{ "id": "8e24f16f-54cd-4357-bd29-e5cf0d1f7526", "created_at": "2026-04-06T15:53:52.661902Z", "updated_at": "2026-04-10T03:21:32.328253Z", "deleted_at": null, "sha1_hash": "094b1b7e0b4586b702a13084342fa1865560241e", "title": "Latvian National Charged for Alleged Role in Transnational Cybercrime Organization", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 44420, "plain_text": "Latvian National Charged for Alleged Role in Transnational\r\nCybercrime Organization\r\nPublished: 2021-06-04 · Archived: 2026-04-06 15:50:12 UTC\r\nA Latvian national was arraigned in federal court in Cleveland, Ohio, today on multiple charges stemming from\r\nher alleged role in a transnational cybercrime organization responsible for creating and deploying a computer\r\nbanking trojan and ransomware suite of malware known as “Trickbot.” \r\nAlla Witte, aka Max, 55, is charged in 19 counts of a 47-count indictment, which accuses her of participating in a\r\ncriminal organization referred to as the “Trickbot Group,” which deployed the Trickbot malware. The Trickbot\r\nGroup operated in Russia, Belarus, Ukraine, and Suriname, and primarily targeted victim computers belonging to\r\nbusinesses, entities, and individuals, including those in the Northern District of Ohio and elsewhere in the United\r\nStates. Targets included hospitals, schools, public utilities, and governments. Witte, who previously resided in\r\nParamaribo, Suriname, was arrested on Feb. 6, in Miami, Florida.\r\n“This indictment demonstrates the broad reach of the Department of Justice’s Ransomware and Digital Extortion\r\nTask Force,” said Deputy Attorney General Lisa O. Monaco. “Trickbot infected millions of victim computers\r\nworldwide and was used to harvest banking credentials and deliver ransomware. The defendant is accused of\r\nworking with others in the transnational criminal organization to develop and deploy a digital suite of malware\r\ntools used to target businesses and individuals all over the world for theft and ransom. These charges serve as a\r\nwarning to would-be cybercriminals that the Department of Justice, through the Ransomware and Digital\r\nExtortion Task Force and alongside our partners, will use all the tools at our disposal to disrupt the cybercriminal\r\necosystem.”\r\n“The Trickbot malware was designed to steal the personal and financial information of millions of people around\r\nthe world, thereby causing extensive financial harm and inflicting significant damage to critical infrastructure\r\nwithin the United States and abroad,” said Acting U.S. Attorney Bridget M. Brennan of the Northern District of\r\nOhio. “Federal law enforcement, along with assistance provided by international partners, continue to fight and\r\ndisrupt ransomware and malware where feasible. We are united in our efforts to hold transnational hackers\r\naccountable for their actions.” \r\n“Witte and her associates are accused of infecting tens of millions of computers worldwide, in an effort to steal\r\nfinancial information to ultimately siphon off millions of dollars through compromised computer systems,” said\r\nSpecial Agent in Charge Eric B. Smith of the FBI’s Cleveland Field Office. “Cyber intrusions and malware\r\ninfections take significant time, expertise, and investigative effort, but the FBI will ensure these hackers are held\r\naccountable, no matter where they reside or how anonymous they think they are.”\r\nThe indictment alleges that beginning in November 2015, Witte and others stole money and confidential\r\ninformation from unsuspecting victims, including businesses and their financial institutions in the United States,\r\nUnited Kingdom, Australia, Belgium, Canada, Germany, India, Italy, Mexico, Spain, and Russia through the use\r\nof the Trickbot malware.\r\nhttps://www.justice.gov/opa/pr/latvian-national-charged-alleged-role-transnational-cybercrime-organization\r\nPage 1 of 2\n\nWitte and her co-conspirators allegedly worked together to infect victim computers with the Trickbot malware\r\ndesigned to capture online banking login credentials and harvest other personal information, including credit card\r\nnumbers, emails, passwords, dates of birth, social security numbers and addresses. Witte and others also allegedly\r\ncaptured login credentials and other stolen personal information to gain access to online bank accounts, execute\r\nunauthorized electronic funds transfers and launder the money through U.S. and foreign beneficiary accounts.\r\nAccording to the indictment, Witte worked as a malware developer for the Trickbot Group and wrote code related\r\nto the control, deployment, and payments of ransomware. The ransomware informed victims that their computer\r\nwas encrypted, and that they would need to purchase special software through a Bitcoin address controlled by the\r\nTrickbot Group to decrypt their files. In addition, Witte allegedly provided code to the Trickbot Group that\r\nmonitored and tracked authorized users of the malware and developed tools and protocols to store stolen login\r\ncredentials.\r\nWitte is charged with one count of conspiracy to commit computer fraud and aggravated identity theft; one count\r\nof conspiracy to commit wire and bank fraud affecting a financial institution; eight counts of bank fraud affecting\r\na financial institution; eight counts of aggravated identity theft and one count of conspiracy to commit money\r\nlaundering. The defendant was arraigned before U.S. Magistrate Judge William H. Baughman Jr. of the U.S.\r\nDistrict Court for the Northern District of Ohio. If convicted, she faces a maximum penalty of five years in prison\r\nfor conspiracy to commit computer fraud and aggravated identity theft; 30 years in prison for conspiracy to\r\ncommit wire and bank fraud; 30 years in prison for each substantive bank fraud count; a two-year mandatory\r\nsentence for each aggravated identity theft count, which must be served consecutively to any other sentence; and\r\n20 years in prison for conspiracy to commit money laundering. A federal district court judge will determine any\r\nsentence after considering the U.S. Sentencing Guidelines and other statutory factors.\r\nThe FBI’s Cleveland Office investigated the case.\r\nSenior Counsel C.S. Heath of the Criminal Division’s Computer Crime and Intellectual Property Section and\r\nAssistant U.S. Attorneys Daniel J. Riedl and Duncan T. Brown of the Northern District of Ohio are prosecuting\r\nthe case.\r\nThis case is part of the Department of Justice’s Ransomware and Digital Extortion Task Force, which was created\r\nto combat the growing number of ransomware and digital extortion attacks. As part of the Task Force, the\r\nCriminal Division, working with the U.S. Attorneys’ Offices, prioritizes the disruption, investigation, and\r\nprosecution of ransomware and digital extortion activity by tracking and dismantling the development and\r\ndeployment of malware, identifying the cybercriminals responsible, and holding those individuals accountable for\r\ntheir crimes. The department, through the Task Force, also strategically targets the ransomware criminal\r\necosystem as a whole and collaborates with domestic and foreign government agencies as well as private sector\r\npartners to combat this significant criminal threat. \r\nAn indictment is merely an allegation and the defendant is presumed innocent until proven guilty beyond a\r\nreasonable doubt in a court of law.\r\nSource: https://www.justice.gov/opa/pr/latvian-national-charged-alleged-role-transnational-cybercrime-organization\r\nhttps://www.justice.gov/opa/pr/latvian-national-charged-alleged-role-transnational-cybercrime-organization\r\nPage 2 of 2", "extraction_quality": 1, "language": "EN", "sources": [ "Malpedia", "ETDA" ], "references": [ "https://www.justice.gov/opa/pr/latvian-national-charged-alleged-role-transnational-cybercrime-organization" ], "report_names": [ "latvian-national-charged-alleged-role-transnational-cybercrime-organization" ], "threat_actors": [], "ts_created_at": 1775490832, "ts_updated_at": 1775791292, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/094b1b7e0b4586b702a13084342fa1865560241e.pdf", "text": "https://archive.orkl.eu/094b1b7e0b4586b702a13084342fa1865560241e.txt", "img": "https://archive.orkl.eu/094b1b7e0b4586b702a13084342fa1865560241e.jpg" } }