9 Charged In $30 Million Securities Fraud, Hacking Scheme

Over five-year period, attackers stole non-public earnings data from multiple newswire services, used it for illicit trades, and reaped millions in illegal profits

Sara Peters, Senior Editor

August 11, 2015

2 Min Read
Dark Reading logo in a gray background | Dark Reading

Today, nine individuals were slammed with criminal charges for their involvement in a securities fraud scheme that earned them $30 million in illegal gains by stealing, and trading upon, corporate earnings data stolen from newswire services before they were published. The charges include securities fraud, wire fraud, fraud in connection with computers, aggravated identity theft, and money laundering conspiracy, and were brought by the U.S. Attorney’s Office for the District of New Jersey and the U.S. Attorney’s Office for the Eastern District of New York.

In addition to the criminal charges, the Securities and Exchange Commission announced fraud charges against those defendants and another 23 others; with those additional defendants' illicit earnings added in, the SEC says the scheme's illegal gains total over $100 million.  

"Hacker defendants" Ivan Turchynov and Oleksandr Ieremenko, listed in the indictment as computer hackers that resided in Ukraine, compromised a variety of newswire services, including PR Newswire (owned by UBM plc, Dark Reading's parent company), Marketwired, and Business Wire.

Tens of thousands of press releases were stolen from each of the services before they were published.The attackers obtained access to Marketwired networks in 2010 via SQL injection and used reverse shells to steal the data. They also obtained contact information and credentials for Marketwired employees, customers, and business partners. They obtained access to PRN on three occasions in 2010, 2011, and 2013 and lost access once because of a change in PRN's infrastructure, and twice because PRN detected the intrusion and ejected the attackers. They compromised Business Wire and stole credentials, including 15 employees' that had been brute-forced.

The seven "trader defendants" -- Arkadiy Dubovoy, Igor Dubovoy, Pavel Dubovoy, Vitaly Korchevsky, Vladislav Khalupsky, Aleksandr Garkusha, and Leonid Momotok -- live in both the United States and the Ukraine. They traded on the privileged information before it was publicly released, and paid Turchynov and Ieremenko portions of their proceeds, often through the use of shell companies.

“Russian speaking cybercriminals have immersed and educated themselves on the information supply chain of Wall Street,” said Trend Micro chief cybersecurity officer Tom Kellermann. “Within the capital market community, information plus time equals power. Media outlets are key distributors of market information and are being targeted for the purposes of front running, a widespread phenomenon that was first highlighted in a 2006 World Bank report.”

About the Author

Sara Peters

Senior Editor

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad of other topics. She authored the 2009 CSI Computer Crime and Security Survey and founded the CSI Working Group on Web Security Research Law -- a collaborative project that investigated the dichotomy between laws regulating software vulnerability disclosure and those regulating Web vulnerability disclosure.


Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights