Loading story…
Ukrainian national Mark Sokolovsky was sentenced to five years in prison for his role in operating Raccoon Stealer, a malware-as-a-service infostealer that prosecutors said was rented to other criminals for $75 per week or $200 per month in cryptocurrency. U.S. authorities said the platform infected millions of computers and stole more than 52 million credentials along with cryptocurrency wallets, payment card data, email records, and other sensitive information later used in fraud, identity theft, and ransomware attacks. Sokolovsky was arrested in the Netherlands in March 2022, extradited to the United States in February 2024, and later pleaded guilty after being charged with fraud, money laundering, and aggravated identity theft.
The case followed a coordinated FBI and European law enforcement operation that dismantled Raccoon Stealer infrastructure in the Netherlands and Italy and led to the launch of the FBI victim-notification portal at raccoon.ic3.gov. Independent research by Team Cymru linked Raccoon’s management activity to Kharkiv, Ukraine, identified a Tor-based customer panel and Telegram update server, and tied the operation to the CC2BTC stolen-card marketplace, suggesting the operators monetized victim data both by leasing the malware and by reselling stolen payment cards. Despite the takedown, the malware family later resurfaced as Recordbreaker, also described as Raccoon Stealer v2, with a rewritten codebase and updated delivery and exfiltration features.
Pull IOCs and campaign context straight into your stack.
13 events from the most recent confirmed update back to the earliest known activity.
On December 18, 2024, Mark Sokolovsky was sentenced to five years in prison for his role in the Raccoon Stealer operation.
BleepingComputer reported that Mark Sokolovsky was extradited from the Netherlands to the United States in February 2024 following the earlier indictment and extradition ruling.
On October 25, 2022, the U.S. Department of Justice unsealed an indictment charging Mark Sokolovsky over his alleged role in operating the Raccoon Infostealer malware-as-a-service platform.
The Amsterdam District Court granted Mark Sokolovsky's extradition to the United States on September 13, 2022, according to the Justice Department.
Team Cymru said Raccoon Stealer re-emerged in early June 2022 as version two after the disruption of the original service.
Team Cymru reported that Raccoon Stealer V1 ceased operations in late March 2022 after the operators said they had lost a developer during Russia's invasion of Ukraine.
In March 2022, the FBI and law enforcement partners in Italy and the Netherlands dismantled the digital infrastructure supporting Raccoon Stealer and took the then-current version offline.
Dutch authorities arrested alleged Raccoon operator Mark Sokolovsky in March 2022 as part of the international investigation into the malware-as-a-service operation.
Team Cymru reported that a host it labeled "Possible Marketplace," tied to the same operators as Raccoon, began making outbound TCP/2049 connections to a Lithuanian VPS provider labeled NFS Server in October 2021.
From 2021 onward, the same two external IP addresses connected over SSH to several key Raccoon hosts, and WHOIS data linked those management IPs to TRIOLAN infrastructure in Kharkiv, Ukraine.
Passive DNS data cited by Team Cymru showed that the Telegram Update Server hosted a domain containing the string "raccoon-core" in late 2019, indicating early infrastructure associated with the operation.
One year after the indictment, Mark Sokolovsky pleaded guilty in the U.S. case and agreed to pay at least $910,844.61 in restitution, according to court reporting summarized by BleepingComputer.
After the March 2022 takedown, the FBI created the raccoon.ic3.gov portal to let potential victims check whether their email addresses or data appeared in recovered Raccoon stolen data.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
5 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourceg0njxa.medium.com
Open sourceteam-cymru.com
Open sourcejustice.gov
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Raccoon Stealer, a malware-as-a-service infostealer sold on underground forums since 2019, was widely distributed through pirated software, fake cracks, game cheats, phishing, and large YouTube-based lure campaigns. Researchers tied deliveries to fake Microsoft Office and Adobe Photoshop cracks, hijacked YouTube accounts and video descriptions, and broader ecosystems using loaders such as **Buer**, **SmokeLoader**, and **AveMaria RAT**. Once executed, the malware stole browser passwords, cookies, autofill data, credit card details, cryptocurrency wallet files, screenshots, Telegram data, and other arbitrary files, while some campaigns also dropped secondary payloads including credential theft tools and a crypto miner.
Aug 15, 2026
A U.S. federal jury convicted Russian national **Oleg Koshkin** for operating malware crypter services that helped the **Kelihos** botnet evade antivirus detection and spread malicious payloads. Prosecutors said Koshkin ran sites including **Crypt4U.com**, **Crypt4U.net**, **fud.bz**, and **fud.re**, advertising tools that made malware such as botnets, RATs, keyloggers, stealers, crypto miners, and ransomware fully undetectable. Court evidence showed Kelihos operator **Peter Levashov** paid roughly **$3,000 per month** from 2014 to 2017 for custom high-volume re-crypting, while co-defendant **Pavel Tsurkan** pleaded guilty to aiding malware infections worldwide, including ransomware attacks. The conviction builds on the broader U.S. campaign against Kelihos, a botnet active since at least 2010 that at various points controlled **60,000 to more than 100,000 compromised Windows computers**. Authorities said the botnet was used for spam, credential theft, pump-and-dump stock fraud, denial-of-service activity, and malware distribution before the FBI and partners including **CrowdStrike** and the **Shadowserver Foundation** disrupted it through a sinkholing operation and Levashov’s arrest in Spain. Investigators linked Levashov to the infrastructure through IP and account records, with reporting noting operational security mistakes such as reused credentials that helped expose him.
Aug 15, 2026
The United States sentenced **Yaroslav Vasinskyi** (`Rabotnik`), a Ukrainian affiliate of the **Sodinokibi/REvil** ransomware operation, to **13 years and 7 months** in prison for his role in more than **2,500 attacks** that collectively sought over **$700 million** in ransom payments. Prosecutors said the scheme encrypted victim networks, threatened to leak stolen data, and used cryptocurrency exchangers and mixing services to launder proceeds; the court also ordered more than **$16 million** in restitution. U.S. authorities said related forfeiture actions recovered assets including **39.89138522 Bitcoin** and **$6.1 million**, and credited cooperation with Polish authorities for Vasinskyi’s extradition and prosecution. In a separate but related enforcement action, **Deniss Zolotarjovs**, a Latvian national tied to the **Karakurt** extortion operation and linked by investigators to the broader **Conti** ecosystem, was sentenced to **102 months** in prison after U.S. prosecutors accused him of helping pressure victims with stolen data, reviving unresolved extortion cases, and laundering cryptocurrency. Authorities said the Russian-linked group targeted more than **54 companies worldwide**, including victims whose stolen records included sensitive medical information, and generated losses exceeding **$56 million** across 13 victims with roughly **$13 million** more paid by 41 additional companies. The cases underscore sustained cross-border law enforcement action against ransomware and data-extortion actors operating through Russia-linked criminal networks.
Jun 29, 2026