Loading story…
Romanian national Gavril Sandu, 53, has been extradited to the United States and appeared in federal court in Charlotte, North Carolina, over allegations that he participated in a cyber-enabled bank fraud scheme that ran from 2009 to 2010. U.S. prosecutors say the operation compromised small businesses’ VoIP systems and used spoofed, trusted-looking caller IDs to place vishing calls while impersonating banks, tricking victims into disclosing debit card numbers and PINs.
Authorities allege the stolen credentials were used to access victim accounts, encode data onto counterfeit magnetic-stripe cards, and withdraw cash from ATMs through money mule activity, with proceeds shared among co-conspirators. Sandu was indicted in 2017, arrested in Romania in January 2026, extradited on 30 April, and now faces charges of bank fraud and conspiracy that carry a maximum sentence of 30 years in prison if convicted.
Get the infrastructure and lures behind it.
5 events from the most recent confirmed update back to the earliest known activity.
Following his extradition, Sandu appeared in U.S. court to answer charges of bank fraud and conspiracy. Prosecutors said he faces up to 30 years in prison if convicted.
Romanian national Gavril Sandu was extradited to the United States to face bank fraud and conspiracy charges related to the vishing scheme. One report specifies the extradition occurred on 30 April 2026, after which he was placed in federal custody in Charlotte, North Carolina.
After years of allegedly evading authorities, Sandu was arrested in Romania in connection with the U.S. case. Reports place the arrest in January 2026.
A U.S. federal grand jury indicted Gavril Sandu on charges tied to the cyber-enabled bank fraud scheme. The indictment was returned on 14 November 2017.
From May 2009 to October 2010, Gavril Sandu and co-conspirators allegedly compromised small businesses' VoIP systems and used vishing calls impersonating banks to steal debit card numbers and PINs. The stolen data was allegedly encoded onto counterfeit magnetic-stripe cards and used for ATM cash withdrawals, with proceeds moved through money mule activity.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A 45-year-old Romanian national, **Catalin Dragomir**, pleaded guilty in U.S. court to hacking computers at Oregon’s Department/Office of Emergency Management in June 2021 and then selling the access for about **$3,000 in Bitcoin**. Prosecutors said Dragomir operated as an **initial access broker**, using online monikers including **“inthematrixl”** to advertise and negotiate sales of administrative credentials on cybercriminal platforms; he repeatedly accessed the victim network to prove the access was valid and provided screenshots and login details. Dragomir also admitted to hacking **10 other U.S. companies**, with total losses cited at **at least $250,000**. He was arrested in Romania in **November 2024**, extradited to the U.S. in 2025, and pleaded guilty to **obtaining information from a protected computer** and **aggravated identity theft**; sentencing is expected in **May**, and he faces **up to seven years** in prison. The case highlights a relatively uncommon prosecution outcome for a municipal/government network intrusion tied to the sale of stolen credentials and access.
Jun 29, 2026
Dutch courts cleared the extradition of Russian national **Vladimir Drinkman** to the United States in a case prosecutors described as the largest hacking and data-breach conspiracy ever prosecuted there. U.S. authorities alleged Drinkman and four co-defendants used **SQL injection**, malware backdoors, and network sniffers to penetrate payment processors, retailers, and financial institutions, stealing more than **160 million** credit and debit card numbers over several years and causing hundreds of millions of dollars in losses. Victims named in court filings included **Heartland Payment Systems**, **7-Eleven**, **Hannaford**, **Carrefour**, **JetBlue**, **Global Payments**, **Dow Jones**, and **NASDAQ**, though prosecutors said the NASDAQ intrusion did not affect its trading platform. The prosecution tied the operation to the broader payment-card theft ecosystem exposed in earlier cases involving **Albert Gonzalez**, who had already been accused of orchestrating some of the largest U.S. retail breaches. After his transfer to the United States, Drinkman later admitted his role in the conspiracy, marking a major step in a long-running investigation into an international crew that allegedly harvested card data from corporate networks and sold it through criminal resellers. The case underscored how a small group of Russian and Eastern European defendants allegedly sustained long-term access inside major companies and monetized stolen payment data at unprecedented scale.
Jun 29, 2026
Romanian national **Catalin Dragomir**, who used the alias **`inthematrixl`**, was sentenced to **56 months in prison** after pleading guilty to hacking Oregon’s Office of Emergency Management and selling administrative access to the state government network on a cybercriminal forum. U.S. prosecutors said Dragomir repeatedly breached the Oregon network, stole an employee’s personal data — including name, email address, date of birth, and Social Security number — and used that access for criminal resale. The case followed Dragomir’s arrest in Romania in November 2024, extradition to the United States, and guilty plea to **aggravated identity theft** and **obtaining information from a protected computer**. Authorities said he was also tied to intrusions affecting **10 other U.S. organizations**, with combined losses of at least **$250,000**, underscoring how stolen government and enterprise credentials continue to be monetized through underground access markets.
Jun 29, 2026