On June 24, 2021, the Department of Justice announced that Ukrainian national Andrii Kolpakov, a high-level member of hacker group FIN7, also known as the Carbanak Group, was sentenced in the District Court for the Western District of Washington to seven years in prison for his participation in a sophisticated malware operation responsible for attacking hundreds of US companies, mostly in the restaurant, gambling and hospitality industries. Kolpakov, who pleaded guilty in June 2020 to one count of conspiracy to commit wire fraud and one count of conspiracy to commit computer hacking, was also ordered by the court to pay restitution of $2.5 million.
The DOJ reports that members of FIN7 launched the malware campaign as early as 2015, resulting in the thousands of cyberattacks on numerous businesses in the US and around the world. The members allegedly used email messages that were designed to appear as legitimate business messages that included attachments that, once opened and activated, would use an adapted version of Carbanak malware, in addition to other tools, to access and steal customers’ credit and debit card numbers – many of which have allegedly been offered for sale through online underground marketplaces.