FIN7 (Carbanak Group) DOJ Prosecutions: Hladyr, Kolpakov, and Iarmak (2018-2022)

What happened

The DOJ case summary describes FIN7, also tracked as the Carbanak Group and Navigator Group, breaching more than 100 U.S. companies across 49 states and D.C., stealing over 15 million payment-card records from over 6,500 point-of-sale terminals at more than 3,600 locations. AP's April 2022 report on Iarmak's sentencing instead describes more than 20 million card records. The U.S. Department of Justice, Western District of Washington, unsealed superseding indictments on August 1, 2018 against three alleged high-level members, Fedir Hladyr, Andrii Kolpakov, and a third codefendant, charging conspiracy to commit wire fraud and computer hacking; a fourth member, Denys Iarmak, was indicted separately after his 2019 arrest. The group's tradecraft blended remote cyber-intrusion with physical and in-person social engineering: a fake front company, "Combi Security," used to recruit hackers under the pretense of legitimate cybersecurity work, and, in a later, related campaign publicly attributed to FIN7 by the FBI, mailed BadUSB keystroke-injection devices disguised as gifts or official mailings sent to staff at target companies. The criminal proceedings and the later USB-campaign attribution are separate evidence: a group attribution does not by itself establish that these defendants were convicted for the USB mailings.

How it worked

FIN7 combined remote cyber intrusion with physical and in-person social-engineering tradecraft. (1) Recruitment cover: the group operated a fake cybersecurity company, "Combi Security," complete with a phony website, to publicly advertise legitimate-sounding jobs (penetration tester, developer) and recruit hackers who believed they were doing lawful security work; defendants Hladyr and Kolpakov were both recruited this way, giving the organization plausible deniability and giving lower-level members cover to deny knowingly committing crimes. (2) Core intrusion vector: spear-phishing emails to employees at target restaurant/hotel/casino chains carrying malicious Microsoft Word attachments (sometimes using pretexts like a fabricated food-poisoning complaint to a restaurant manager), frequently reinforced by a follow-up phone call from a FIN7 member posing as the sender to talk the employee into opening the attachment; once inside, operators moved laterally to point-of-sale systems to harvest card data. (3) Physical baiting/USB campaign (documented in FBI FLASH alerts starting March 2020, attributed to FIN7 by FBI and independently corroborated by Kaspersky and FireEye/Mandiant researchers via malware/infrastructure overlap): FIN7 mailed BadUSB/"Bad Beetle" USB keystroke-injection devices via USPS/UPS to employees in HR, IT, and executive roles at retail, restaurant, and hotel companies, disguised as a $50 Best Buy gift card with a USB "product list," sometimes bundled with a teddy bear; the campaign later (from August 2021) expanded to transportation, insurance, and defense-sector targets using a fake U.S. Department of Health and Human Services COVID-19 guidance letter or a decorative "thank you" gift box impersonating Amazon with a counterfeit gift card. When plugged in, the device registered as a keyboard (HID) and auto-typed a PowerShell command that downloaded the GRIFFON backdoor, leading in later intrusions to ransomware deployment (BlackMatter, REvil).

The lure and the tell

Lures: (1) a fabricated angry-customer/food-poisoning complaint email to a restaurant manager urging them to open an attached "report"; (2) an unsolicited package appearing to be from Best Buy containing a $50 loyalty gift card and a USB drive claimed to list eligible products; (3) a "gift" package with a teddy bear or gift card mailed to HR/IT/executive staff; (4) a fake U.S. Department of Health and Human Services letter with COVID-19 "guidance" and an enclosed USB; (5) a decorative gift box impersonating Amazon with a counterfeit thank-you gift card and USB; (6) a legitimate-looking classified job ad for "Combi Security," a real-seeming cybersecurity firm with its own website, used to recruit hackers. Tells that gave it away when caught: recipients with security training who did not plug in unsolicited USB devices and instead submitted them for analysis; the USB devices were commercially available "BadUSB"/"Bad Beetle"/LilyGO hardware (cheap, $5-$14) rather than custom silicon; devices registered anomalously as HID keyboards even when storage media was policy-restricted; and Combi Security, on inspection, had no legitimate clients and a phony web presence.

Outcome

Superseding indictments against Hladyr, Kolpakov, and a third codefendant were filed July 27, 2018 and unsealed August 1, 2018 in the Western District of Washington; a fourth defendant, Denys Iarmak, was indicted separately (CR19-257RSM). Hladyr, arrested in Germany in January 2018 and extradited, pleaded guilty September 11, 2019 to one count of conspiracy to commit wire fraud and one count of conspiracy to commit computer hacking (24 other counts were dropped), and was sentenced April 16, 2021 to 10 years in prison (including time already served) plus $2.5 million restitution. Kolpakov, arrested on vacation in Lepe, Spain on June 28, 2018 and extradited in June 2019, pleaded guilty November 16, 2020 to conspiracy to commit wire fraud and computer hacking, and was sentenced to 84 months (7 years) plus $2.5 million restitution around June 2021 (his lawyer argued he was unwittingly "backed into a corner" after answering the Combi Security job ad and was paid only about $75,000). Iarmak, arrested in Bangkok, Thailand in November 2019 at the request of U.S. investigators and extradited to U.S. custody in 2020, pleaded guilty November 22, 2021 to conspiracy to commit wire fraud and conspiracy to commit computer hacking (having originally faced 27 counts and a potential life sentence); he was sentenced April 7, 2022 in Seattle by U.S. District Judge Ricardo S. Martinez to 5 years in federal prison, becoming the third FIN7 member sentenced in the U.S. after Hladyr (10 years) and Kolpakov (7 years); his defense cited time served in a Thailand prison and a COVID-19 infection while in BOP custody. The third codefendant was arrested in Bielsko-Biala, Poland in early 2018. The WDWA case tracker lists no plea or sentencing outcome for that codefendant, so the current disposition remains unverified. The November 22, 2021 change-of-plea and April 7, 2022 sentencing entries belong to the separate Iarmak docket (CR19-257RSM), not that codefendant's case. Separately, FBI FLASH alerts from March 2020, updated through 2021-2022, formally attributed the mailed-USB "BadUSB" baiting campaign to FIN7, based on malware (GRIFFON) and infrastructure overlap independently corroborated by Kaspersky and FireEye/Mandiant researchers.

Why it matters

The proceedings document a fraudulent security-company front used to recruit people into FIN7. Separate reporting attributes later malicious-USB mailings to the group. Keeping those records distinct prevents the convictions from being presented as adjudication of every later tactic attributed to FIN7.

Defenses

DOJ/FBI and researcher guidance arising from this case: never plug in unsolicited/unknown USB devices received by mail, regardless of accompanying "gift" (gift card, teddy bear, COVID-guidance letter); treat unsolicited packages addressed to HR/IT/executive staff as suspicious and route to security before opening; disable USB autorun/HID-injection risk via endpoint controls and monitor for known malicious device VID/PID signatures (FBI published FIN7's 0x2341/0x8037 IDs); train employees to verify unexpected "vendor" emails and pretext follow-up calls out-of-band before opening attachments; vet unsolicited job/recruiting offers (like FIN7's fake "Combi Security" cybersecurity firm) through independent verification before providing skills, network access, or going to work for an unverified employer; report suspicious packages/USB devices to the FBI (evidence-preservation guidance was published in the FLASH alert). The case itself demonstrates that criminal prosecution (indictment, extradition, guilty pleas, prison sentences, restitution) is a viable, if slow, deterrent and remediation path for organized cyber-enabled fraud crews, with three of the four charged members (Hladyr, Kolpakov, Iarmak) now sentenced.