{ "id": "8d138ad7-72ca-4125-83a9-c618e2ad4ca0", "created_at": "2026-04-06T00:21:57.478073Z", "updated_at": "2026-04-10T03:25:13.034837Z", "deleted_at": null, "sha1_hash": "c51dc1187f3f7d1103580a3fca37fd14fa1f00bf", "title": "Officials Announce International Operation Targeting Transnational Criminal Organization QQAAZZ that Provided Money Laundering Services to High-Level Cybercriminals", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 52973, "plain_text": "Officials Announce International Operation Targeting\r\nTransnational Criminal Organization QQAAZZ that Provided\r\nMoney Laundering Services to High-Level Cybercriminals\r\nPublished: 2020-10-15 · Archived: 2026-04-05 18:14:29 UTC\r\nFourteen members of the transnational criminal organization, QQAAZZ, were charged by a federal grand jury in\r\nthe Western District of Pennsylvania in an indictment unsealed today.  A related indictment unsealed in October\r\n2019 charged five members of QQAAZZ.  One additional conspirator, a Russian national, was arrested by\r\ncriminal complaint in late March 2020 while visiting the United States, bringing the total number of charged\r\ndefendants to 20.  Acting Assistant Attorney General Brian C. Rabbitt of the U.S. Department of Justice’s\r\nCriminal Division and U.S. Attorney Scott W. Brady for the Western District of Pennsylvania, made the\r\nannouncement today.\r\nThe QQAAZZ members, acting in concert with cybercriminals across the world, are accused of conspiring to\r\nlaunder money stolen from victims of computer fraud in the United States and elsewhere.  More than 40 house\r\nsearches were conducted in Latvia, Bulgaria, the United Kingdom, Spain and Italy, with criminal prosecutions\r\ninitiated in the United States, Portugal, Spain and the United Kingdom.  The largest number of searches and\r\narrests were carried out in Latvia by the Latvian State Police (Latvijas Valsts Policija), and an extensive bitcoin\r\nmining operation associated with the group was seized in Bulgaria.  Today’s announcement is in coordination with\r\nannouncements by Europol and several law enforcement agencies across Europe who collaborated with the United\r\nStates to develop parallel investigations and prosecutions of the QQAAZZ members in their own countries. \r\n“Today’s charges, brought in coordination with our European law enforcement partners, reflect the Criminal\r\nDivision’s steadfast efforts to work with authorities worldwide to protect the public from fraudsters and the money\r\nlaunderers who help them hide their stolen money,” said Acting Assistant Attorney General Brian C. Rabbitt. \r\n“Our message to money laundering organizations like QQAAZZ is simple: international borders will not stop the\r\ndedicated efforts of law enforcement across the globe to bring you to justice.  In addition to the Criminal Division\r\nteam, I would like to recognize the outstanding efforts of the team led by U.S. Attorney Scott Brady, FBI\r\nPittsburgh, and our European partners.”\r\n“Cybercrime victimizes individuals and companies all over the world, so our work to identify and disrupt\r\ncybercriminals requires global collaboration,” said U.S. Attorney Scott W. Brady for the Western District of\r\nPennsylvania.  “For the past several years, law enforcement from 16 countries has been conducting coordinated\r\ninvestigations of this criminal gang, and now parallel prosecutions will commence in the United States, Portugal,\r\nUnited Kingdom and Spain.  As this case demonstrates, we will be relentless in our pursuit of cybercriminals\r\nregardless of where they reside.”\r\n“This was an extensive investigation that had implications around the world,” said FBI Pittsburgh Special Agent\r\nin Charge Michael Christman. “Partnerships are essential, as no one agency can combat cybercrime alone. This\r\ncase highlights the FBI’s strategy to target and dismantle the most significant cybercriminal enterprises through a\r\nhttps://www.justice.gov/opa/pr/officials-announce-international-operation-targeting-transnational-criminal-organization\r\nPage 1 of 4\n\nglobal task force approach. I can assure everyone that the FBI and our partners will continue to work tirelessly to\r\ncombat these cyber threats.”\r\n“Cybercriminals are constantly exploring new possibilities to abuse technology and financial frameworks to\r\nvictimize millions of users in a moment from anywhere in the world,” said Fernando Ruiz, Head of Europol’s\r\nEuropean Cybercrime Centre.  “Today’s operation shows how through a proper law enforcement international\r\ncoordination we can turn the table on these criminals and bring them to justice.”\r\nThe indictment alleges that the QQAAZZ network laundered, or attempted to launder, tens of millions of dollars’\r\nworth of stolen funds from victims of cybercrimes since 2016.\r\nComprised of several layers of members from Latvia, Georgia, Bulgaria, Romania, and Belgium, among other\r\ncountries, the QQAAZZ network opened and maintained hundreds of corporate and personal bank accounts at\r\nfinancial institutions throughout the world to receive money from cybercriminals who stole it from bank accounts\r\nof victims.  The funds were then transferred to other QQAAZZ-controlled bank accounts and sometimes\r\nconverted to cryptocurrency using “tumbling” services designed to hide the original source of the funds.  After\r\ntaking a fee of up to 40 to 50 percent, QQAAZZ returned the balance of the stolen funds to their cybercriminal\r\nclientele.  \r\nThe QQAAZZ members secured these bank accounts by using both legitimate and fraudulent Polish and\r\nBulgarian identification documents to create and register dozens of shell companies which conducted no\r\nlegitimate business activity. Using these registration documents, the QQAAZZ members then opened corporate\r\nbank accounts in the names of the shell companies at numerous financial institutions around the world, thereby\r\ngenerating hundreds of QQAAZZ-controlled bank accounts available to receive stolen funds from cyber thieves.\r\nQQAAZZ advertised its services as a “global, complicit bank drops service” on Russian-speaking online\r\ncybercriminal forums where cybercriminals gather to offer or seek specialized skills or services needed to engage\r\nin a variety of cybercriminal activities. The criminal gangs behind some of the world’s most harmful malware\r\nfamilies (e.g.: Dridex, Trickbot, GozNym, etc.) are among those cybercriminal groups that benefited from the\r\nservices provided by QQAAZZ. \r\nThe 14 defendants named in the indictment unsealed today are:\r\n1. Nika Nazarovi, aka “Nika Utiashvili,” aka “Mihail Atansov,” aka “Stefan Trifonov Zhelyazkov,” 32, of\r\nGeorgia;\r\n2. Martins Ignatjevs, aka “Yordan Angelov Stoyanov,” aka “Aleksander Tihomirov,” aka “Svetlin Iliyanov\r\nAsenov,” 33, of Latvia;\r\n3. Aleksandre Kobiashvili, aka “Antonios Nastas,” aka “Ognyan Krasimirov Trifonov,” 32, of Georgia;\r\n4. Dmitrijs Kuzminovs, aka “Parush Gospodinov Genchev,” 35, of Latvia;\r\n5. Valentins Sevecs, aka “Marek Jaswilko,” aka “Rafal Szczytko,” 32, of Latvia;\r\n6. Dmitrijs Slapins, 35, of Latvia;\r\n7. Armens Vecels, 24, of Latvia;\r\n8. Artiom Capacli, 31, of Bulgaria;\r\n9. Ion Cebanu, 26, of Romania;\r\n10. Tomass Trescinkas, 25, of Latvia;\r\nhttps://www.justice.gov/opa/pr/officials-announce-international-operation-targeting-transnational-criminal-organization\r\nPage 2 of 4\n\n11. Ruslans Sarapovs, 19, of Latvia;\r\n12. Silvestrs Tamenieks, 21, of Latvia;\r\n13. Abdelhak Hamdaoui, 48, of Belgium; and\r\n14. Petar Iliev, 37, of Bulgaria.\r\nThe five defendants charged in the indictment unsealed in October 2019 are:\r\n1. Aleksejs Trofimovics, aka “Aleksejs Trofimovich,” aka “Alexey Trofimovich,” aka “Aleko Stoyanov\r\nAngelov,” 24, of Latvia;\r\n2. Ruslans Nikitenko, aka “Krzysztof Wojciech Lewko,” aka “Milen Nikolchev Nikolov,” aka “Rafal\r\nZimnoch,” 41, of Latvia;  \r\n3. Arturs Zaharevics, aka “Piotr Ginelli,” aka “Arkadiusz Szuberski,” 33, of Latvia;\r\n4. Deniss Ruseckis, aka “Denis Rusetsky,” aka “Sevdelin Sevdalinov Atanasov,” 24, of Latvia; and\r\n5. Deinis Gorenko, 25, of Latvia.                \r\nThe Russian national charged by criminal complaint and arrested in late March 2020 while visiting the United\r\nStates is Maksim Boiko, aka “Maxim Boyko” aka “gangass,” 30, of Russia.\r\nThe U.S. victims who had funds stolen, or attempted to be stolen, from their online bank accounts (including from\r\nbanks headquartered in Pittsburgh, Pennsylvania) and destined for QQAAZZ-controlled bank accounts overseas\r\ninclude:\r\na technology company in Windsor, Connecticut;\r\na Jewish Orthodox Synagogue in Brooklyn, New York;\r\na medical device manufacturer in York, Pennsylvania;\r\nan individual in Montclair, New Jersey;\r\nan architecture firm in Miami, Florida;\r\nan individual in Acworth, Georgia;\r\nan automotive parts manufacturer in Livonia, Michigan;\r\na homebuilder in Skokie, Illinois;\r\nan individual in Carrollton, Texas; and\r\nan individual in Villa Park, California.  \r\nActing Assistant Attorney General Rabbitt and U.S. Attorney Brady praised the outstanding investigative work of\r\nthe FBI’s Pittsburgh Field Office and their law enforcement partners from Portugal, Spain, the United Kingdom,\r\nLatvia, Bulgaria, Georgia, Italy, Switzerland, Poland, Czech Republic, Australia, Sweden, Austria, Germany and\r\nBelgium.  Acting Assistant Attorney General Rabbitt and U.S. Attorney Brady also thanked Europol in The Hague,\r\nNetherlands for coordinating the investigative efforts of the law enforcement agencies from the 15 participating\r\ncountries.  The Justice Department’s Office of International Affairs of the Department’s Criminal Division\r\nprovided significant assistance by coordinating requests to foreign countries for searches, arrests, extraditions and\r\nevidence sharing.  Assistance was also provided by the National Cyber-Forensics and Training Alliance (NCFTA)\r\nin Pittsburgh.   \r\nThe case is being prosecuted by Assistant U.S. Attorney Charles A. “Tod” Eberle, Chief of the National Security\r\nand Cybercrime Section for the Western District of Pennsylvania, Assistant U.S. Attorney Brian Czarnecki of the\r\nhttps://www.justice.gov/opa/pr/officials-announce-international-operation-targeting-transnational-criminal-organization\r\nPage 3 of 4\n\nWestern District of Pennsylvania, and Trial Attorney Michael Parker of the Money Laundering and Asset\r\nRecovery Section of the U.S. Department of Justice’s Criminal Division.\r\nAn indictment is an accusation. A defendant is presumed innocent unless and until proven guilty.\r\nSource: https://www.justice.gov/opa/pr/officials-announce-international-operation-targeting-transnational-criminal-organization\r\nhttps://www.justice.gov/opa/pr/officials-announce-international-operation-targeting-transnational-criminal-organization\r\nPage 4 of 4", "extraction_quality": 1, "language": "EN", "sources": [ "Malpedia" ], "references": [ "https://www.justice.gov/opa/pr/officials-announce-international-operation-targeting-transnational-criminal-organization" ], "report_names": [ "officials-announce-international-operation-targeting-transnational-criminal-organization" ], "threat_actors": [ { "id": "b753c6a8-a83d-47bc-829d-45e56136eb7d", "created_at": "2023-01-06T13:46:38.97802Z", "updated_at": "2026-04-10T02:00:03.169611Z", "deleted_at": null, "main_name": "GozNym", "aliases": [], "source_name": "MISPGALAXY:GozNym", "tools": [], "source_id": "MISPGALAXY", "reports": null } ], "ts_created_at": 1775434917, "ts_updated_at": 1775791513, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/c51dc1187f3f7d1103580a3fca37fd14fa1f00bf.pdf", "text": "https://archive.orkl.eu/c51dc1187f3f7d1103580a3fca37fd14fa1f00bf.txt", "img": "https://archive.orkl.eu/c51dc1187f3f7d1103580a3fca37fd14fa1f00bf.jpg" } }