While I wouldn't put Seleznev on the same scale as Bout and Yaroshenko, he is definitely not small potatoes either. We wrote about Seleznev as part of the RICO racketeering case against the owners and operators of the Carder.su website. (See The Carder.su indictment: United States v. Kilobit et. al.) but that was only the first part of Seleznev's trouble.
In the Kilobit indictment, the charges are that Seleznev did "Participate in a Racketeer Influenced Corrupt Organization [RICO]" and "Participated in a Conspiracy to Engage in a Racketeer Influenced Corrupt Organization."
The whole group are described in the indictment like this:
"The defendants herein, and others known and unknown, are members of, employed by, and associates of a criminal organization, hereafter referred to as "the Carder.su organization," whose members engage in acts of identity theft and financial fraud, including, but not limited to, acts involving trafficking in stolen means of identification; trafficking in, production and use of couterfeit identification documents; identity theft; trafficking in, production and use of unauthorized and counterfeit access devices; and bank fraud; and whose members interfere with interstate and foreign commerce through acts of identity theft and financial fraud. Members and associates of the Carder.su organization operate principally in Las Vegas, Nevada, and elsewhere.
The important thing to understand about RICO is that as PART OF THE CORRUPT ORGANIZATION all of the charged members are sentenced as if the whole group did all of the crimes.
What does that mean to Seleznev? In Las Vegas, Nevada, Seleznev is being charged with being part of a RICO group that is credited with directly causing, in actual measured and aggregated fraudulent transaction losses, $50,893,166.35!!
But before Vegas gets their hands on him, Seleznev will face charges in the Western District of Washington for Case # 2:11-cr-0070-RAJ-1.
In that case, Roman Seleznev, AKA TRACK2, AKA Roman Ivanov, AKA Ruben Samvelich, AKA nCuX, AKA Bulba, AKA bandysli64, AKA smaus, AKA Zagreb, AKA shmak is charged with:
This 27 page indictment, filed March 3, 2011, was just unsealed on July 6, 2014 when Seleznev appeared in court in Guam.
(Counts 1-5) Bank Fraud 18:1344 & 2
(6-13) Intentional Damage to a Protected Computer 18:1030(a)(5)(A) & 1030(c)(4)(B)(i) & 2
(14-21) Obtaining InformationFrom a Protected Computer 18:1030(a)(2) & 1030(c)(2)(ii) & 2
(22) Possession of Fifteen or More Unauthorized Access Devices 18:1029(a)(3) & 1029(c)(1)(A)(i) & 2
(23-24) Trafficking in Unauthorized Access Devices 18:1029(a)(2) & 1029(c)(1)(A)(i) & 2
(25-29) Aggravated Identity Theft 18:1028(a)(1) & 2
Washington charges that Seleznev "knowingly and willfully devised and executed and aided and abetted a scheme and artifice to defraud various financial institutions, including, but not limited to, Boeing Employees' Credit Union, Chase Bank, Capital One, Citibank, and Keybank, and to obtain moneys, funds, and credits under the custody and control of the banks by means of material false and fraudulent pretenses, representations and promises, as further described below."
Seleznev would:
- hack into retail businesses,
- install malicious computer code onto those hacked computers,
- and use the malware to steal credit card numbers from the victim businesses' customers
- market and sell the stolen credit card numbers on "criminally inspired" websites
- thus allowing these cards and the associated accounts to be used for fraudulent purposes by the customers of his service.
Seleznev's websites for selling cards were primarily bulba.cc, secure.bulba.cc, Track2.name, and secure.Track2.name.
The targeted businesses usually had several "point of sale" terminals "up front" and a "back of the house computer" which may have been a server or perhaps even just the manager's computer.
Some of Seleznov's victims included: The Broadway Grill - 32,000 unique credit card numbers from Dec 1, 2009 to Oct 22, 2010
Grand Central Baking Company in Seattle, WA
four Mad Pizza restaurants (three in Seattle, one in Tukwila, WA)
Village Pizza in Anacortes, WA
Casa Mia Italian in Yelm, WA.
Schlotsky's Deli in Coeur d'Alene, Idaho
Active Networks in Frostburg, MD
Days Jewelry in Waterville, Maine
Latitude Bar and Grill, NY, NY
Mary's Pizza Shack in Sonoma, CA
City News Stand in Chicago and Evanston, IL
Bulba would advertise when he had new cards for sale, claiming as many as 17,000 "Fresh Dumps" (newly stolen and never before used for fraud) cards and offering guarantees, including free card replacement for cards that were declined. Seleznev/Bulba had such high quality, that the owners of the popular crdsu.su and carder.biz allowed Seleznev and others to assume Monopoly status as the preferred card vendors for their boards, which were extremely prevalent in the underground.
According to the newly unsealed indictment, Seleznev personally stole (through his malware) more than 200,000 cards, and succesfully sold over 140,000 of those cards through his websites bulba.cc and Track2.name between November 15, 2010 and February 22, 2011, generating direct illicit profits in excess of $2,000,000 USD.
Just the cards stolen by Seleznev at the Broadway Grill have been associated with $79,317 in fraudulent charges, and all of the cards stolen by Seleznev are responsible for actual fraud charges of at least $1,175,217.37.
November 15-16, 2010, $83,490 in charges were made against Boeing Employees Credit Union cards.
Jan 31-Feb 1, 2011, $30,716 in charges against BECU.
Seleznev will have a hearing in Guam on July 22, and then be transferred to the Seattle courts.