CASE DOSSIER sentenced

U.S. v. Sergey Medvedev et al. (Infraud Organization)

Docket: 2:17-cr-00360 Court: U.S. District Court for the District of Nevada Opened: 2018-01-26 Sector: Financial Services, Consumer Credit, Retail

Key Facts

Status

SENTENCED

Legal disposition

Loss Amount

$568.0 million

Caused actual financial losses of over $568 million to financial institutions and cardholders.

Techniques

Verified mappings

Defendants

Named in charges

Legal Status: SENTENCED in U.S. District Court for the District of Nevada.
Primary Target Sector: Financial Services, Consumer Credit, Retail.
Documented Financial Loss: $568.0 million.
1 verified MITRE ATT&CK techniques substantiated with verbatim court excerpts.

Export structured case data and MITRE ATT&CK Navigator layer:

Download Navigator Layer (JSON) Case Data (JSON)

Case Summary

Global cybercrime enterprise operating under the slogan 'In Fraud We Trust' with over 10,000 members, trafficking in stolen identities, counterfeit documents, compromised credit cards, and banking trojans.

BOARDROOM EXECUTIVE BRIEF

Executive Summary for Board Members & Leadership

Plain-English Root Cause

Unauthorized intrusion originating from targeted infiltration directed against Financial Services, Consumer Credit, Retail networks. Global cybercrime enterprise operating under the slogan 'In Fraud We Trust' with over 10,000 members, trafficking in stolen identities, counterfeit documents, compromised credit cards, and banking trojans.

Operational & Financial Fallout

Caused actual financial losses of over $568 million to financial institutions and cardholders. Impacted Financial Services, Consumer Credit, Retail infrastructure and associated victim operations.

3 Critical Boardroom Questions

1. Do 100% of our external portals enforce phishing-resistant hardware MFA?
2. Can compromised endpoint credentials traverse laterally to domain controllers or cloud storage?
3. Have our air-gapped immutable recovery backups been restored and tested within the last 90 days?

Disposition: SENTENCED

Technical Threat Intelligence

Attack Anatomy & Incident Execution

Forensic analysis of initial intrusion vector, step-by-step kill chain, operational blast radius, and defensive controls.

Ground Zero / Infiltration Vector

Adversary Kill Chain Flow

1 Documented Phases

Phase 1: Defense Evasion Defense Evasion & Security Blindfolding

MITRE ATT&CK T1078 →

Infraud operated escrow systems enabling cybercriminals to buy and sell verified high-balance administrative account credentials.

Artifacts & Tooling: T1078 Valid Accounts

Real-World Blast Radius & Operational Fallout

Caused actual financial losses of over $568 million to financial institutions and cardholders. Impacted Financial Services, Consumer Credit, Retail infrastructure and associated victim operations.

Defensive Engineering Takeaways

Recommended Hardening Controls

✓ Enforce phishing-resistant multifactor authentication (FIDO2) across all external remote access endpoints.

✓ Implement network microsegmentation to prevent unrestricted lateral traversal between internal subnets.

✓ Maintain isolated, immutable backups of critical directory services and transaction databases.

✓ Deploy real-time endpoint detection and response (EDR) agents with automated containment policies.

Procedural & Incident Timeline

2018-02-02 arrest

Medvedev arrested in Bangkok, Thailand, with over 100,000 Bitcoins in digital wallets.

2020-06-26 plea

Pleads guilty to RICO conspiracy in federal court in Las Vegas.

2021-03-19 sentencing

Sentenced to 120 months (10 years) in federal prison.

Named Defendants & Operatives

Defendant	Nationality	Status	Prison Term	Restitution	Notes
Sergey Medvedev	Russian Federation	sentenced	120 mo	None	Infraud Organization leader sentenced to 10 years in federal prison.

Substantiated MITRE ATT&CK Techniques

Technique ID	Technique Name & Tactic	Primary Source Evidence Excerpt	Locator	Verification
T1078	Valid Accounts Defense Evasion	"Infraud operated escrow systems enabling cybercriminals to buy and sell verified high-balance administrative account credentials."	Indictment ¶ 14, Page 7	reviewed

Cite & Embed This Case Record

Public Domain / CC0

Bluebook Legal Citation:

Cyberattack Case Library, U.S. v. Sergey Medvedev et al. (Infraud Organization), No. 2:17-cr-00360 (U.S. District Court for the District of Nevada 2018), https://cybercaselibrary.com/cases/us-v-medvedev-infraud-organization/

Embeddable Incident Card (HTML):