Raccoon Infostealer developer sentenced to 5 years in federal prison

Mark Sokolovsky, a 28 year old man from Ukraine, has been sentenced to five years in federal prison for conspiracy to commit computer intrusion. In addition, he has to pay well over $900,000 in restitution.

Sokolovsky was arrested by the Dutch National Police in March 2022. In February 2024, the Ukrainian national was extradited to the United States after being indicted for crimes related to fraud, money laundering and aggravated identity theft.

Sokolovsky tried to impede his extradition numerous times. Eventually, late 2023, a court in The Hague concluded that there was no reason to assume he would be treated inhumanely in the US and he wouldn’t get a fair trial. Therefore, the extradition could proceed.

In October, the Ukrainian suspect pleaded guilty of his crimes in federal court. This week he got sentenced to five years in federal prison. As part of his plea, Sokolovsky agreed to forfeit $23,975 and pay the amount of $910,884.61 in restitution.

Sokolovsky’s infostealer was responsible for compromising more than 52 million user credentials, which were then used to commit fraud, identity theft, and ransomware attacks on millions of victims worldwide.

“Mark Sokolovsky was a key player in an international criminal conspiracy that victimized countless individuals by administering malware which made it cheaper and easier for even amateurs to commit complex cybercrimes,” US Attorney for the Western District of Texas Jaime Esparza said in a statement.

To avoid prison time, Sokolovsky tried to fake his own death, claiming he had been killed during the war between Russia and Ukraine. After only sixteen days, he was arrested while traveling in Europe in his Porsche Cayenne. At one of the crossings, a border camera snapped a photo of Sokolovsky driving, with his girlfriend in the passenger seat.

Raccoon Infostealer is malicious software that was developed to steal login credentials and other data for online banking and crypto wallets. Since 2018, it was offered as a malware-as-a-service, meaning that affiliates could use the malware in exchange for a piece of the unlawfully gained revenues and a monthly fee, which was about $200.