Russia arrests leader of “Infraud Organization” hacker group

The Russian Federal Security Service (FSB) and law enforcement have arrested Andrey Sergeevich Novak, the alleged leader of the Infraud Organization, a hacker group that caused losses of more than $560 million in seven years of activity.

The arrest was possible due to intelligence collected by Russian special services and with the cooperation of U.S. law enforcement.

The Infraud Organization was involved in acquiring and trading of stolen payment card data and identities on the Infraud carding portal.

In 2018, an international law enforcement operation disrupted the organization and the U.S. Department of Justice (DoJ) indicted 36 suspects. Of these, 13 were arrested in various countries, including one of the portal’s administrators.

Four suspected Infraud members detained

Last week, the FSB and law enforcement in Russia arrested four individuals, Andrey Novak among them, who is believed to be the founder of Infraud Organization operating under the aliases “Unicc,” “Faaxxx,” and “Faxtrod.”

Novak has been detained for two months, while the investigation clarifies his role in the hacking group. The other three alleged members - Kirill Samokutyaev, Konstantin Vladimirovich Bergman, and Mark Avramovich Bergman, have been placed under house arrest, Russian News Agency TASS reports.

The agency quotes an undisclosed source saying that Novak is the alleged founder of the criminal group. A graphic from the DoJ of the hierarchy within the Infraud Organization, however, shows Novak listed as a vendor on the portal, well below the higher echelon of administrators and super moderators.

Infraud hierarchy, source: DoJ

The investigation into Infraud activities is ongoing and continues to identify new members of the group. The list of arrests has expanded and some individuals have pleaded guilty and received a sentence.

Infraud co-founder Sergey Medvedev (a.k.a. “Stells,” “segmed,” and “serjbear) admitted his role in the operation in June 2020 and on March 19, 2021, was sentenced to 10 years in prison for one count of racketeering conspiracy.

Another member of the group, Marko Leopard, aka “Leopardmk,” received five years of prison time for offering bulletproof hosting services to Infraud members.

Russia takes action against its cybercriminals

Russia appears to have started collaborate with the U.S. and take active measures against cybercriminals on its territory.

Earlier this month, the FSB announced that it shut down the REvil ransomware gang, following reports from U.S. authorities on the leader of the group. At least eight suspects have been charged and detained for two months.

These raids and arrests come after multiple warnings that the U.S. would take action against threat actors in Russia if the Russian government can’t or won’t.

Russian citizens found guilty of cybercriminal activities will serve their sentence in Russia, even if they are wanted in other countries, because the country’s legislation forbids extraditing them.

However, non-Russian citizens will be extradited to a foreign state after an investigation and court proceedings in Russia.