The U.S. Department of Justice (DOJ) has charged two Ukrainians with participating in a plot to hack into computers systems at the U.S. Securities and Exchange Commission (SEC) and use the information they stole to commit fraud.
On 15 January, the U.S. Attorney’s Office for the District of New Jersey announced a 16-count indictment charging Artem Radchenko, 27, and Oleksandr Ieremenko, 26, both of Kiev, Ukraine, with securities fraud conspiracy, wire fraud conspiracy, computer fraud conspiracy, wire fraud and computer fraud.
The court document alleges that Radchenko, Ieremenko and others plotted to gain unauthorized access to the SEC’s Electronic Data Gathering, Analysis and Retrieval (EDGAR) system, which companies can use to make test filing prior to submitting a public filing. The co-conspirators allegedly used directory traversal attacks, phishing campaigns and malware between February 2016 and March 2017 to gain access to the EDGAR system’s networks.
Upon gaining access to the system, the individuals stole thousands of test filings and exfiltrated them to a server under their control in Lithuania. They then attempted to profit on that information by trading on them before the public learned of the information contained in those test filings.
This isn’t the first time that the DOJ has announced charges against Ieremenko. Back in 2015, Ieremenko was one of nine men charged by the DOJ with hacking into three newswires, stealing yet-to-be-published press releases and passing this stolen information to approximately two dozen individuals who then traded on the bulletins before their public release. The DOJ issued an international warrant for the arrest of Ieremenko and three of his co-conspirators, but as the United States and Ukraine don’t have an extradition treaty, Ieremenko has yet to stand trial in an American court.
Assistant Attorney General Brian Benczkowski feels that these latest charges against Ieremenko and Radchenko reflect the extent to which the Ukrainians attempted to manipulate the market to their advantage. As quoted in a DOJ press release:
The defendants allegedly orchestrated sophisticated computer intrusions to steal non-public information from the SEC, compromising the integrity of the market and depriving honest investors of a level playing field. The Department of Justice will aggressively pursue and prosecute those who attack our financial markets and seek to profit unfairly, no matter where such offenders reside.
The two men face 20 years in prison and a $250,000 fine, or twice the gain or loss from their offense, for the wire fraud conspiracy and substantive wire fraud counts. They also face five years in prison and a $250,000 fine, or twice the gain or loss from the offense, for the securities fraud conspiracy, computer fraud conspiracy and substantive computer fraud counts.