More light has been shed on this summer’s arrests of individuals tied to the Affactive and Revenuejet online gambling groups.
On Tuesday, US Attorney General Loretta Lynch and US Attorney for the Southern District of New York Preet Bharara released superseding indictments charging Gery Shalon, Joshua Samuel Aaron and Ziv Orenstein with hacking JPMorgan Chase & Co, as well as similar hacks on other major financial companies and media outlets, including the Wall Street Journal.
The accused face a litany of charges including hacking, wire fraud, securities fraud, identification document fraud (involving over 30 bogus passports), operating an illegal gambling business, violating the Unlawful Internet Gambling Enforcement Act (UIGEA), aggravated identity theft, operating an unlicensed money transmitting business, money laundering and conspiracy.
Shalon and Orenstein, both Israel citizens, were arrested in Israel in July and are awaiting extradition to the US. Aaron, a US citizen, remains at large.
ACCUSED READ RIVAL OPERATORS’ EMAILS, LAUNCHED DDOS ATTACKS
The new indictment (read it here) also charges Shalon, Orenstein and their accomplices with operating “at least 12” illegal online casinos, which generated “millions of dollars in profits per month” via their US-facing activity between 2007 and the July arrests. Shalon is said to have stashed $100m in bank accounts in Switzerland and other jurisdictions, the possible seizure of which likely has the feds salivating like Pavlovian dogs.
The accused also hacked rival gambling operators in order to steal customer databases and, while it’s not in the indictment, are believed to have manipulated thousands of mostly inactive blogs via a WordPress exploit to push Affactive gambling sites to the top of Google search rankings.
The indictment notes that the accused repeatedly spammed US gamblers, aka “email promotions distributed on a massive scale.” Shalon also read the emails of top execs at other online gambling companies and targeted same with distributed denial of service (DDOS) attacks “in response to perceived misconduct by [the sites] directed at Shalon’s casinos.”
Shalon also broke into the email accounts of online gambling software developers “to ensure that the companies’ work with Shalon’s competitors did not, in Shalon’s view, compromise the success of Shalon’s unlawful internet gambling businesses.”
DON’T OPERATE A BITCOIN EXCHANGE WITHIN THE US, PEOPLE
The accused trio operated multinational payment processors to facilitate transactions with their online casinos and other businesses, including unlawful pharmaceutical distributors, counterfeit software/malware distributors and the Florida-based Bitcoin exchange Coin.mx.
A fourth defendant, Anthony Murgio, was also arrested in the US in July in connection with the operation of Coin.mx. (Read Murgio’s indictment here.)
To facilitate business with the Coin.mx site, Murgio reportedly opened US bank accounts under the name Collectable’s Club, while maintaining a website under the same name that claimed to cater to members looking to sell items like stamps and sports memorabilia. (What? No golf balls? Rookies…)
PUMP, DUMP, DO A SHOT
The indictment accuses the main trio of thieving the personal info of over 100m individuals, including 80m from JPMorgan alone, which represents the single largest theft of customer data in US history. The trio is accused of using the stolen information to target investors in elaborate pump-and-dump stock schemes between 2012 and 2015.
The indictments contain some humorous exchanges involving the accused, including one conversation in which a co-conspirator asks Shalon if trading stocks is really that popular in America, to which Shalon replies that it was “like drinking freaking vodka in Russia.”
