Malware & Threats

Ukrainian Raccoon Infostealer Operator Extradited to US

Alleged Raccoon Infostealer operator Mark Sokolovsky is awaiting trial in the US, after being extradited from the Netherlands.

Alleged Raccoon Infostealer operator Mark Sokolovsky is awaiting trial in the US, after being extradited from the Netherlands.

A Ukrainian national charged with operating the Raccoon Infostealer malware-as-a-service (MaaS) has made an appearance in a US court after being extradited from the Netherlands.

The man, Mark Sokolovsky, 28, was arrested in March 2022, after the FBI and law enforcement agencies in Italy and the Netherlands dismantled the Raccoon Infostealer infrastructure.

In October 2022, Sokolovsky was indicted in the US for his involvement in the distribution of the Raccoon Infostealer malware to millions of computers worldwide.

Distributed using phishing and other social engineering tactics, the malware was used to steal login credentials, financial data, and other personal information.

According to court documents, in addition to stealing information from victim systems, the Raccoon Infostealer operators also leased access to the malware, charging a fee of approximately $200 per month, payable in cryptocurrency.

In 2022, the FBI announced that it had collected various types of data exfiltrated from the Raccoon Infostealer-infected computers, including over 50 million unique credentials and forms of identification.

Advertisement. Scroll to continue reading.

“The United States does not believe it is in possession of all the data stolen by Raccoon Infostealer and continues to investigate,” the US Department of Justice said last week.

The FBI has created a website where victims can enter their email addresses to check whether their personal information is included in the dataset in the US government’s repository.

Sokolovsky is charged with conspiracy to commit computer fraud, conspiracy to commit wire fraud, conspiracy to commit money laundering, and aggravated identity theft. He made an appearance in court on February 9 and is currently awaiting trial.

Related: JFK Airport Taxi Hackers Sentenced to Prison

Related: DraftKings Hacker Sentenced to 18 Months in Prison

Related: Man Sentenced to Prison for Stealing Millions in Cryptocurrency via SIM Swapping

Related Content

Malware & Threats

Turla has been using the backdoor against government and military organizations in Ukraine for espionage.

Cybercrime

Hundreds of C&C servers were disrupted in an operation involving law enforcement and several cybersecurity companies.

Malware & Threats

Mistic is used by Woodgnat, an initial access broker working with Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta.

Cybercrime

26-year-old Abdellah Belmili faces up to 30 years in prison for allegedly operating the marketplaces Market0Day and Spoxy.

Malware & Threats

CryptoBandits uses a local SOCKS5 proxy for traffic routing, blending data theft with remote code execution.

Malware & Threats

The attackers deployed a new Go-based backdoor that uses Microsoft Teams servers for command-and-control.

Cybercrime

Researchers say the OnyxC2 malware targets more than 200 applications and extensions while evading detection through encrypted payloads, DLL sideloading, and in-memory execution techniques.

ICS/OT

A PowerShell script included in patch files appears to be triggering false positives by multiple security engines.

Copyright © 2026 SecurityWeek ®, a Wired Business Media Publication. All Rights Reserved.

Exit mobile version