Ukrainian hacker confesses leading Raccoon malware-as-a-service operation

28 year old Ukrainian national Mark Sokolovsky committed he led the Raccoon Infostealer malware-as-a-service or ‘MaaS’ operation.

Raccoon Infostealer is malicious software that was developed to steal login credentials and other data for online banking and crypto wallets. It was offered as a malware-as-a-service, meaning that affiliates could use the malware in exchange for a piece of the unlawfully gained revenues and a monthly fee, which was about $ 200, paid for by cryptocurrency.

Affiliates used Raccoon Infostealer in email phishing attacks in order to infect as many computers as possible of unsuspecting victims. The data that was obtained with the malware, such as login credentials, financial information, and other personal records, was then used for financial fraud, or sold on hacking forums on the dark web.

According to the American authorities, millions of computers worldwide have been infected with Raccoon Infostealer. The FBI’s Internet Crime Complaint Center (IC3) developed a website that allowed people to see whether their computer was infected with the Raccoon malware, simply by entering their email address.

In March 2022, Sokolovsky was arrested by the Dutch National Police. In February 2024, the Ukrainian suspect got extradited to the United States after being indicted for crimes related to fraud, money laundering and aggravated identity theft.

Sokolovsky tried to impede his extradition several times, but to no avail. Late 2023, a court in The Hague concluded that there was no reason to assume he would be treated inhumanely in the U.S. and he wouldn’t get a fair trial. Therefore, the extradition could proceed.

The U.S. Department of Justice says in a press release that Sokolovsky pleaded guilty of his crimes in federal court. As part of the plea, he agreed to a forfeiture money judgment of $ 23,975 and restitution of at least $ 910,844.61.

When the judge will make its final decision remains unclear.