Loading story…
Courts in Kazakhstan and the United States sentenced members tied to the Carbanak/FIN7 cybercrime ecosystem for long-running attacks on banks and payment-card environments. In Kazakhstan, two Carbanak members received eight-year prison terms for hacking several Kazakh banks in 2016 and 2017, stealing more than 2 billion tenges and attempting to steal another 8 billion tenges by moving funds to 250 payment cards that were later cashed out through ATMs in Europe and Russia. U.S. prosecutors separately sentenced Denys Iarmak, identified as a FIN7 member, to five years in prison for helping compromise tens of millions of debit and credit cards through phishing and network intrusions targeting businesses across the United States and abroad.
The cases add to a broader law-enforcement campaign against a group tracked under overlapping names including Carbanak, Cobalt, FIN7, and Navigator Group, which investigators say attacked banks, restaurants, casinos, hotels, and other financial targets at global scale. Security reporting has linked the operation to spearphishing, malicious Office documents and attachments, point-of-sale malware, lightweight backdoors, and exploitation of vulnerabilities including CVE-2015-1770 and CVE-2015-2426. Authorities have previously said the group breached more than 100 banks in 40 countries, stole over 20 million payment card records from thousands of business locations, and caused losses estimated above $1 billion, while additional suspects remain identified or in custody in multiple jurisdictions.
See the reporting duties and controls this puts on the clock.
21 events from the most recent confirmed update back to the earliest known activity.
In November 2021, Denys Iarmak pleaded guilty to conspiracy to commit wire fraud and conspiracy to commit computer hacking.
FIN7 member Andrii Kolpakov was sentenced to seven years in custody in the United States.
FIN7 member Fedir Hladyr was sentenced to 10 years in prison in the United States. The Record also identifies him as the suspected Carbanak leader arrested in Germany.
Denys Iarmak was transferred from Thailand to U.S. custody following extradition proceedings.
After initially fighting extradition, Denys Iarmak consented to extradition in a Thai court.
Denys Iarmak was arrested in Bangkok, Thailand, at the request of U.S. law enforcement.
The U.S. Department of Justice announced that three members of FIN7 were in custody for their role in attacking over 100 U.S. companies.
Additional Carbanak suspects were arrested in Germany and Ukraine in August 2018 and extradited to the United States to face charges.
The first Carbanak member was arrested in Spain as part of international action against the group.
After the 2018 arrests, the Carbanak group fragmented into smaller cells that continued targeting the financial sector, with some also engaging in ransomware.
On or about March 3, 2017, Denys Iarmak updated a JIRA issue for a victim company and uploaded data he had stolen from that company.
According to U.S. prosecutors, Denys Iarmak participated in FIN7 operations from approximately November 2016 through November 2018 as a high-level hacker or "pen tester."
Two later-convicted Carbanak members hacked the IT systems of several Kazakh banks between 2016 and 2017, stealing more than 2 billion tenges and attempting to steal 8 billion more.
ESET published research linking multiple malware families to ongoing Carbanak operations and describing use of exploits including CVE-2015-1770 and CVE-2015-2426.
Securelist published "The Great Bank Robbery: the Carbanak APT," documenting the Carbanak operation targeting banks. The reference anchors this publication in February 2015.
The DOJ said FIN7, also referred to as the Carbanak Group and Navigator Group, had engaged in a sophisticated malware campaign against hundreds of U.S. companies since at least 2015.
By 2015, a Kaspersky investigation found Carbanak had breached more than 100 banks in 40 countries and stolen more than $1 billion.
Kazakh officials said the Carbanak cybercrime group was first observed in 2013.
Denys Iarmak was sentenced in the Western District of Washington to five years in prison for his role in FIN7's hacking operations.
A Kazakhstan court sentenced two unnamed Carbanak members to eight years in prison for hacking several Kazakh banks and stealing millions of dollars.
An ESET report described a late-August attempt to compromise a U.S. casino hotel's network, likely via spearphishing, to reach point-of-sale payment systems.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 98 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See what this changes for your reporting obligations and which controls it puts on the clock.
5 references tracked. Mallory keeps watching after this page renders.
justice.gov
Open sourcetherecord.media
Open sourcejustice.gov
Open sourcewelivesecurity.com
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
FIN7 has been profiled by multiple security and law-enforcement sources as a Russian-speaking cybercrime group that evolved from large-scale payment-card theft into ransomware operations. The group is described as operating with a corporate-like structure, using front companies including **Combi Security**, **IPC**, and **Bastion Secure** to recruit technical staff, and relying on phishing, software supply-chain compromise, and mailed **BadUSB** devices for initial access. Researchers and government reporting tie FIN7 to a broad toolkit including **Carbanak**, **Bateleur**, **Griffon/Harpy**, **Lizar**, **Cobalt Strike**, and PowerShell-based tooling, while intelligence reporting says investigators obtained insight into the gang’s internal organization, infrastructure, victim targeting, and member communications. U.S. prosecutors said FIN7 compromised hundreds of companies, breached more than 6,500 point-of-sale terminals across over 3,600 business locations, and stole more than 20 million payment-card records, causing losses estimated above **$1 billion**; in one case, high-level member **Andrii Kolpakov** was sentenced to seven years in prison. Separate reporting and government assessments say FIN7 later moved into big-game-hunting ransomware and was linked to **Sodinokibi**, **DarkSide**, and later **BlackMatter**, though attribution to **ALPHV** remained unconfirmed by ANSSI. Reporting on DarkSide’s collapse after the Colonial Pipeline incident also showed affiliates publicly disputing unpaid ransom shares on the **XSS** forum, underscoring the instability inside the ransomware ecosystem tied to groups that security researchers have associated with FIN7.
Aug 15, 2026
The United States sentenced **Yaroslav Vasinskyi** (`Rabotnik`), a Ukrainian affiliate of the **Sodinokibi/REvil** ransomware operation, to **13 years and 7 months** in prison for his role in more than **2,500 attacks** that collectively sought over **$700 million** in ransom payments. Prosecutors said the scheme encrypted victim networks, threatened to leak stolen data, and used cryptocurrency exchangers and mixing services to launder proceeds; the court also ordered more than **$16 million** in restitution. U.S. authorities said related forfeiture actions recovered assets including **39.89138522 Bitcoin** and **$6.1 million**, and credited cooperation with Polish authorities for Vasinskyi’s extradition and prosecution. In a separate but related enforcement action, **Deniss Zolotarjovs**, a Latvian national tied to the **Karakurt** extortion operation and linked by investigators to the broader **Conti** ecosystem, was sentenced to **102 months** in prison after U.S. prosecutors accused him of helping pressure victims with stolen data, reviving unresolved extortion cases, and laundering cryptocurrency. Authorities said the Russian-linked group targeted more than **54 companies worldwide**, including victims whose stolen records included sensitive medical information, and generated losses exceeding **$56 million** across 13 victims with roughly **$13 million** more paid by 41 additional companies. The cases underscore sustained cross-border law enforcement action against ransomware and data-extortion actors operating through Russia-linked criminal networks.
Jun 29, 2026
Recent court actions highlighted multiple **cyber-enabled crimes** resulting in prison sentences and follow-on legal measures. In the US, federal authorities announced sentencing and impending deportation of two Venezuelan nationals tied to a multi-state **ATM jackpotting** scheme that used **Ploutus** malware to force cash-out from legacy ATMs, with theft totaling hundreds of thousands of dollars and investigations linking activity to a broader network associated with **Tren de Aragua**. Separately in France, a Romanian national was sentenced in Paris to a five-year term with one year suspended (effectively four years to serve) for involvement in **ransomware** attacks using the **“Umbrella”** ransomware, with reported damages nearing €1 million and related cases spanning multiple European countries. In a separate, unrelated case, **Ilya Lichtenstein**—convicted for stealing **120,000 bitcoins**—publicly sought a “second chance” and a cybersecurity job after serving a 60-month sentence and being moved to home confinement, citing efforts to rehabilitate and cooperate. Collectively, the reporting underscores ongoing law-enforcement focus on financially motivated cybercrime ranging from malware-assisted physical compromise of financial infrastructure to enterprise-targeting ransomware, alongside continued public attention on high-profile cryptocurrency theft prosecutions.
Jun 29, 2026