Market OxyMonster Administrator)
Federal prosecution of French cybercriminal Gal Vallerius (known as OxyMonster), senior administrator and escrow vendor for Dream Market darknet marketplace, arrested at Atlanta Hartsfield-Jackson airport while traveling to the World Beard Championships and sentenced to 20 years in federal prison.
"Vallerius operated hidden Tor onion services to conceal server hosting locations while conducting darknet administration and cryptocurrency transactions."
U.S. v. Aleksandr Zhukov (Methbot Digital Ad Fraud Scheme)
Russian national and self-styled 'King of Fraud' Aleksandr Zhukov convicted after federal trial in Brooklyn and sentenced to 10 years in prison for running Methbot, a massive botnet and server farm that spoofed billions of digital video ad impressions, looting $36 million from American digital advertising networks.
"Defendants rented hundreds of commercial data center servers in Dallas and Amsterdam, leasing IP addresses fraudulently assigned to U.S. residential ISPs to route automated browser sessions."
Commonly Charged Criminal Statutes
Extortion in Connection with Computers
Prohibits transmitting in interstate or foreign commerce threats to cause damage to a protected computer or obtain confidential information with intent to extort money or value.
Conspiracy to Commit Wire Fraud
Applies the same penalties as the underlying substantive wire fraud offense to any person who attempts or conspires to commit wire fraud.
Money Laundering
Prohibits conducting financial transactions knowing that the property involved represents the proceeds of unlawful activity to promote unlawful activity or conceal the nature or ownership of the proceeds.
RICO Conspiracy (Racketeering)
Prohibits conspiring to conduct or participate in the conduct of an enterprise's affairs through a pattern of racketeering activity.