Another guilty plea in $568 million Infraud crime ring

Valerian Chiochiu, a 30-year-old Moldovan, allegedly wrote malware for the group.

A Moldovan man on Friday became the second person in as many months to plead guilty to being part of Infraud, a $568 million cybercriminal enterprise that stole payment cards and personal data from around the world, the U.S. Department of Justice said.

30-year-old Valerian Chiochiu, who allegedly trained Infraud members on writing and deploying malware, appeared before a judge in federal court in Nevada, U.S. officials said. Chiochiu’s guilty plea follows that of Sergey Medvedev, a 33-year-old Russian, who is accused of being the group’s co-founder.

The pleas are part of the ongoing U.S. effort to prosecute Infraud, which Department of Justice officials say victimized people in all 50 states. At its height, Infraud aspired to be the internet’s top spot for “carding,” or buying things with stolen credit card data. It amassed more than 10,000 members, and claimed to only allow vetted vendors of stolen data to advertise on the forum.

But the crime ring was dismantled in 2018 after the U.S. indictment of 36 of the organization’s affiliates and the arrest of 13 of them. Svyatoslav Bondarenko, a Ukrainian accused of being the other co-founder of Infraud, is still at large, according to Department of Justice officials.

Chiochiu joined Infraud in 2012, two years after it was formed, according to the indictment, and allegedly soon began putting his technical skills to use. He would post computer scripts and other code to the Infraud forum that could steal personal and financial data, prosecutors allege.

As part of the guilty plea, Chiochiu admitted to authoring a piece of malware known as FastPOS, U.S. officials said. That tool is “designed to immediately exfiltrate any stolen card data, instead of storing it locally in a file,” according to cybersecurity company Trend Micro.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure