Changes

  VIKTOR BORISOVICH NETYKSHO,    *  

  VIKTOR BORISOVICH NETYKSHO,    *  

  BORIS ALEKSEYEVICH ANTONOV,    *  

  BORIS ALEKSEYEVICH ANTONOV,    *  

  DMITRIY SERGEYEVICH BADIN ,    *  

  DMITRIY SERGEYEVICH BADIN,    *  

  IVAN SERGEYEVICH YERMAKOV,    *  

  IVAN SERGEYEVICH YERMAKOV,    *  

  ALEKSEY VIKTOROVICH            *  

  ALEKSEY VIKTOROVICH            *  

6.  Beginning in or around June 2016, the Conspirators staged and released tens of thousands of the stolen emails and documents.  They did so using fictitious online personas, including “DCLeaks ” and “Guccifer 2.0.”<ref>[https://disobedientmedia.com/2018/07/muellers-latest-indictment-ignores-evidence-in-the-public-domain/ Mueller’s Latest Indictment Contradicts Evidence In The Public Domain], July 15, 2018, Adam Carter. disobedientmedia.com</ref>

6.  Beginning in or around June 2016, the Conspirators staged and released tens of thousands of the stolen emails and documents.  They did so using fictitious online personas, including “DCLeaks ” and “Guccifer 2.0.”<ref>[https://disobedientmedia.com/2018/07/muellers-latest-indictment-ignores-evidence-in-the-public-domain/ Mueller’s Latest Indictment Contradicts Evidence In The Public Domain], July 15, 2018, Adam Carter. disobedientmedia.com</ref>

7.  The Conspirators also used the Guccifer 2.0 persona to release additional stolen documents through a website maintained by an organization (“Organization 1”) , that had previously posted documents stolen from U.S.  persons, entities, and the U.S.  government .  The Conspirators continued their U.S.  election -interference operations through in or around November 2016.

7.  The Conspirators also used the Guccifer 2.0 persona to release additional stolen documents through a website maintained by an organization (“Organization 1”), that had previously posted documents stolen from U.S.  persons, entities, and the U.S.  government .  The Conspirators continued their U.S.  election -interference operations through in or around November 2016.

8.  To hide their connections to Russia and the Russian government, the Conspirators used false identities and made false statements about their identities.  To further avoid detection, the Conspirators used a network of computers located across the world, including in the United States , and paid for this infrastructure using cryptocurrency.

8.  To hide their connections to Russia and the Russian government, the Conspirators used false identities and made false statements about their identities.  To further avoid detection, the Conspirators used a network of computers located across the world, including in the United States, and paid for this infrastructure using cryptocurrency.

===Defendants===

===Defendants===

11.  Defendant DMITRIY SERGEYEVICH BADIN (Бадин Дмитрий Сергеевич) was a Russian military officer assigned to Unit 26165 who held the title “Assistant Head of Department.”  In or around 2016, BADIN, along with ANTONOV, supervised other co-conspirators who targeted the DCCC, DNC, and individuals affiliated with the Clinton Campaign.

11.  Defendant DMITRIY SERGEYEVICH BADIN (Бадин Дмитрий Сергеевич) was a Russian military officer assigned to Unit 26165 who held the title “Assistant Head of Department.”  In or around 2016, BADIN, along with ANTONOV, supervised other co-conspirators who targeted the DCCC, DNC, and individuals affiliated with the Clinton Campaign.

12.  Defendant IVAN SERGEYEVICH YERMAKOV (Ермаков Иван Сергеевич) was a Russian military officer assigned to ANTONOV’s department within Unit 26165.  Since in or around 2010, YERMAKOV used various online personas , including “ Kate S.  Milton,” “ James McMorgans, ” and “Karen W.  Millen ,” to conduct hacking operations on behalf of Unit 26165.  In or around March 2016, YERMAKOV participated in hacking at least two email accounts from which campaign -related documents were released through DCLeaks.  In or around May 2016, YERMAKOV also participated in hacking the DNC email server and stealing DNC emails that were later released through Organization 1.

12.  Defendant IVAN SERGEYEVICH YERMAKOV (Ермаков Иван Сергеевич) was a Russian military officer assigned to ANTONOV’s department within Unit 26165.  Since in or around 2010, YERMAKOV used various online personas, including “ Kate S.  Milton,” “ James McMorgans, ” and “Karen W.  Millen ,” to conduct hacking operations on behalf of Unit 26165.  In or around March 2016, YERMAKOV participated in hacking at least two email accounts from which campaign -related documents were released through DCLeaks.  In or around May 2016, YERMAKOV also participated in hacking the DNC email server and stealing DNC emails that were later released through Organization 1.

13.  Defendant ALEKSEY VIKTOROVICH LUKASHEV (Лукашев Алексей Викторович) was a Senior Lieutenant in the Russian military assigned to ANTONOV ’s department within Unit 26165.  LUKASHEV used various online personas , including “ Den Katenberg ” and “ Yuliana Martynova.”  In or around 2016, LUKASHEV sent spearphishing emails to members of the Clinton Campaign and affiliated individuals, including the chairman of the Clinton Campaign.

13.  Defendant ALEKSEY VIKTOROVICH LUKASHEV (Лукашев Алексей Викторович) was a Senior Lieutenant in the Russian military assigned to ANTONOV ’s department within Unit 26165.  LUKASHEV used various online personas , including “ Den Katenberg ” and “ Yuliana Martynova.”  In or around 2016, LUKASHEV sent spearphishing emails to members of the Clinton Campaign and affiliated individuals, including the chairman of the Clinton Campaign.

:d.  For example, on or about April 14, 2016, the Conspirators repeatedly activated X-Agent’s keylog and screenshot functions to surveil DCCC Employee 1’s computer activity over the course of eight hours.  During that time, the Conspirators captured DCCC Employee 1’s communications with co-workers and the passwords she entered while working on [[fundraising]] and voter outreach projects.  Similarly, on or about April 22, 2016, the Conspirators activated X-Agent’s keylog and screenshot functions to capture the discussions of another DCCC Employee (“DCCC Employee 2”) about the DCCC’s [[finance]]s, as well as her individual [[banking]] information and other personal topics.<ref>Obviously DCCC Employee 2 co-mingled DCCC’s finances with her individual banking information.</ref>

:d.  For example, on or about April 14, 2016, the Conspirators repeatedly activated X-Agent’s keylog and screenshot functions to surveil DCCC Employee 1’s computer activity over the course of eight hours.  During that time, the Conspirators captured DCCC Employee 1’s communications with co-workers and the passwords she entered while working on [[fundraising]] and voter outreach projects.  Similarly, on or about April 22, 2016, the Conspirators activated X-Agent’s keylog and screenshot functions to capture the discussions of another DCCC Employee (“DCCC Employee 2”) about the DCCC’s [[finance]]s, as well as her individual [[banking]] information and other personal topics.<ref>Obviously DCCC Employee 2 co-mingled DCCC’s finances with her individual banking information.</ref>

25.  On or about April 19, 2016, KOZACHEK, Y ERSHOV , and their co-conspirators remotely configured an overseas computer to relay communications between X-Agent malware and the AMS panel and then tested X-Agent’s ability to connect to this computer.  The Conspirators referred to this computer as a “middle server.”  The middle server acted as a proxy to obscure the connection between malware at the DCCC and the Conspirators’ AMS panel.  On or about April 20, 2016, the Conspirators directed X-Agent malware on the DCCC computers to connect to this middle server and receive directions from the Conspirators.

25.  On or about April 19, 2016, KOZACHEK, Y ERSHOV, and their co-conspirators remotely configured an overseas computer to relay communications between X-Agent malware and the AMS panel and then tested X-Agent’s ability to connect to this computer.  The Conspirators referred to this computer as a “middle server.”  The middle server acted as a proxy to obscure the connection between malware at the DCCC and the Conspirators’ AMS panel.  On or about April 20, 2016, the Conspirators directed X-Agent malware on the DCCC computers to connect to this middle server and receive directions from the Conspirators.

===Hacking into the DNC Network===

===Hacking into the DNC Network===

===Theft of DCCC and DNC Documents===

===Theft of DCCC and DNC Documents===

27.  The Conspirators searched for and identified computers within the DCCC and DNC networks that stored information related to the 2016 U.S.  presidential election.  For example, on or about April 15, 2016, the Conspirators searched one hacked DCCC computer for terms that included “hillary,” “[[Ted Cruz|cruz]],” and “trump .”  The Conspirators also copied select DCCC folders , including “[[Benghazi massacre|Benghazi Investigations]].”  The Conspirators targeted computers containing information such as opposition research and field operation plans for the 2016 elections.

27.  The Conspirators searched for and identified computers within the DCCC and DNC networks that stored information related to the 2016 U.S.  presidential election.  For example, on or about April 15, 2016, the Conspirators searched one hacked DCCC computer for terms that included “hillary,” “[[Ted Cruz|cruz]],” and “trump .”  The Conspirators also copied select DCCC folders, including “[[Benghazi massacre|Benghazi Investigations]].”  The Conspirators targeted computers containing information such as opposition research and field operation plans for the 2016 elections.

28.  To enable them to steal a large number of documents at once without detection, the Conspirators used a publicly available tool to gather and compress multiple documents on the DCCC and DNC networks.  The Conspirators then used other GRU malware, known as “X-Tunnel,” to move the stolen documents outside the DCCC and DNC networks through encrypted channels.

28.  To enable them to steal a large number of documents at once without detection, the Conspirators used a publicly available tool to gather and compress multiple documents on the DCCC and DNC networks.  The Conspirators then used other GRU malware, known as “X-Tunnel,” to move the stolen documents outside the DCCC and DNC networks through encrypted channels.

===Efforts to Remain on the DCCC and DNC Networks===

===Efforts to Remain on the DCCC and DNC Networks===

32.  Despite the Conspirators’ efforts to hide their activity , beginning in or around May 2016, both the DCCC and DNC became aware that they had been hacked and hired a security company [[CrowdStrike|(“Company 1”)]] to identify the extent of the intrusions.  By in or around June 2016, Company 1 took steps to exclude intruders from the networks.  Despite these efforts, a Linux-based version of X-Agent, programmed to communicate with the GRU-registered domain linuxkrnl.net, remained on the DNC network until in or around October 2016.

32.  Despite the Conspirators’ efforts to hide their activity, beginning in or around May 2016, both the DCCC and DNC became aware that they had been hacked and hired a security company [[CrowdStrike|(“Company 1”)]] to identify the extent of the intrusions.  By in or around June 2016, Company 1 took steps to exclude intruders from the networks.  Despite these efforts, a Linux-based version of X-Agent, programmed to communicate with the GRU-registered domain linuxkrnl.net, remained on the DNC network until in or around October 2016.

33.  In response to Company 1’s efforts , the Conspirators took countermeasures to maintain access to the DCCC and DNC networks.

33.  In response to Company 1’s efforts, the Conspirators took countermeasures to maintain access to the DCCC and DNC networks.

:a.  On or about May 31, 2016, YERMAKOV searched for open-source information about Company 1 and its reporting on X-Agent and X-Tunnel.  On or about June 1, 2016, the Conspirators attempted to delete traces of their presence on the DCCC network using the computer program CCleaner.

:a.  On or about May 31, 2016, YERMAKOV searched for open-source information about Company 1 and its reporting on X-Agent and X-Tunnel.  On or about June 1, 2016, the Conspirators attempted to delete traces of their presence on the DCCC network using the computer program CCleaner.

==COUNTS TWO THROUGH NINE (Aggravated Identity Theft)==

==COUNTS TWO THROUGH NINE (Aggravated Identity Theft)==

54.  Paragraphs 1 through 19, 21 through 49 , and 57 through 64 of this Indictment are re-alleged and incorporated by reference as if fully set forth herein.

54.  Paragraphs 1 through 19, 21 through 49, and 57 through 64 of this Indictment are re-alleged and incorporated by reference as if fully set forth herein.

55.  On or about the dates specified below, in the District of Columbia and elsewhere, Defendants VI KTOR BORISOVICH NETYKSHO, BORIS ALEKSEYEVICH ANTONOV, DMITRIY SERGEYEVICH BADIN, IVAN SERGEYEVICH YERMAKOV, ALEKSEY VIKTOROVICH LUKASHEV, SERGEY ALEKSANDROVICH MORGACHEV, NIKOLAY YURYEVICH KOZACHEK, PAVEL VYACHESLAVOVICH YERSHOV, ARTEM ANDREYEVICH MALYSHEV, ALEKSANDR VLADIMIROVICH OSADCHUK, and ALEKSEY ALEKSANDROVICH POTEMKIN did knowingly transfer, possess, and use, without lawful authority, a means of identification of another person during and in relation to a felony violation enumerated in Title 18, United States Code, Section 1028A(c), namely, computer fraud in violation of Title 18, United States Code, Sections 1030(a)(2)(C) and 1030(c)(2)(B), knowing that the means of identification belonged to another real person:

55.  On or about the dates specified below, in the District of Columbia and elsewhere, Defendants VI KTOR BORISOVICH NETYKSHO, BORIS ALEKSEYEVICH ANTONOV, DMITRIY SERGEYEVICH BADIN, IVAN SERGEYEVICH YERMAKOV, ALEKSEY VIKTOROVICH LUKASHEV, SERGEY ALEKSANDROVICH MORGACHEV, NIKOLAY YURYEVICH KOZACHEK, PAVEL VYACHESLAVOVICH YERSHOV, ARTEM ANDREYEVICH MALYSHEV, ALEKSANDR VLADIMIROVICH OSADCHUK, and ALEKSEY ALEKSANDROVICH POTEMKIN did knowingly transfer, possess, and use, without lawful authority, a means of identification of another person during and in relation to a felony violation enumerated in Title 18, United States Code, Section 1028A(c), namely, computer fraud in violation of Title 18, United States Code, Sections 1030(a)(2)(C) and 1030(c)(2)(B), knowing that the means of identification belonged to another real person:

62.  The Conspirators funded the purchase of computer infrastructure for their hacking activity in part by “mining” bitcoin.  Individuals and entities can mine bitcoin by allowing their computing power to be used to verify and record payments on the bitcoin public ledger, a service for which they are rewarded with freshly -minted bitcoin.  The pool of bitcoin generated from the GRU’s mining activity was used, for example, to pay a Romanian company to register the domain dcleaks.com through a payment processing company located in the United States.

62.  The Conspirators funded the purchase of computer infrastructure for their hacking activity in part by “mining” bitcoin.  Individuals and entities can mine bitcoin by allowing their computing power to be used to verify and record payments on the bitcoin public ledger, a service for which they are rewarded with freshly -minted bitcoin.  The pool of bitcoin generated from the GRU’s mining activity was used, for example, to pay a Romanian company to register the domain dcleaks.com through a payment processing company located in the United States.

63.  In addition to mining bitcoin, the Conspirators acquired bitcoin through a variety of means designed to obscure the origin of the funds.  This included purchasing bitcoin through peer -to-peer exchanges, moving funds through other digital currencies , and using pre-paid cards.  They also enlisted the assistance of one or more third -party exchangers who facilitated layered transactions through digital currency exchange platforms providing heightened anonymity.

63.  In addition to mining bitcoin, the Conspirators acquired bitcoin through a variety of means designed to obscure the origin of the funds.  This included purchasing bitcoin through peer -to-peer exchanges, moving funds through other digital currencies, and using pre-paid cards.  They also enlisted the assistance of one or more third -party exchangers who facilitated layered transactions through digital currency exchange platforms providing heightened anonymity.

64.  The Conspirators used the same funding structure—and in some cases, the very same pool of funds—to purchase key accounts, servers, and domains used in their election-related hacking activity.

64.  The Conspirators used the same funding structure—and in some cases, the very same pool of funds—to purchase key accounts, servers, and domains used in their election-related hacking activity.

===Statutory Allegations===

===Statutory Allegations===

65.  From at least in or around 2015 through 2016, within the District of Columbia and elsewhere, Defendants VIKTOR BORISOVICH NETYKSHO, BORIS ALEKSEYEVICH ANTONOV, DMITRIY SERGEYEVICH BADIN, IVAN SERGEYEVICH YERMAKOV, ALEKSEY VIKTOROVICH LUKASHEV, SERGEY ALEKSANDROVICH MORGACHEV, NIKOLAY YURYEVICH KOZACHEK, PAVEL VYACHESLAVOVICH YERSHOV, ARTEM ANDREYEVICH MALYSH EV, ALEKSANDR VLADIMIROVICH OSADCHUK, and ALEKSEY ALEKSANDROVICH POTEMKIN, together with others, known and unknown to the Grand Jury, did knowingly and intentionally conspire to transport, transmit, and transfer monetary instruments and funds to a place in the United States from and through a place outside the United States and from a place in the United States to and through a place outside the United States, with the intent to promote the carrying on of s pecified unlawful activity, namely , a violation of Title 18, United States Code, Section 1030, contrary to Title 18, United States Code, Section 1956(a)(2)(A).  All in violation of Title 18, United States Code, Section 1956(h).

65.  From at least in or around 2015 through 2016, within the District of Columbia and elsewhere, Defendants VIKTOR BORISOVICH NETYKSHO, BORIS ALEKSEYEVICH ANTONOV, DMITRIY SERGEYEVICH BADIN, IVAN SERGEYEVICH YERMAKOV, ALEKSEY VIKTOROVICH LUKASHEV, SERGEY ALEKSANDROVICH MORGACHEV, NIKOLAY YURYEVICH KOZACHEK, PAVEL VYACHESLAVOVICH YERSHOV, ARTEM ANDREYEVICH MALYSH EV, ALEKSANDR VLADIMIROVICH OSADCHUK, and ALEKSEY ALEKSANDROVICH POTEMKIN, together with others, known and unknown to the Grand Jury, did knowingly and intentionally conspire to transport, transmit, and transfer monetary instruments and funds to a place in the United States from and through a place outside the United States and from a place in the United States to and through a place outside the United States, with the intent to promote the carrying on of s pecified unlawful activity, namely, a violation of Title 18, United States Code, Section 1030, contrary to Title 18, United States Code, Section 1956(a)(2)(A).  All in violation of Title 18, United States Code, Section 1956(h).

==COUNT ELEVEN (Conspiracy to Commit an Offense Against the United States)==

==COUNT ELEVEN (Conspiracy to Commit an Offense Against the United States)==

74.  In or around August 2016, the Federal Bureau of Investigation issued an alert about the hacking of SBOE 1 and identified some of the infrastructure that was used to conduct the hacking.  In response, KOVALEV deleted his search history.  KOVALEV and his co-conspirators also deleted records from accounts used in their operations targeting state boards of elections and similar election-related entities.

74.  In or around August 2016, the Federal Bureau of Investigation issued an alert about the hacking of SBOE 1 and identified some of the infrastructure that was used to conduct the hacking.  In response, KOVALEV deleted his search history.  KOVALEV and his co-conspirators also deleted records from accounts used in their operations targeting state boards of elections and similar election-related entities.

75.  In or around October 2016, KOVALEV and his co-conspirators further targeted state and county offices responsible for administering tHe 2016 U.S. Elections.  For example, on or about October 28, 2016, KOVALEV and his co-conspirators visited the websites of certain counties in Georgia, Iowa, and Florida to identify vulnerabilities.

75.  In or around October 2016, KOVALEV and his co-conspirators further targeted state and county offices responsible for administering the 2016 U.S. Elections.  For example, on or about October 28, 2016, KOVALEV and his co-conspirators visited the websites of certain counties in Georgia, Iowa, and Florida to identify vulnerabilities.

76.  In or around November 2016 and prior to the 2016 U.S.  presidential election, KOVALEV and his co-conspirators used an email account designed to look like a Vendor 1 email address to send over 100 spearphishing emails to organizations and personnel involved in administering elections in numerous Florida counties.  The spearphishing emails contained malware that the Conspirators embedded into Word documents bearing Vendor 1’s logo.

76.  In or around November 2016 and prior to the 2016 U.S.  presidential election, KOVALEV and his co-conspirators used an email account designed to look like a Vendor 1 email address to send over 100 spearphishing emails to organizations and personnel involved in administering elections in numerous Florida counties.  The spearphishing emails contained malware that the Conspirators embedded into Word documents bearing Vendor 1’s logo.

==FORFEITURE ALLEGATION==

==FORFEITURE ALLEGATION==

79.  Pursuant to Federal Rule of Criminal Procedure 32.2, notice is hereby given to Defendants that the United States will seek forfeiture as part of any sentence in the event of Defendants’ convictions under Counts One , Ten , and Eleven of this Indictment.  Pursuant to Title 18, United States Code, Sections 982(a)(2) and 1030(i), upon conviction of the offenses charged in Counts One and Eleven , Defendants NETYKSHO, ANTONOV, BADIN, YERMAKOV, LUKASHEV, MORGACHEV, KOZACHEK, YERSHOV, MALYSHEV, OSADCHUK, POTEMKIN, and KOVALEV shall forfeit to the United States any property, real or personal, which constitutes or is derived from proceeds obtained directly or indirectly as a result of such violation, and any personal property that was used or intended to be used to commit or to facilitate the commission of such offense .  Pursuant to Title 18, United States Code, Section 982(a)(1), upon conviction of the offense charged in Count Ten , Defendants NETYKSHO, ANTONOV, BADIN, YERMAKOV, LUKASHEV, MORGACHEV, KOZACHEK, YERSHOV, MALYSHEV, OSADCHUK, and POTEMKIN shall forfeit to the United States any property, real or personal, involved in such offense, and any property traceable to such property .  Notice is further given that, upon conviction, the United States intends to seek a judgment against each Defendant for a sum of money representing the property described in this paragraph, as applicable to each Defendant (to be offset by the forfeiture of any specific property).

79.  Pursuant to Federal Rule of Criminal Procedure 32.2, notice is hereby given to Defendants that the United States will seek forfeiture as part of any sentence in the event of Defendants’ convictions under Counts One, Ten, and Eleven of this Indictment.  Pursuant to Title 18, United States Code, Sections 982(a)(2) and 1030(i), upon conviction of the offenses charged in Counts One and Eleven, Defendants NETYKSHO, ANTONOV, BADIN, YERMAKOV, LUKASHEV, MORGACHEV, KOZACHEK, YERSHOV, MALYSHEV, OSADCHUK, POTEMKIN, and KOVALEV shall forfeit to the United States any property, real or personal, which constitutes or is derived from proceeds obtained directly or indirectly as a result of such violation, and any personal property that was used or intended to be used to commit or to facilitate the commission of such offense .  Pursuant to Title 18, United States Code, Section 982(a)(1), upon conviction of the offense charged in Count Ten, Defendants NETYKSHO, ANTONOV, BADIN, YERMAKOV, LUKASHEV, MORGACHEV, KOZACHEK, YERSHOV, MALYSHEV, OSADCHUK, and POTEMKIN shall forfeit to the United States any property, real or personal, involved in such offense, and any property traceable to such property .  Notice is further given that, upon conviction, the United States intends to seek a judgment against each Defendant for a sum of money representing the property described in this paragraph, as applicable to each Defendant (to be offset by the forfeiture of any specific property).

===Substitute Assets===

===Substitute Assets===

{{reflist}}

{{reflist}}

[[category:Trump-Russia Collusion Hoax]]

[[Category:Trump-Russia Collusion Hoax]]