The US Department of Justice (DoJ) has announced charges against two Russian nationals for operating money laundering services worth billions of dollars for cybercriminals, including ransomware groups.
The charges involve money laundering, bank fraud and facilitating websites that sell stolen credit card information and personal data.
The two individuals are Sergey Ivanov, who uses the alias “Taleon”, and Timur Shakhmametov (also known as “JokerStash” and “Vega”).
Ivanov is accused of laundering more than $1.15 billion in cryptocurrency through the services UAPS, PinPays and PM2BTC, while Shakhmametov allegedly operated one of the largest card marketplaces, “Joker’s Stash,” which made profits from at least $280 million and up to $1 billion.
According to the Department of Justice, Shakhmametov promoted Joker’s Stash on cybercriminal forums and was involved in bank fraud and money laundering in his position at the card store.
UAPS and PinPays acted as intermediaries for money transfers and payments, and both were confirmed to have been involved in transactions with card websites such as Rescator.
Rescator allegedly sold data from the infamous Target PoS breach in 2013, when up to 40 million cards and data of approximately 70 million people were stolen.
PM2BTC was a cryptocurrency exchange that primarily worked with Bitcoin, helping criminals convert between cryptocurrencies and fiat money without any know-your-customer (KYC) mechanism.
He US Department of Justice says that between July 2013 and August 2024, approximately 32% of all Bitcoin transactions associated with Ivanov platforms were traced back to criminal activity.
Joker’s Stash was a popular and long-established card store, offering data on around 40 million payment cards for sale each year. The platform operated between 2014 until 2021 when its administrator decided turn it off.
Even three years after Joker’s Stash threw in the towel, law enforcement authorities continued to collect and examine evidence, ultimately leading to the person behind it.
This action was carried out under the same operation that targeted Cryptex, a cryptocurrency exchange that the The US Treasury sanctioned yesterday for laundering money from Russian ransomware groups.
Dutch authorities seized servers hosting PM2BTC and Cryptex, and seized more than $7 million worth of cryptocurrencies during the action.
Meanwhile, the US State Department announced rewards of up to $11 million to obtain information leading to the whereabouts of Ivanov or Shakhmametov.
Last week, law enforcement authorities in Germany They seized 47 cryptocurrency exchange platforms hosted in the country and operating in violation of KYC regulations, facilitating money laundering for cybercriminals, including ransomware gangs.
Notable platforms removed as a result of the operation, codenamed “Final Exchange”, include Xchange.cash, 60cek.org, Bankcomat.com and Banksman.com, which together had more than 1.2 million accounts and They processed more than 3.5 million transactions.
