International "Malvertiser" Extradited from the Netherlands to Face Hacking Charges in New Jersey

https://www.justice.gov/opa/pr/international-malvertiser-extradited-netherlands-face-hacking-charges-new-jersey

Department of Justice
Office of Public Affairs

FOR IMMEDIATE RELEASE
Friday, May 3, 2019

International “Malvertiser” Extradited from the Netherlands to Face Hacking Charges in New Jersey

A Ukrainian national charged with participating in a years-long, international scheme to infect computers with malware through online advertisements – so-called “malvertising” – will appear in Newark, New Jersey federal court today after being extradited from the Netherlands, Assistant Attorney General Brian A. Benczkowski of the Justice Department’s Criminal Division and U.S. Attorney Craig Carpenito for the District of New Jersey announced.

Oleksii Petrovich Ivanov, 31, is charged by indictment with one count of conspiracy to commit wire fraud, four counts of wire fraud, and one count of computer fraud. The indictment was returned on Dec. 3, 2018, and unsealed upon his arrival in the United States on May 2, 2019. Ivanov is scheduled to appear today before U.S. Magistrate Judge James B. Clark III in Newark federal court and was detained without bail.
(snip)

According to the indictment, unsealed in Newark federal court on May 2, 2019, and other court filings, between around October 2013 through May 2018, Ivanov conspired to defraud millions of internet users around the world by launching malicious online advertising campaigns that appeared legitimate, but attempted to direct the internet browsers of victim computers towards malicious computer programs (“malware”), unwanted advertisements, and other computers that could install malware. As a result of the scheme, Ivanov and others caused unsuspecting internet users to view or access malicious advertisements on more than one hundred million occasions.

Online advertising companies work with companies and individuals to publish their online advertisements on the internet. These companies place advertisements on third-party websites, such as shopping, news, entertainment, or sports websites. These advertisements include web banners, frame ads, and other graphical advertisements and are delivered through websites that are accessed by computer users.

To carry out the scheme, Ivanov and co-conspirators are alleged to have used fake online personas and fake companies to pose as legitimate advertisers seeking to purchase online advertisements. According to the indictment, Ivanov and his co-conspirators told the advertising companies they were distributing ads for real products and services, and even created false banners and websites showing purported advertisements. But, in reality, the advertisements they purchased were used to push malware out to the computers of victims who viewed or clicked on the advertisements.

For instance, in June and July 2014, the defendant allegedly posed as “Dmitrij Zaleskis,” CEO of a fake United Kingdom company called “Veldex Limited” to submit a series of malicious advertisements to a U.S.-based internet advertising company for distribution, including two campaigns submitted on July 15, 2014 that were viewed or accessed approximately 17,328,129 times in a matter of days. The internet advertising company repeatedly told Ivanov that his advertisements were being flagged as malware threats, but Ivanov denied any wrongdoing and persuaded the company to continue running his malicious advertisements for months.

After online advertisers and advertising server platforms flagged many of the co-conspirators’ advertisements as malicious, Ivanov and others are alleged to have lied and denied that their advertisements were malicious. When their advertisments were banned as malicious, they switched to new online advertising companies and used new fake identities to buy more advertisements.

Ivanov and co-conspirators also allegedly used false identities to register internet domains that hosted malicious advertisements, and launch purported advertising campaigns. Ivanov and others also allegedly attempted to enrich themselves by offering to sell access to networks of infected devices or “botnets. Ivanov is alleged to have successfully infected or aided and abetted the infection of computers with malware that he controlled, including botnet malware that infected more than one hundred devices in the District of New Jersey.
(snip)