![\"\"](\"https:\/\/wrolf.net\/blog\/wp-content\/uploads\/2018\/07\/800px-Director_Robert_S._Mueller-_III-240x300.jpg\")
<\/p>\n<\/p>\n<\/p>\n<\/p>\n
IN THE UNITED STATES DISTRICT COURT
\nFOR THE DISTRICT OF COLUMBIA<\/p>\n
UNITED STATES OF AMERICA
\nV.<\/p>\n
VIKTOR BORISOVICH NETYKSHO,
\nBORIS ALEKSEYEVICH ANTONOV,
\nDMITRIY SERGEYEVICH BADIN,
\nIVAN SERGEYEVICH YERMAKOV,
\nALEKSEY VIKTOROVICH LUKASHEV,
\nSERGEY ALEKSANDROVICH MORGACHEV,
\nNIKOLAY YURYEVICH KOZACHEK,
\nPAVEL VYACHESLAVOVICH YERSHOV,
\nARTEM ANDREYEVICH MALYSHEV,
\nALEKSANDR VLADIMIROVICH OSADCHUK,
\nALEKSEY ALEKSANDROVICH POTEMKIN, and
\nANATOLIY SERGEYEVICH KOVALEV, <\/p>\n
Defendants. <\/p>\n
CRIMINAL NO.<\/p>\n
(18 U.S.C. §§2,371,1030,1956,
\nand 3551 et seq.)<\/p>\n
INDICTMENT<\/p>\n
The Grand Jury for the District of Columbia charges:<\/p>\n
COUNT ONE
\n(Conspiracy to Commit an Offense Against the United States)<\/p>\n
1. In or around 2016, the Russian Federation (Russia) operated a military intelligence agency called the Main Intelligence Directorate of the General Staff The GRU had multiple units, including Units 26165 and 74455, engaged in cyber operations that involved the staged releases of documents stolen through computer intrusions. These units conducted large-scale cyber operations to interfere with the 2016 US. presidential election.<\/p>\n
2. Defendants VIKT OR BORISOVICH BORIS ALEKSEYEVICH
\nANTONOV, DMITRIY SERGEYEVICH IVAN SERGEYEVICH YERMAKOV,
\nALEKSEY VIKTOROVICH LUKASHEV, SERGEY ALEKSANDROVICH MORGACHEV,
\nNIKOLAY YURYEVICH KOZACHEK, PAVEL VYACHESLAVOVICH YERSHOV, ARTEM
\nANDREYEVICH ALEKSANDR VLADIMIROVICH OSADCHUK, and
\nALEKSEY ALEKSANDROVICH POTENIKIN were GRU officers who knowingly and
\nintentionally conspired with each other, and with persons known and unknown to the Grand Jury
\n(collectively the Conspirators), to gain unauthorized access (to hack) into the computers of
\nU.S. persons and entities involved in the 2016 U.S. presidential election, steal documents from
\nthese computers, and stage releases of the stolen documents to interfere with the 2016 U.S.
\npresidential election.<\/p>\n
3. Starting in at least March 2016, the Conspirators used a variety of means to hack the email
\naccounts of Volunteers and employees of the U.S. presidential campaign of Hillary Clinton (the
\nClinton Campaign), including the email account of the Clinton Campaign’s chairman.<\/p>\n
4. By in or around April 2016, the Conspirators also hacked into the computer networks of
\nthe Democratic Congressional Campaign Committee and the Democratic National
\nCommittee The Conspirators covertly monitored the computers of dozens of
\nand DNC employees, implanted hundreds of files containing malicious computer code
\n(?malware?), and stole emails and other documents from the and DNC.<\/p>\n
5. By in or around April 2016, the Conspirators began to plan the release of materials stolen
\nfrom the Clinton Campaign, and DNC.<\/p>\n
6. Beginning in or around June 2016, the Conspirators staged and released tens of thousands<\/p>\n
of the stolen emails and documents. They did so using fictitious online personas, including “DCLeaks” and “Guccifer 2,0”.<\/p>\n
7. The Conspirators also used the Guccifer 2.0 persona to release additional stolen documents
\nthrough a website maintained by an organization (?Organization that had previously posted
\ndocuments stolen from U.S. persons, entities, and the U.S. government. The Conspirators
\ncontinued their U.S. election-interference operations through in or around November 2016.<\/p>\n
8. To hide their connections to Russia and the Russian government, the Conspirators used
\nfalse identities and made false statements about their identities. To further avoid detection, the
\nConspirators used a network of computers located across the world, including in the United States,
\nand paid for this infrastructure using cryptocurrency.<\/p>\n
Defendants<\/p>\n
9. Defendant VIKTOR BORISOVICH was
\nthe Russian military officer in command of Unit 26165, located at 20 Komsomolskiy Prospekt,
\nMoscow, Russia. Unit 26165 had primary responsibility for hacking the and DNC, as well
\nas the email accounts of individuals affiliated with the Clinton Campaign.<\/p>\n
10. Defendant BORIS ALEKSEYEVICH ANTONOV was a
\nMajor in the Russian military assigned to Unit 26165. ANTONOV oversaw a department within
\nUnit 26165 dedicated to targeting military, political, governmental, and non-governmental
\norganizations with spearphishing emails and other computer intrusion activity. ANTONOV held
\nthe title “Head of Department.” In or around 2016, ANTONOV supervised other co-conspirators
\nwho targeted the DNC, and individuals affiliated with the Clinton Campaign.<\/p>\n
11. Defendant DMITRIY SERGEYEVICH BADIN was a
\nRussian military officer assigned to Unit 26165 who held the title “Assistant Head of Department.”
\nIn or around 2016, BADIN, along with ANTONOV, supervised other co-conspirators who targeted
\nthe DNC, and individuals affiliated with the Clinton Campaign.<\/p>\n
I2. Defendant IVAN SERGEYEVICH YERMAKOV was a
\nRussian military officer assigned to department within Unit 26165. Since in or
\naround 2010, YERMAKOV used various online personas, including “Kate S. Milton,” “James
\nMcMorgans,” and “Karen W. Millen,” to conduct hacking operations on behalf of Unit 26165. In
\nor around March 2016, YERMAKOV participated in hacking at least two email accounts from
\nwhich campaign-related documents were released through DCLeaks. In or around May 2016,
\nYERMAKOV also participated in hacking the DNC email server and stealing DNC emails that
\nwere later released through Organization 1.<\/p>\n
13. Defendant ALEKSEY VIKTOROVICH LUKASHEV
\nwas a Senior Lieutenant in the Russian military assigned to department within Unit
\n26165. LUKASHEV used various online personas, including “Den Katenberg” and “Yuliana
\nMartynova.” In or around 2016, LUKASHEV sent spearphishing emails to members of the
\nClinton Campaign and af?liated individuals, including the chairman of the Clinton Campaign.<\/p>\n
14. Defendant SERGEY ALEKSANDROVICH MORGACHEV was a Lieutenant Colonel in the Russian military assigned to Unit 26165.
\nMORGACHEV oversaw a department within Unit 26165 dedicated to developing and managing
\nmalware, including a hacking tool used by the GRU known as “X-Agent.” During the hacking of
\nthe DC CC and DNC networks, MORGACHEV supervised the co-conspirators who developed and
\nmonitored the X-Agent malware implanted on those computers.<\/p>\n
15. Defendant NIKOLAY YURYEVICH KOZACHEK was a
\nLieutenant Captain in the Russian military assigned to department within Unit
\n26165. KOZACHEK used a variety of monikers, including “kazak” and “blablabla1234565.”
\nKOZACHEK developed, customized, and monitored X-Agent malware used to hack the DCCC
\nand DNC networks beginning in or around April 2016.<\/p>\n
16. Defendant PAVEL VYACHESLAVOVICH YERSHOV
\nwas a Russian military officer assigned to department within Unit 26165. In or
\naround 2016, . YERSHOV assisted KOZACHEK and other co-conspirators in testing and
\ncustomizing X-Agent malware before actual deployment and use.<\/p>\n
17. Defendant ARTEM ANDREYEVICH MALYSHEV was
\na Second Lieutenant in the Russian military assigned to department within Unit
\n26165. MALYSHEV used a variety of monikers, including “djangomagicdev” and “realblatr.” In
\nor around 2016, MALYSHEV monitored X-Agent malware implanted on the DCCC and DNC
\nnetworks.<\/p>\n
18. Defendant ALEKSANDR VLADIMJROVICH OSADCHUK
\nwas a Colonel in the Russian military and the commanding officer of Unit 74455 .
\nUnit 74455 was located at 22 Kirova Street, Khimki, Moscow, a building referred to within the
\nGRU as the “Tower.” Unit 74455 assisted in the release of stolen documents through the DCLeaks
\nand Guccifer 2.0 personas, the promotion of those releases, and the publication of anti-Clinton
\ncontent on social media accounts operated by the GRU.<\/p>\n
19. Defendant ALEKSEY ALEKSANDROVICH POTEMKJN
\nwas an officer in the Russian military assigned to Unit 7445 5. POTEMKIN was
\na supervisor in a department within Unit 74455 responsible for the administration of computer
\ninfrastructure used in cyber operations. Infrastructure and social media accounts administered by
\ndepartment were used, among other things, to assist in the release of stolen
\ndocuments through the DCLeaks and Guccifer 2.0 personas.<\/p>\n
20. The object of the conspiracy was to hack into the computers of U.S. persons and entities
\ninvolved in the 2016 U.S. presidential election, steal documents from those computers, and stage
\nreleases of the stolen documents to interfere with the 2016 U.S. presidential election.<\/p>\n
21. ANTONOV, BADIN, YERMAKOV, LUKASHEV, and their co-conspirators targeted 22. The Conspirators spearphished individuals affiliated with the Clinton Campaign Hacking into the Network<\/p>\n 23. Beginning in or around March 2016, the Conspirators, in addition to their spearphishing 24. By in or around April 2016, Within days of searches regarding the DCCC a. On or about April 12, 2016, the Conspirators used the stolen credentials of a DCCC Between in or around April 2016 and June 2016, the Conspirators installed multiple c. X-Agent malware implanted on the network transmitted information from d. For example, on or about April 14, 2016, the Conspirators repeatedly activated 25. On or about April 19, 2016, KOZACHEK, YERSHOV, and their co-conspirators remotely Hacking into the DNC Network<\/p>\n 26. On or about April 18, 2016, the Conspirators hacked into the computers through Theft of and DNC Documents<\/p>\n 27. The Conspirators searched for and identified computers within the DCCC and DNC 28. To enable them to steal a large number of documents at once without detection, the a. For example, on or about April 22, 2016, the Conspirators compressed gigabytes b. On or about April 28, 2016, the Conspirators connected to and tested the same 29. Between on or about May 25, 2016 and June 1, 2016, the Conspirators hacked the DNC 30. On or about May 30, 2016, 1V1ALYSHEV accessed the AMS panel in order to upgrade 31. During the hacking of the DCCC and DNC networks, the Conspirators covered their tracks 11<\/p>\n Conspirators deleted logs from the AMS panel that documented their activities on the panel,<\/p>\n including the login history.<\/p>\n Efforts to Remain on the and DNC Networks<\/p>\n 32. Despite the Conspirators? efforts to hide their activity, beginning in or around May 2016,<\/p>\n both the and DNC became aware that they had been hacked and hired a security company<\/p>\n (?Company to identify the extent of the intrusions. By in or around June 2016, Company 1<\/p>\n took steps to exclude intruders from the networks. Despite these efforts, a Linux?based version of<\/p>\n X?Agent, programmed to communicate with the GRU?registered domain remained<\/p>\n on the DNC network until in or around October 2016.<\/p>\n 33. In response to Company 1?s efforts, the Conspirators took countermeasures to maintain<\/p>\n access to the and DNC networks.<\/p>\n a.<\/p>\n On or about May 31, 2016, YERMAKOV searched for open~source information On or about June 14, 2016, the Conspirators registered the domain actblues.com, On or about June 20, 2016, after Company 1 had disabled X-Agent on the previously stolen credentials.<\/p>\n l2<\/p>\n 34. In or around September 2016, the Conspirators also successfully gained access to DNC Stolen Documents Released through DCLeaks<\/p>\n 35. More than a month before the release of any documents, the Conspirators constructed the 36. On or about June 8, 2016, the Conspirators launched the public website dcleaks.com, which 37. Starting in or around June 2016 and continuing through the 2016 US. presidential election, operations, including those they had conducted in 2015 that collected emails from individuals<\/p>\n 13<\/p>\n af?liated with the Republican Party.<\/p>\n 38. On or about June 8, 2016, and at approximately the same time that the dcleakscom website 39. On or about June 8, 2016, the Conspirators created the Twitter account @dcleaksw. The Stolen Documents Released through Guccifer 2.0 for certain words and phrases, including:<\/p>\n 14<\/p>\n 5′ . –<\/p>\n ?some hundred sheets?<\/p>\n ?some hundreds of sheets? illuminati<\/p>\n mnpono useec’rnm? nepeaon ?worldwide known? ?company?s competence?<\/p>\n 42. Later that day, at 7:02 PM Moscow Standard Time, the online persona Guccifer 2.0 Worldwide known cyber security company [Company 1] announced that I?m very pleased the company appreciated my skills so . <\/p>\n Here are just a few does from many thousands I extracted when hacking Some hundred sheets! This?s a serious case, isn?t it? . <\/p>\n I guess [Company 1] customers should think twice about company?s the Illuminati and their <\/p>\n 43. Between in or around June 2016 and October 2016, the Conspirators used Guccifer 2.0 to a. On or about August 15, 2016, the Conspirators, posing as Guccifer 2.0, received a<\/p>\n 15<\/p>\n request for stolen documents from a candidate for the U.S. Congress. The b. On or about August 22, 2016, the Conspirators, posing as Guccifer 2.0, transferred 0. On or about August 22, 2016, the Conspirators, posing as Guccifer 2.0, sent a 44. The Conspirators, posing as Guccifer 2.0, also communicated with US. persons about the 45. The Conspirators conducted operations as Guccifer 2.0 and DCLeaks using overlapping a. For example, between on or about March 14, 2016 and April 28, 2016, the<\/p>\n 16<\/p>\n Conspirators used the same pool of bitcoin funds to purchase a virtual private U.S. reporter with an offer to provide stolen emails from ?Hillary Clinton?s staff.? 46. On or about January 12, 2017, the Conspirators published a statement on the Guccifer 2.0<\/p>\n WordPress blog, falsely claiming that the intrusions and release of stolen documents had ?totally<\/p>\n no relation to the Russian government.?<\/p>\n Use of Organization 1<\/p>\n 47. In order to expand their interference in the 2016 U.S. presidential election, the Conspirators a. On or about June 22, 2016, Organization I sent a private message to Guccifer 2.0<\/p>\n to ?[s]end any new material [stolen from the here for us to review and it will<\/p>\n 17<\/p>\n have a much higher impact than what you are doing.? On or about July 6, 2016, b. After failed attempts to transfer the stolen documents starting in late June 2016, on 48. On or about July 22, 2016, Organization 1 released over 20,000 emails and other<\/p>\n documents stolen from the DNC network by the Conspirators. This release occurred<\/p>\n approximately three days before the start of the Democratic National Convention. Organization 1<\/p>\n did not disclose Guccifer 2.0?s role in providing them. The latest-in?time email released through<\/p>\n Organization 1 was dated on or about May 25, 2016, approximately the same day the Conspirators<\/p>\n hacked the DNC Microsoft Exchange Server.<\/p>\n 49. On or about October 7, 2016, Organization 1 released the ?rst set of emails from the<\/p>\n chairman of the Clinton Campaign that had been stolen by LUKASHEV and his co~conspirators.<\/p>\n Between on or about October 7, 2016 and November 7, 2016, Organization 1 released<\/p>\n 18<\/p>\n approximately thirty-three tranches of documents that had been stolen from the chairman of the<\/p>\n Clinton Campaign. In total, over 50,000 stolen documents were released.<\/p>\n Statutory Allegations if fully set forth herein.<\/p>\n 51. From at least in or around March 2016 through November 2016, in the District of Columbia a. To knowingly access a computer without authorization and exceed authorized b. To knowingly cause the transmission of a program, information, code, and 52. In furtherance of the Conspiracy and to effect its illegal objects, the Conspirators<\/p>\n committed the overt acts set forth in paragraphs 1 through 19, 21 through 49, 55, and 57 through<\/p>\n 19<\/p>\n 64, which are re-alleged and incorporated by reference as if fully set forth herein.<\/p>\n 53. In furtherance of the Conspiracy, and as set forth in paragraphs 1 through 19, 21 through Allin Violation of Title 18, United States Code, Sections 371 and 3559(g)(1).<\/p>\n COUNTS TWO THROUGH NINE 54. Paragraphs 1 through 19, 21 through 49, and 57 through 64 of this Indictment are re-alleged 55. On or about the dates specified below, in the District of Columbia and elsewhere, that the means of identi?cation belonged to another real person:<\/p>\n 20<\/p>\n – Victim – Mmus-ofidenti?cation <\/p>\n 2 March 21, 2016 Victim 3 Usemame and Password for All in violation of Title 18, United States Code, Sections 1028A(a)(1) and 2.<\/p>\n I COUNT TEN 56. Paragraphs 1 through 19, 21 through 49, and 55 are re?alleged and incorporated by reference 57. To facilitate the purchase of infrastructure used in their hacking activity?including hacking 58. Although the Conspirators caused transactions to be conducted in a variety of currencies, and otherwise making payments in furtherance of hacking activity. Many of these payments were<\/p>\n 21<\/p>\n processed by companies located in the United States that provided payment processing services to 59. All bitcoin transactions are added to a public ledger called the Blockchain, but the 60. The Conspirators used several dedicated email accounts to track basic bitcoin transaction 61. On occasion, the Conspirators facilitated bitcoin payments using the same computers that<\/p>\n they used to conduct their hacking activity, including to create and send test spearphishing emails.<\/p>\n 22<\/p>\n Additionally, one of these dedicated accounts was used by the Conspirators in or around 2015 to 62. The Conspirators funded the purchase of computer infrastructure for their hacking activity 63. In addition to mining bitcoin, the Conspirators acquired bitcoin through a variety of means 64. The Conspirators used the same funding structure?end in some cases, the very same pool a. The bitcoin mining operation that funded the registration payment for dcleaks.com qooqle.com and <\/p>\n 23<\/p>\n b. On or about March 14, 2016, using funds in a bitcoin address, the Conspirators 0. The Conspirators used a different set of ?ctitious names (including ?Ward Statutorv Allegations<\/p>\n 65. From at least in or around 2015 through 2016, within the District of Columbia and All in Violation of Title 18, United States Code, Section 1956(h).<\/p>\n 24<\/p>\n COUNT ELEVEN 66. Paragraphs 1 through 8 of this Indictment are re-alleged and incorporated by reference as Defendants<\/p>\n 67. Paragraph 18 of this Indictment relating to ALEKSANDR VLADIMIROVICH 68. Defendant ANATOLIY SERGEYEVICH KOVALEV (Koaanea AHaTonnii CepreeBnLr) 69. Defendants OSADCHUK and KOVALEV were GRU of?cers who knowingly and Obiect of the Conspiracy<\/p>\n 70. The object of the conspiracy was to hack into protected computers of persons and entities Manner and Means of the Conspiracy<\/p>\n 71. In or around June 2016, KOVALEV and his co?conspirators researched domains used by addresses, including ?ltered queries for email addresses listed on state Republican Party websites.<\/p>\n 25<\/p>\n 72. In or around July 2016, KOVALEV and his co-conspirators hacked the website of a state 73. In or around August 2016, KOVALEV and his co-conspirators hacked into the computers 74. In or around August 2016, the Federal Bureau of Investigation issued an alert about the 75. In or around October 2016, KOVALEV and his co-conspirators further targeted state and 76. In or around November 2016 and prior to the 2016 U.S. presidential election, KOVALEV Conspirators embedded into Word documents bearing Vendor 1?s logo.<\/p>\n Statutory Allegations<\/p>\n 77. Between in or around June 2016 and November 2016, in the District of Columbia and<\/p>\n 26<\/p>\n elsewhere, Defendants OSADCHUK and KOVALEV, together with others known and unknown a. To knowingly access a computer without authorization and exceed authorized b. To knowingly cause the transmission of a program, information, code, and 78. In furtherance of the Conspiracy and to effect its illegal objects, OSADCHUK, All in violation of Title 18, United States Code, Section 371.<\/p>\n ORFEITURE ALLEGATION<\/p>\n 79. Pursuant to Federal Rule of Criminal Procedure 32.2, notice is hereby given to Defendants convictions under Counts One, Ten, and Eleven of this Indictment. Pursuant to Title 18, United<\/p>\n 27<\/p>\n States Code, Sections 982(a)(2) and 1030(i), upon conviction of the offenses charged in Counts Substitute Assets<\/p>\n 80. If any of the property described above as being subject to forfeiture, as a result of any act or<\/p>\n omission of any Defendant —<\/p>\n a. cannot be located upon the exercise of due diligence;<\/p>\n b. has been transferred or sold to, or deposited with, a third party;<\/p>\n c. has been placed beyond the jurisdiction of the court;<\/p>\n has been substantially diminished in value; or<\/p>\n e. has been commingled with other property that cannot be subdivided without it is the intent of the United States of America, pursuant to Title 18, United States Code, Section<\/p>\n 28<\/p>\n 982(b) and Title 28, United States Code, Section 2461(0), incorporating Title 21, United States Pursuant to 18 U.S.C. 982 and 1030(i); 28 U.S.C. 2461(0).<\/p>\n 2.224%;<\/p>\n Robert S. Mueller, 111 “r US. Department of Justice <\/p>\n A TRUE BILL:<\/p>\n Foreperson<\/p>\n Date: July 13, 2018<\/p>\n 29<\/p>\n","protected":false},"excerpt":{"rendered":" IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA UNITED STATES OF AMERICA V. VIKTOR BORISOVICH NETYKSHO, BORIS ALEKSEYEVICH ANTONOV, DMITRIY SERGEYEVICH BADIN, IVAN SERGEYEVICH YERMAKOV, ALEKSEY VIKTOROVICH LUKASHEV, SERGEY ALEKSANDROVICH MORGACHEV,...<\/p>\n","protected":false},"author":1,"featured_media":652,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ngg_post_thumbnail":0,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[4],"tags":[],"class_list":["post-634","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-activism"],"yoast_head":"\n
\nvictims using a technique known as spearphishing to steal victims’ passwords or otherwise gain
\naccess to their computers. Beginning by at least March 2016, the Conspirators targeted over 300
\nindividuals affiliated with the Clinton Campaign, DCCC, and DNC.<\/p>\n\n
\ncreated and sent a spearphishing email to the chairman of the Clinton Campaign.
\nLUKASHEV used the account “john356gh” at an online service that abbreviated
\nwebsite addresses (referred to as a “URL-shortening service”).
\nLUKASHEV used the account to mask a link contained in the spearphishing email,
\nwhich directed the recipient to a GRU created website. LUKASHEV altered the
\nappearance of the sender email address in order to make it look like the email was
\na security notification from Google (a technique known as “spoofing”), instructing
\nthe user to change his password by clicking the embedded link. Those instructions
\nWere followed. On or about March 21, 2016, LUKASHEV, YERMAKOV, and
\ntheir co-conspirators stole the contents of the chairman’s email account, which
\nconsisted of over 50,000 emails.<\/p>\n
\nspearphishing emails to the personal accounts of other individuals af?filiated with
\nthe Clinton Campaign, including its campaign manager and a senior foreign policy
\nadviser. On or about March 25, 2016, LUKASHEV used the same john356gh
\naccount to mask additional links included in spearphishing emails sent to numerous
\nindividuals affiliated with the Clinton Campaign, including Victims and 2.
\nLUKASHEV sent these emails from the Russia-based email account
\nhi.mymail@yandex.com that he spoofed to appear to be from Google.<\/li>\n
\n2 and their association with Clinton on various social media sites. Through their
\nspearphishing operations, LUKASI-IEV, YERMAKOV, and their co-conspirators
\nsuccessfully stole email credentials and thousands of emails from numerous
\nindividuals affiliated with the Clinton Campaign. Many of these stolen emails,
\nincluding those from Victims 1 and 2, were later released by the Conspirators
\nthrough DCLeaks.<\/li>\n
\n(with a one-letter deviation from the actual spelling) of a known member of the
\nClinton Campaign. The Conspirators then used that account to send spearphishing
\nemails to the work accounts of more than thirty different Clinton Campaign
\nemployees. In the spearphishing emails, LUKASHEV and his co-conspirators
\nembedded a link purporting to direct the recipient to a document titled “hillary-clinton-favorable-rating.xlsx”
\nIn fact, this link directed the recipients’ computers
\nto a GRU-created website.<\/li>\n<\/ol>\n
\nthroughout the summer of 2016. For example, on or about July 27, 2016, the Conspirators
\nattempted after hours to spearphish for the ?rst time email accounts at a domain hosted by a third-
\nparty provider and used by Clinton’s personal of?ce. At or around the same time, they also
\ntargeted seventy-six email addresses at the domain for the Clinton Campaign.<\/p>\n
\nefforts, researched the DCCC and DNC computer networks to identify technical specifications and
\nvulnerabilities.<\/p>\n\n
\nquery for the internet protocol configurations to identify connected devices.<\/lii>\n
\nabout the DNC network, the Democratic Party, and Hillary Clinton.<\/li>\n
\ninternet protocol configurations to identify connected devices.<\/li>\n<\/ol>\n
\nthe Conspirators hacked into the computer network. Once they gained access, they
\ninstalled and managed different types of malware to explore the network and steal data.<\/p>\n
\nEmployee (“DCCC Employee 1”) to access the network.
\nDCCC Employee 1 had received a spearphishing email from the Conspirators on or about
\nApril 6, 2016, and entered her password after clicking on the link.<\/p>\n
\nversions of their X-Agent malware on at least ten computers, which allowed
\nthem to monitor individual employees? computer activity, steal passwords, and
\nmaintain access to the network.<\/p>\n
\nthe victims’ computers to a GRU-leased server located in Arizona. The
\nConspirators referred to this server as their panel. KOZACHEK,
\nMALYSHEV, and their co-conspirators logged into the AMS panel to use
\nX-Agent’s keylog and screenshot functions in the course of monitoring and
\nsurveilling activity on the computers. The keylog function allowed the
\nConspirators to capture keystrokes entered by employees. The screenshot
\nfunction allowed the Conspirators to take pictures of the employees?
\ncomputer screens.<\/p>\n
\nX-Agent’s keylog and screenshot functions to surveil DCCC Employee 1’s
\ncomputer activity over the course of eight hours. During that time, the Conspirators
\ncaptured DCCC Employee 1’s communications with co-workers and the passwords
\nshe entered while working on fundraising and voter outreach projects. Similarly,
\non or about April 22, 2016, the Conspirators activated X-Agent’s keylog and
\nscreenshot functions to capture the discussions of another Employee
\nEmployee about the finances, as well as her individual
\nbanking information and other personal topics.<\/p>\n
\nconfigured an overseas computer to relay communications between X-Agent malware and the
\nAMS panel and then tested X-Agent’s ability to connect to this computer. The Conspirators
\nreferred to this computer as a “middle server.” The middle server acted as a proxy to obscure the
\nconnection between malware at the and the Conspirators? AMS panel. On or about April
\n20, 2016, the Conspirators directed X-Agent malware on the computers to connect to this
\nmiddle server and receive directions from the Conspirators.<\/p>\n
\ntheir access to the network. The Conspirators then installed and managed different types
\nof malware (as they did in the network) to explore the DNC network and steal documents.
\na. On or about April 18, 2016, the Conspirators activated X-Agent’s keylog and
\nscreenshot functions to steal credentials of a employee who was authorized
\nto access the DNC network. The Conspirators hacked into the DNC network from
\nthe network using stolen credentials. By in or around June 2016, they
\ngained access to approximately thirty?three DNC computers.
\nb. In or around April 2016, the Conspirators installed X-Agent malware on the DNC
\nnetwork, including the same versions installed on the network.
\nMALYSHEV and his co-conspirators monitored the X-Agent malware from the
\nAMS panel and captured data from the victim computers. The AMS panel collected
\nthousands of keylog and screenshot results from the and DNC computers,
\nsuch as a screenshot and keystroke capture of DCCC Employee 2 viewing the
\nonline banking information.<\/p>\n
\nnetworks that stored information related to the 2016 US. presidential election. For example, on
\nor about April 15, 2016, the Conspirators searched one hacked computer for terms that
\nincluded “hillary,” “cruz,” and “trump.”? The Conspirators also copied select folders,
\nincluding “Benghazi Investigations.” The Conspirators targeted computers containing information
\nsuch as opposition research and ?eld operation plans for the 2016 elections.<\/p>\n
\nConspirators used a publicly available tool to gather and compress multiple documents on the
\nand DNC networks. The Conspirators then used other GRU malware, known as
\n“X-Tunnel,” to move the stolen documents outside the DCCC and DNC networks through
\nchannels.<\/p>\n
\nof data from DNC computers, including opposition research. The Conspirators
\nlater moved the compressed DNC data using X-Tunnel to a GRU-leased computer
\nlocated in Illinois.<\/p>\n
\ncomputer located in Illinois. Later that day, the Conspirators used X?Tunnel to
\nconnect to that computer to steal additional documents from the network.<\/p>\n
\nMicrosoft Exchange Server and stole thousands of emails from the work accounts of DNC
\nemployees. During that time, YERMAKOV researched PowerShell commands related to
\naccessing and managing the Microsoft Exchange Server.<\/p>\n
\ncustom AMS software on the server. That day, the AMS panel received updates from
\napproximately thirteen different X-Agent malware implants on and DNC computers.<\/p>\n
\nby intentionally deleting logs and computer ?les. For example, on or about May 13, 2016, the
\nConspirators cleared the event logs from a DNC computer. On or about June 20, 2016, the<\/p>\n
\nabout Company 1 and its reporting on X-Agent and X-Tunnel. On or about June
\n1, 2016, the Conspirators attempted to delete traces of their presence on the
\nnetwork using the computer program CCleaner.<\/p>\n
\nwhich mimicked the domain of a political fundraising platform that included a
\ndonations page. Shortly thereafter, the Conspirators used stolen
\ncredentials to modify the website and redirect Visitors to the actbluescom
\ndomain.<\/p>\n
\nnetwork, the Conspirators spent over seven hours unsuccessfully trying to connect
\nto X-Agent. The Conspirators also tried to access the network using<\/p>\n
\ncomputers hosted on a third-party cloud-computing service. These computers contained test
\napplications related to the analytics. After conducting reconnaissance, the Conspirators
\ngathered data by creating backups, or ?snapshots,? of the cloud-based systems using the
\ncloud provider?s own technology. The Conspirators then moved the snapshots to cloud-based
\naccounts they had registered with the same service, thereby stealing the data from the DNC.<\/p>\n
\nonline persona DCLeaks to release and publicize stolen election-related documents. On or about
\nApril 19, 2016, after attempting to register the domain electionleaks.com, the Conspirators
\nregistered the domain dcleaks.com through a service that anonymized the registrant. The funds
\nused to pay for the dcleaks.com domain originated from an account at an online
\nservice that the Conspirators also used to fund the lease of a virtual private server registered with
\nthe operational email account dirbinsaabol@mai1.com. The dirbinsaabol email account was also
\nused to’register the john356gh URL-shortening account used by LUKASHEV to spearphish the
\nClinton Campaign chairman and other campaign-related individuals.<\/p>\n
\nthey used to release stolen emails. Before it shut down in or around March 2017, the site received
\nover one million page Views. The Conspirators falsely claimed on the site that DCLeaks was
\nstarted by a group of ?American hacktivists,? when in fact it was started by the Conspirators.<\/p>\n
\nthe Conspirators used DCLeaks to release emails stolen from individuals affiliated with the Clinton
\nCampaign. The Conspirators also released documents they had stolen in other spearphishing<\/p>\n
\nwas launched, the Conspirators created a DCLeaks Facebook page using a preexisting social media
\naccount under the ?ctitious name ?Alice Donovan.? In addition to the DCLeaks acebook page,
\nthe Conspirators used other social media accounts in the names of ?ctitious U.S. persons such as
\n?Jason Scott? and ?Richard Gingrey? to promote the DCLeaks website. The Conspirators accessed
\nthese accounts from computers managed by POTEMKIN and his co?conspirators.<\/p>\n
\nConspirators operated the @dcleaks_ Twitter account from the same computer used for other
\nefforts to interfere with the 2016 U.S. presidential election. For example, the Conspirators used
\nthe same computer to operate the Twitter account @BaltimoreIsWhr, through which they
\nencouraged U.S. audiences to ?[i]oin our flash mob? opposing Clinton and to post images with the
\nhashtag #BlacksAgainstHillary.<\/p>\n
\n40. On or about June 14, 2016, the Company lupublicly announced that it
\nhad been hacked by Russian government actors. In response, the Conspirators created the online
\npersona Guccifer 2.0 and falsely claimed to be a lone Romanian hacker to undermine the
\nallegations of Russian responsibility for the intrusion.
\n41. On or about June 15, 2016, the Conspirators logged into a Moscow-based server used and
\nmanaged by Unit 74455 and, between 4:19 PM and 4:56 PM Moscow Standard Time, searched<\/p>\n
\ndcleaks<\/p>\n
\n[widely known translation]<\/p>\n
\n?think twice about?<\/p>\n
\npublished its ?rst post on a blog site created through WordPress. Titled servers hacked
\nby a lone hacker,? the post used numerous English words and phrases that the Conspirators had
\nsearched for earlier that day (bolded below):<\/p>\n
\nthe Democratic National Committee (DNC) servers had been hacked by
\n?sophisticated? hacker groups.<\/p>\n
\ninto network. . <\/p>\n
\ncompetence.<\/p>\n
\nrelease documents through WordPress that they had stolen from the and DNC. The
\nConspirators, posing as Guccifer 2.0, also shared stolen documents with certain individuals.<\/p>\n
\nConspirators responded using the Guccifer 2.0 persona and sent the candidate
\nstolen documents related to the candidate?s opponent.<\/p>\n
\napproximately 2.5 gigabytes of data stolen from the to a then-registered state
\nlobbyist and online source of political news. The stolen data included donor records
\nand personal identifying information for more than 2,000 Democratic donors.<\/p>\n
\nreporter stolen documents pertaining to the Black Lives Matter movement. The
\nreporter responded by discussing when to release the documents and offering to
\nwrite an alticle about their release.<\/p>\n
\nrelease of stolen documents. On or about August 15, 2016, the Conspirators, posing as Guccifer
\n2.0, wrote to a person who was in regular contact with senior members of the presidential campaign
\nof Donald J. Trump, ?thank for writing back . . . do ?nd anyt[h]ing interesting in the docs i
\nposted?? On or about August 17, 2016, the Conspirators added, ?please tell me if i can help
\nanyhow . . . it would be a great pleasure to me.? On or about September 9, 2016, the Conspirators,
\nagain posing as Guccifer 2.0, referred to a stolen document posted online and asked the
\nperson, ?what do think of the info on the turnout model for the democrats entire presidential
\ncampaign.? The person responded, ?[p]retty standard.?<\/p>\n
\ncomputer infrastructure and financing.<\/p>\n
\nnetwork account and to lease a server in Malaysia. In or around June
\n2016, the Conspirators used the Malaysian server to host the dcleaks.com website.
\nOn or about July 6, 2016, the Conspirators used the VPN to log into the
\n@Guccifer_2 Twitter account. The Conspirators opened that VPN account from
\nthe same server that was also used to register malicious domains for the hacking of
\nthe and DNC networks.
\nb. On or about June 27, 2016, the Conspirators, posing as Guccifer 2.0, contacted a<\/p>\n
\nThe Conspirators then sent the reporter the password to access a nonpublic,
\npassword-protected portion of dcleaks.com containing emails stolen from Victim
\nby LUKASHEV, YERMAKOV, and their co-conspirators in or around March
\n2016. I<\/p>\n
\ntransferred many of the documents they stole from the DNC and the chairman of the Clinton
\nCampaign to Organization 1. The Conspirators, posing as Guccifer 2.0, discussed the release of
\nthe stolen documents and the timing of those releases with Organization 1 to heighten their impact
\non the 2016 U.S. presidential election.<\/p>\n
\nOrganization 1 added, ?if you have anything hillary related we want it in the next
\ntweo [sic] days prefable [sic] because the DNC [Democratic National Convention]
\nis approaching and she will solidify bernie supporters behind her after.? The
\nConspirators responded, ?0k . . . i see.? Organization 1 explained, ?we think trump
\nhas only a 25% chance of winning against hillary . . . so con?ict between bernie
\nand hillary is interesting.?<\/p>\n
\nor about July 14, 2016, the Conspirators, posing as Guccifer 2.0, sent
\nOrganization 1 an email with an attachment titled ?wk linkl.txt.gpg.? The
\nConspirators explained to Organization 1 that the ?le contained
\ninstructions on how to access an online archive of stolen DNC documents. On or
\nabout July 18, 2016, Organization 1 con?rmed it had ?the le or so archive? and
\nwould make a release of the stolen documents ?this week.?<\/p>\n
\n50. Paragraphs 1 through 49 of this Indictment are re?alleged and incorporated by reference as<\/p>\n
\nand elsewhere, Defendants ANTONOV, YERMAKOV, LUKASHEV,
\nMORGACI-IEV, KOZACHEK, YERSHOV, MALYSHEV, OSADCHUK, and POTEMKJN,
\ntogether with others known and unknown to the Grand Jury, knowingly and intentionally conspired
\nto commit offenses against the United States, namely:<\/p>\n
\naccess to a computer, and to obtain thereby information from a protected computer,
\nwhere the value of the information obtained exceeded $5,000, in Violation of Title
\n18, United States Code, Sections 1030(a)(2)(C) and 1030(c)(2)(B); and<\/p>\n
\ncommand, and as a result of such conduct, to intentionally cause damage without
\nauthorization to a protected computer, and where the offense did cause and, if
\ncompleted, would have caused, loss aggregating $5,000 in iralue to at least one
\nperson during a one~year period from a related course of conduct affecting a
\nprotected computer, and damage affecting at least ten protected computers during
\na one-year period, in Violation of Title 18, United States Code, Sections
\n1030(a)(5)(A) and 1030(c)(4)(B).<\/p>\n
\n49, 55, and 57 through 64, the Conspirators knowingly falsely registered a domain name and
\nknowingly used that domain name in the course of committing an offense, namely, the
\nConspirators registered domains, including dcleaks.com and actblues.com, with false names and
\naddresses, and used those domains in the course of committing the felony offense charged in Count
\nOne.<\/p>\n
\n(Aggravated Identity Theft)<\/p>\n
\nand incorporated by reference as if fully set forth herein.<\/p>\n
\nDefendants BORISOVICH BORIS ALEKSEYEVICH ANTONOV,
\nDMITRIY SERGEYEVICH IVAN SERGEYEVICH YERMAKOV, ALEKSEY
\nVIKTOROVICH LUKASHEV, SERGEY ALEKSANDROVICH MORGACHEV, NIKOLAY
\nYURYEVICH KOZACHEK, PAVEL VYACHESLAVOVICH YERSHOV, ARTEM
\nANDREYEVICH MALYSHEV, ALEKSANDR VLADIMTROVICH OSADCHUK, and
\nALEKSEY ALEKSANDROVICH POTEMKIN did knowingly transfer, possess, and use, Without
\nlawful authority, a means of identi?cation of another person during and in relation to a felony
\nViolation enumerated in Title 18, United States Code, Section 1028A(c), namely, computer fraud
\nin Violation of Title 18, United States Code, Sections 1030(a)(2)(C) and 1030(c)(2)(B), knowing<\/p>\n
\npersonal emall account
\n3 March 25, 2016 Victim 1 Usemame and Password for
\npersonal emall account
\n. . . Username and password for
\n4 Ap r11 12? 2016 4 computer network
\n. . . Username and password for
\n5 April 15, 2016 5 computer network
\n. . . Username and password for
\n6 April 18, 2016 Victim 6 computer network
\n. . Username and password for
\n. 7 May 10? 2016 Victlm 7 DNC computer network
\n8 June 2 2016 Victim 2 Username and password for
\npersonal email account
\n9 July 6 2016 Victim 8 Username and password for
\n.- personal email account<\/p>\n
\n(Conspiracy to Launder Money)<\/p>\n
\nas if fully set forth herein. <\/p>\n
\ninto the computers of U.S. persons and entities involved in the 2016 U.S. presidential election and
\nreleasing the stolen documents?the Defendants conspired to launder the equivalent of more than
\n$95,000 through a web of transactions structured to capitalize on the perceived anonymity of
\nsuch as bitcoin.<\/p>\n
\nincluding U.S. dollars, they principally used bitcoin when purchasing servers, registering domains,<\/p>\n
\nhosting companies, domain registrars, and other vendors both international and domestic. The use
\nof bitcoin allowed the Conspirators to avoid direct relationships with traditional ?nancial
\ninstitutions, allowing them to evade greater scrutiny of their identities and sources of funds.<\/p>\n
\nBlockchain identi?es the parties to each transaction only by alpha?numeric identi?ers known as
\nbitcoin addresses. To further avoid creating a centralized paper trail of all of their purchases, the
\nConspirators purchased infrastructure using hundreds of different email accounts, in some cases
\nusing a new account for each purchase. The Conspirators used ?ctitious names and addresses in
\norder to obscure their identities and their links to Russia and the Russian government. For
\nexample, the dcleaks.com domain was registered and paid for using the ?ctitious name ?Carrie
\nFeehan? and an address in New York. In some cases, as part of the payment process, the
\nConspirators provided vendors with nonsensical addresses such as ?usa Denver ?g?igh
\nghihgfh and ?l 2 District of Columbia.?<\/p>\n
\ninformation and to facilitate bitcoin payments to vendors. One of these dedicated accounts,
\nregistered with the username ?gfadel47,? received hundreds of bitcoin payment requests from
\napproximately 100 different email accounts. For example, on or about February 1, 2016, the
\ngfadel47 account received the instruction to ?[p]lease send exactly 0.026043 bitcoin to? a certain
\nthirty-four character bitcoin address. Shortly thereafter, a transaction matching those exact
\ninstructions was added to the Blockchain.<\/p>\n
\nrenew the registration of a domain encoded in certain X?Agent malware installed
\non the DNC network. I<\/p>\n
\nin part by ?mining? bitcoin. Individuals and entities can mine bitcoin by allowing their computing
\npower to be used to verify and record payments on the bitcoin public ledger, a service for which
\nthey are rewarded with freshly?minted bitcoin. The pool of bitcoin generated from the
\nmining activity was used, for example, to pay a Romanian company to register the domain
\ndcleaks.com through a payment processing company located in the United States.<\/p>\n
\ndesigned to obscure the origin of the funds. This included purchasing bitco in through peer-to-peer
\nexchanges, moving funds through other digital currencies, and using pre-paid cards. They also
\nenlisted the assistance of one or more third-party exchangers who facilitated layered transactions
\nthrough digital currency exchange platforms providing heightened anonymity.<\/p>\n
\nof funds?to purchase key accounts, servers, and domains used in their election-related hacking
\nactivity.<\/p>\n
\nalso sent newly-minted bitcoin to a bitcoin address controlled by ?Daniel Farell,?
\nthe persona that was used to renew the domain The bitcoin mining
\noperation also funded, through the same bitcoin address, the purchase of servers
\nand domains used in the spearphishing operations, including accounts-<\/p>\n
\npurchased a VPN account, which they later used to log into the @Guccifer_2
\nTwitter account. The remaining funds from that bitcoin address were then used on
\nor about April 28, 2016, to lease a Malaysian server that hosted the dcleaks.com
\nwebsite.<\/p>\n
\nDeClaur? and ?Mike Long?) to send bitcoin to a company in order to lease a
\nserver used to administer X-Tunnel malware implanted on the and DNC
\nnetworks, and to lease two servers used to hack the cloud network.<\/p>\n
\nelsewhere, Defendants VIKTOR BORISOVICH BORIS ALEKSEYEVICH
\nANTONOV, DMITRIY SERGEYEVICH IVAN SERGEYEVICH YERMAKOV,
\nALEKSEY VIKTOROVTCH LUKASHEV, SERGEY ALEKSANDROVICH MORGACHEV,
\nNIKOLAY YURYEVICH KOZACHEK, PAVEL VYACHESLAVOVICH YERSHOV, ARTEM
\nANDREYEVICH MALYSHEV, ALEKSANDR VLADIMIROVICH OSADCHUK, and
\nALEKSEY ALEKSANDROVICH POTEMKIN, together with others, known and unknown to the
\nGrand Jury, did knowingly and intentionally conspire to transport, transmit, and transfer monetary
\ninstruments and funds to a place in the United States from and through a place outside the United
\nStates and ?om a place in the United States to and through a place outside the United States, with
\nthe intent to promote the carrying on of speci?ed unlawful activity, namely, a Violation of Title
\n18, United States Code, Section 1030, contrary to Title 18, United States Code, Section
\n1956(a)(2)(A).<\/p>\n
\n(Conspiracy to Commit an Offense Against the United States)<\/p>\n
\nif fully set forth herein.<\/p>\n
\nOSADCHUK is re?alleged and incorporated by reference as if fully set forth herein.<\/p>\n
\nwas an of?cer in the Russian military assigned to Unit 74455 who worked in the 22 Kirova
\nStreet building (the Tower).<\/p>\n
\nintentionally conspired with each other and with persons, known and unknown to the Grand Jury,
\nto hack into the computers of US. persons and entities responsible for the administration of 2016
\nUS. elections, such as state boards of elections, secretaries of state, and US. companies that
\nsupplied software and other technology related to the administration of US. elections.<\/p>\n
\ncharged with the administration of the 2016 US. elections in order to access these computers and
\nsteal voter data and other information stored on these computers.<\/p>\n
\nUS. state boards of elections, secretaries of state, and other election-related entities for website
\nvulnerabilities. KOVALEV and his co-conspirators also searched for state political party email<\/p>\n
\nboard of elections and stole information related to approximately 500,000 voters,
\nincluding names, addresses, partial social security numbers, dates of birth, and driver?s license
\nnumbers.<\/p>\n
\nof a U.S. vendor (?Vendor that supplied software used to verify voter registration information
\nfor the 2016 U.S. elections. KOVALEV and his co-conspirators used some of the same
\ninfrastructure to hack into Vendor 1 that they had used to hack into SBOE 1.<\/p>\n
\nhacking of SBOE 1 and identi?ed some of the infrastructure that was used to conduct the hacking.
\nIn response, KOVALEV deleted his search history. KOVALEV and his co-conspirators also
\ndeleted records from accounts used in their operations targeting state boards of elections and
\nsimilar election-related entities.<\/p>\n
\ncounty of?ces responsible for administering the 2016 U.S. elections. For example, on or about
\nOctober 28, 2016, KOVALEV and his co?conspirators visited the websites of certain counties in
\nI Georgia, Iowa, and Florida to identify vulnerabilities.<\/p>\n
\nand his co-conspirators used an email account designed to look like a Vendor 1 email address to
\nsend over 100 spearphishing emails to organizations and personnel involved in administering
\nelections in numerous Florida counties. The spearphishing emails contained malware that the<\/p>\n
\nto the Grand Jury, knowingly and intentionally conspired to commit offenses against the United
\nStates, namely:<\/p>\n
\naccess to a computer, and to obtain thereby information from a protected computer,
\nwhere the value of the information obtained exceeded $5,000, in violation of Title
\n18, United States Code, Sections 1030(a)(2)(C) and 1030(c)(2)(B); and<\/p>\n
\ncommand, and as a result of such conduct, to intentionally cause damage without
\nauthorization to a protected computer, and where the offense did cause and, if
\ncompleted, would have caused, loss aggregating $5,000 in value to at least one
\nperson during a one-year period from a related course of conduct affecting a
\nprotected computer, and damage affecting at least ten protected computers during
\na one-year period, in violation of Title 18, United States Code, Sections
\n1030(a)(5)(A) and 1030(c)(4)(B).<\/p>\n
\nKOVALEV, and their co?conspirators committed the overt acts set forth in paragraphs 67 through
\n69 and 71 through 76, which are re?alleged and incorporated by reference as if fully set forth
\nherein.<\/p>\n
\nthat the United States will seek forfeiture as part of any sentence in the event of Defendants?<\/p>\n
\nOne and Eleven, Defendants ANTONOV, BADIN, YERMAKOV, LUKASHEV,
\nMORGACHEV, KOZACHEK, YERSHOV, MALYSHEV, OSADCHUK, POTEMKIN, and
\nKOVALEV shall forfeit to the United States any property, real or personal, which constitutes or
\nis derived from proceeds obtained directly or indirectly as a result of such violation, and any
\npersonal property that was used or intended to be usedito commit or to facilitate the commission
\nof such offense. Pursuant to Title 18, United States Code, Section 982(a)(l), upon conviction of
\nthe offense charged in Count Ten, Defendants ANTONOV, BADIN,
\nYERMAKOV, LUKASHEV, MORGACHEV, KOZACHEK, YERSHOV, MALYSHEV,
\nOSADCHUK, and POTEMKIN shall forfeit to the United States any property, real or personal,
\ninvolved in such offense, and any property traceable to such prOperty. Notice is further given that,
\nupon conviction, the United States intends to seek a judgment against each Defendant for a sum
\nof money representing the property described in this paragraph, as applicable to each Defendant
\n(to be offset by the forfeiture of any speci?c property).<\/p>\n
\ndif?culty;<\/p>\n
\nCode, Section 853, to seek forfeiture of any other property of said Defendant.<\/p>\n
\nSpecial Counsel<\/p>\n