FIN7 Supervisor Gets 7-Year Jail Term for Stealing Millions of Credit Cards

A Ukrainian national and a mid-​level supervisor of the hacking
group known as FIN7 has been sentenced to seven years in prison for
his role as a “pen tester” and perpetuating a criminal scheme that
enabled the gang to compromise millions of customers debit and
credit cards.

Andrii Kolpakov^[1], 33, was arrested in
Spain on June 28, 2018, and subsequently extradited to the U.S. the
following year on June 1, 2019. In June 2020, Kolpakov pleaded
guilty to one count of conspiracy to commit wire fraud and one
count of conspiracy to commit computer hacking.

The Western District of Washington also ordered Kolpakov to pay
$2.5 million in restitution.

The defendant, who was involved with the group from April 2016
until his arrest, managed other hackers who were tasked with
breaching the point-of-sale systems of companies, both in the U.S.
and elsewhere, to deploy malware capable of stealing financial
information.

FIN7^[2], also called Anunak,
Carbanak Group^[3], and the Navigator
Group, is said to have engaged in a sophisticated malware campaign
at least since 2015 targeting restaurant, gambling, and hospitality
industries in the U.S. to plunder credit and debit card numbers
that were then used or sold for profit on underground forums.

According to court documents, FIN7 used a firm called Combi
Security as a front to recruit hackers — one of them being Kolpakov
— to “provide a veil of legitimacy to the illegal enterprise,”
while projecting itself as “one of the leading international
companies” that offered penetration testing services to customers
worldwide.

“FIN7 carefully crafted email messages that would appear
legitimate to a business’s employees and accompanied emails with
telephone calls intended to further legitimize the emails,” the
Department of Justice (DoJ) said^[4]
in a release. “Once an attached file was opened and activated, FIN7
would use an adapted version of the Carbanak malware^[5], in addition to an
arsenal of other tools, to access and steal payment card data for
the business’s customers.”

The total damages stemming from these intrusions exceeded $1
billion, the DoJ said.

Kolpakov is the second member of the FIN7 group to be sentenced
in the U.S. since the start of the year. In April, another
35-year-old Ukrainian national Fedir Hladyr^[6]
was awarded 10 years in prison for his role as a high-level manager
and systems administrator responsible for maintaining the server
infrastructure that FIN7 used to attack and control victims’
machines.