Loading story…
Russian national and web developer Sergei Anatolyevich Filimonov, 36, was extradited from the Republic of Georgia to the United States on allegations that he helped operate a bank-account takeover and wire-fraud scheme. Prosecutors allege that from November 2023 through October 2025, Filimonov and co-conspirators purchased sponsored-search advertisements, impersonated bank domains, and deployed fraudulent banking login pages to steal customer credentials and facilitate unauthorized wire transfers.
The alleged operation maintained infrastructure to retain stolen credentials and gather information used to bypass bank security controls. U.S. authorities linked a December 2025 seizure of web3adspanels.org and its stolen-password database to at least 19 U.S. victims, about $28 million in attempted losses, and roughly $14.6 million in confirmed losses; alleged transfers involving two banks in June and November 2024 totaled nearly $6.315 million. Filimonov pleaded not guilty in the Northern District of Georgia on September 4 and remains in custody.
See the reporting duties and controls this puts on the clock.
7 events from the most recent confirmed update back to the earliest known activity.
Filimonov pleaded not guilty in federal court in Atlanta and remained detained in the Northern District of Georgia.
U.S. authorities seized web3adspanels.org, a domain allegedly used to store credentials harvested through spoofed banking sites. Authorities said it contained credentials for thousands of victims; the FBI linked it to at least 19 U.S. victims, roughly $28 million in attempted losses, and about $14.6 million in confirmed losses.
A federal grand jury indicted Filimonov on charges including conspiracy to commit bank and wire fraud, access-device-fraud conspiracy, bank fraud, wire fraud, access-device fraud, and aggravated identity theft.
Prosecutors allege the group caused or attempted an unauthorized transfer of $735,000 from another unnamed bank.
Prosecutors allege the group caused or attempted an unauthorized transfer of nearly $5.58 million from an unnamed bank.
Prosecutors allege that Sergei Anatolyevich Filimonov and co-conspirators began using spoofed banking domains, sponsored search advertisements, and fraudulent login pages to steal online-banking credentials. The group allegedly built infrastructure to retain credentials and obtain information to bypass bank security controls.
U.S. authorities extradited the 36-year-old Russian web developer from the Republic of Georgia to face charges over the alleged bank-account takeover and wire-fraud scheme.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See what this changes for your reporting obligations and which controls it puts on the clock.
8 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcedatabreaches.net
Open sourcedecipher.sc
Open sourcecyberscoop.com
Open sourcetherecord.media
Open sourcejustice.gov
Open sourcejustice.gov
Open sourcejustice.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Russian national **Searzhudin Tamirlanovich Aktulaev** was extradited from Cyprus to the United States to face federal charges over an alleged 2016–2017 phishing operation that compromised more than 80,000 computers. Prosecutors allege Aktulaev and co-conspirators created roughly 255 fraudulent accounts on a freelance-employment platform and sent targets malicious Excel attachments designed to persuade them to enable macros. The macro-enabled files allegedly downloaded the **TVRAT** and **DarkVNC** remote-access trojans, allowing the operators to steal victim information and exfiltrate it through U.S.-hosted command-and-control infrastructure. The campaign affected thousands of victims, approximately half in the United States; Aktulaev faces charges including conspiracy, computer-damage offenses, and aggravated identity theft, with potential penalties of up to 20 years in prison.
Sep 4, 2026
The U.S. Department of Justice announced the seizure of the domain `web3adspanels[.]org`, which was used as a backend control panel for a sophisticated bank account takeover fraud operation targeting Americans. The criminal group behind the scheme purchased fraudulent advertisements on major search engines such as Google and Bing, which closely mimicked legitimate banking ads. Unsuspecting users who clicked these ads were redirected to counterfeit bank websites, where their login credentials were harvested using malicious code. The attackers then used these credentials to access real bank accounts and steal funds, resulting in at least $14.6 million in confirmed losses and $28 million in attempted thefts from 19 identified victims, including two companies in Georgia. The seized domain stored thousands of stolen credentials and supported the fraud operation as recently as November 2025. The FBI’s Internet Crime Complaint Center (IC3) has received over 5,100 complaints related to similar bank account takeover schemes since January 2025, with reported losses exceeding $262 million. The takedown of the domain is part of a broader law enforcement effort to disrupt the infrastructure enabling these attacks and prevent further exploitation of stolen credentials.
Jun 29, 2026
Dutch courts cleared the extradition of Russian national **Vladimir Drinkman** to the United States in a case prosecutors described as the largest hacking and data-breach conspiracy ever prosecuted there. U.S. authorities alleged Drinkman and four co-defendants used **SQL injection**, malware backdoors, and network sniffers to penetrate payment processors, retailers, and financial institutions, stealing more than **160 million** credit and debit card numbers over several years and causing hundreds of millions of dollars in losses. Victims named in court filings included **Heartland Payment Systems**, **7-Eleven**, **Hannaford**, **Carrefour**, **JetBlue**, **Global Payments**, **Dow Jones**, and **NASDAQ**, though prosecutors said the NASDAQ intrusion did not affect its trading platform. The prosecution tied the operation to the broader payment-card theft ecosystem exposed in earlier cases involving **Albert Gonzalez**, who had already been accused of orchestrating some of the largest U.S. retail breaches. After his transfer to the United States, Drinkman later admitted his role in the conspiracy, marking a major step in a long-running investigation into an international crew that allegedly harvested card data from corporate networks and sold it through criminal resellers. The case underscored how a small group of Russian and Eastern European defendants allegedly sustained long-term access inside major companies and monetized stolen payment data at unprecedented scale.
Jun 29, 2026