Infraud Organisation: Massive $530m global cyber fraud ring with over 10,000 members taken down by US

The US Justice Department has charged 36 individuals linked to a massive cyber fraud ring that claimed over $530m (£381m) in stolen funds over seven years. The international cybercrime group, known as the Infraud Organisation, acquired, sold and disseminated identities, compromised debit and credit cards, personally identifiable information, financial and banking data, malicious malware and other contraband via an online discussion forum.

According to a criminal indictment filed in Las Vegas and unsealed on Wednesday (7 February), the organisation was set up in October 2010 by a Ukranian national named Svyatoslav Bondarenko on the dark web. Bondarenko, also known as "Obnon", "Rector" and "Helkern" created the group under the slogan "In Fraud We Trust".

The Infraud Organisation was promoted as the "premier destination for carding" that directed traffic and potential buyers to the automated vending sites of its members.

"It also provided an escrow service to facilitate illicit digital currency transactions among its members and employed screening protocols that purported to ensure only high quality vendors of stolen cards, personally identifiable information, and other contraband were permitted to advertise to members," authorities said. That service was run by Infraud co-founder Sergey Medvedev, as per the indictment.

Members on the forum was found selling stolen PayPal accounts of nearly 1,300 victims from 2011 to 2014 along with up to 795,000 HSBC Bank accounts.

Infraud members had a defined hierarchy which included administrators, super moderators, moderators, vendors, VIP members and members. As of March 2017, the Infraud Organisation has over 10,900 members across the globe.

Over the course of its seven year history, the organisation netted $530m in stolen profits from financial institutions, consumers and other victims worldwide.

Officials have arrested 13 people from the US and other countries including the UK, Australia, France, Italy, Kosovo and Serbia. UK-based Anthony Nnamdi Okeakpu, 29, who allegedly joined in December 2010 and went by the monikers "moneymafia" and "Shilonng".

The suspects have been charged with racketeering among other crimes and could face at least 30 years in prison each, if found guilty. The remaining suspects are still at large and will need to be extradited to the US.

According to the Justice Department, Medvedev took over as "admin and owner" of Infraud in April 2016 after posting a note online saying Bondarenko had gone missing.

Acting Assistant Attorney General John Cronan described the case as "one of the largest cyber fraud enterprise prosecutions ever undertaken" by the Justice Department. The department declined to comment on whether data from the Equifax breach was sold on Infraud as well.

"The Department of Justice refuses to allow these cybercriminals to use the perceived anonymity of the Internet as a shield for their crimes," Cronan said in a statement. "We are committed to working closely with our international counterparts to identify, investigate, and bring to justice the perpetrators of these crimes, wherever in the world they operate."