Cybercrime

Ukrainian Malware Operator Pleads Guilty in US Court

Ukrainian national Mark Sokolovsky has pleaded guilty in a US court to operating the malware named Raccoon Infostealer.

Ukrainian national Mark Sokolovsky has pleaded guilty in a US court to operating the malware named Raccoon Infostealer.

The US Justice Department announced on Monday that a Ukrainian national has pleaded guilty over his role in the operation of a piece of malware named Raccoon Infostealer.

The individual is 28-year-old Mark Sokolovsky. He was arrested in March 2022 in the Netherlands and extradited to the US in February 2024 to face computer hacking, fraud, identity theft and money laundering charges.

When they arrested Sokolovsky, authorities also dismantled the infrastructure used at the time by Raccoon Stealer, but the malware was later resurrected

The Justice Department said Sokolovsky pleaded guilty in a Texas court to one count of conspiracy to commit computer intrusions. As part of the plea agreement, the Ukrainian cybercriminal will forfeit nearly $24,000 and pay more than $910,000 in restitution. 

Raccoon Infostealer emerged in 2018 and Sokolovsky is said to be one of its “key administrators”.

The malware, offered through a malware-as-a-service model, enabled users to steal data from infected devices, including login credentials and financial information, which could be used for financial crimes or be sold to other cybercriminals.

Advertisement. Scroll to continue reading.

Raccoon Infostealer was leased to malicious actors for $200 per month and it infected millions of computers around the world.

The FBI has set up a website where users can check whether their email address shows up in the data stolen by Raccoon Infostealer.

Related: More LockBit Hackers Arrested, Unmasked as Law Enforcement Seizes Servers

Related: Russian TrickBot Malware Developer Sentenced to Prison in US

Related: Russian Sentenced to Prison in US for Selling Stolen Information

Related: Ukrainian Sentenced to Prison in US for Role in Zeus, IcedID Malware Operations

Related Content

Malware & Threats

CryptoBandits uses a local SOCKS5 proxy for traffic routing, blending data theft with remote code execution.

Malware & Threats

The attackers deployed a new Go-based backdoor that uses Microsoft Teams servers for command-and-control.

Cybercrime

Researchers say the OnyxC2 malware targets more than 200 applications and extensions while evading detection through encrypted payloads, DLL sideloading, and in-memory execution techniques.

ICS/OT

A PowerShell script included in patch files appears to be triggering false positives by multiple security engines.

Identity & Access

As attackers increasingly favor stolen credentials over exploits, infostealers have become a primary source of access for ransomware and other cybercrime operations.

Artificial Intelligence

Researchers warn GreyVibe’s extensive use of ChatGPT, Gemini, and other AI tools offers a glimpse into how future cybercriminal and state-aligned groups will operate.

Malware & Threats

Delivered via phishing lures, the malware combines financial theft with data exfiltration and remote access.

Supply Chain Security

Published within a 15-minute window, the malicious tags introduced backdoors to exfiltrate CI secrets.

Copyright © 2026 SecurityWeek ®, a Wired Business Media Publication. All Rights Reserved.

Exit mobile version