Ukrainian national pleads guilty to leading Raccoon Infostealer malware operation

Mark Sokolovsky pleaded guilty this week in a US court following his arrest by Dutch authorities in 2022.

Mark Sokolovsky, a 28-year-old Ukrainian national, pleaded guilty to one count of conspiracy to commit computer intrusion in a U.S. federal court in Texas on October 7.

Sokolovsky was arrested in the Netherlands by Dutch authorities on March 22, 2022 and extradited to the United States in February 2024 after being charged with several crimes related to the operation of the Raccoon Infostealer malware-as-a-service operation.

According to court documents and the US Attorney’s Office for the Western District of Texas, Raccoon Infostealer was available for US$200 per month, payable in cryptocurrency. Once deployed – often via phishing emails – the malware was capable of stealing financial information, login credentials and other personal data.

This data was then used to facilitate financial fraud or was sold to other hackers on cybercrime forums.

After Sokolovsky’s arrest in 2022, the FBI managed to remove the infrastructure supporting the information thief, disrupting the existing version of the malware at the time.

However, a few months later, researchers from cybersecurity company Sekoia’s threat intelligence team found evidence of a new version of Raccoon Stealer in circulation. Other malware operators have promised to make a comeback on a Russian-language hacking forum in March 2022.

In May 2022, Raccoon Stealer v2 was sold both on Telegram and on hacking forums, and on June 10, 2022, its admin panel appeared in searches on the Shodan search engine.

“Samples of Raccoon Stealer v2 have therefore been observed in the wild since May 16, 2022,” Sekoia researchers indicated in a June 28, 2022 blog post.

“As with the previous version, malicious actors primarily distribute the information stealer using fake installers or cracked versions of popular software.”

Sokolovsky also agreed to pay restitution of at least US$910,844.61 and a forfeiture judgment of US$23,975.