Ukrainian National Pleads Guilty to “Raccoon Infostealer” Cybercrime

AUSTIN, Texas- A Ukrainian national pleaded guilty in federal court in Austin today to one count of conspiracy to commit computer intrusion.

According to court documents, Mark Sokolovsky, 28, conspired to operate the Raccoon Infostealer as a malware-as-a-service or "MaaS." Individuals who deployed Raccoon Infostealer to steal data from victims leased access to the malware for approximately $200 per month, paid for by cryptocurrency. These individuals used various ruses, such as email phishing, to install the malware onto the computers of unsuspecting victims. Raccoon Infostealer then stole personal data from victim computers, including log-in credentials, financial information, and other personal records. Stolen information was used to commit financial crimes or was sold to others on cybercrime forums.

In March 2022, concurrent with Sokolovsky's arrest by Dutch authorities, the FBI and law enforcement partners in Italy and the Netherlands dismantled the digital infrastructure supporting the Raccoon Infostealer, taking its then existing version offline. Sokolovsky was extradited to the United States from the Netherlands in February 2024 after being indicted for crimes related to fraud, money laundering and aggravated identity theft. As part of the plea, he agreed to a forfeiture money judgment of $23,975 and restitution of at least $910,844.61.

U.S. Attorney Jaime Esparza for the Western District of Texas made the announcement of the defendant's plea.

The FBI's Austin Cyber Task Force is investigating the case with the assistance of the Department of the Army Criminal Investigation Division (Army CID), the Austin Police Department, the Naval Criminal Investigative Service (NCIS), the Round Rock Police Department and the Texas Department of Public Safety.

Assistant U.S. Attorney G. Karthik Srinivasan is prosecuting the case.

Victims of the Raccoon Infostealer can find more information at www.justice.gov/usao-wdtx/victim-assistance-raccoon-infostealer.

###