Ochko123 - How the Feds Caught Russian Mega-Carder Roman Seleznev
Black Hat
AI-assisted summary of Ochko123 - How the Feds Caught Russian Mega-Carder Roman Seleznev — original source. Check the original for full context.
Source published:
Key ideas
- Prolific Russian cybercriminal Roman Seleznev was sentenced to 27 years in federal prison following his conviction on 38 counts stemming from breaches of over 400 point-of-sale systems and at least $169 million in calculated fraud losses. (42:20)
- Seleznev was apprehended in July 2014 via an expulsion operation in the Maldives after U.S. Secret Service agents intercepted him at the Malé airport and transferred him directly to Guam on a private charter flight. (23:06)
- Forensic examiners bypassed Seleznev's unencrypted seized laptop using his recurring handle password 'ochko123', uncovering 1.7 million stolen payment card numbers, tutorials for encoding counterfeit cards, and PACER query logs tracking his own federal indictments. (25:31)
- Prosecutors thoroughly dismantled the defense's forensic tampering claims by demonstrating that post-arrest file timestamp updates were produced by Windows 8 Connected Standby background tasks, while Volume Shadow Copies corroborated the files' pre-arrest existence. (29:41)
Detailed notes
## Background This presentation was delivered by prosecutors Norman Barbosa and Harold Chun at Black Hat USA 2017 and published to YouTube by Black Hat on August 25, 2017. The video outlines how federal investigators tracked and caught Roman Seleznev, a prolific Russian mega-carder responsible for breaching over 400 point-of-sale systems and causing at least $169 million in credit card fraud.
## TL;DR Federal prosecutors detail the decadelong international investigation into Roman Seleznev, tracking his evolution through criminal hacker personas including nCuX, Track2, and 2Pac. Through a trail of server forensic logs, catastrophic operational security blunders with domestic services like Yahoo and PayPal, and historical Secret Service chat archives, investigators conclusively tied the online card shops to Seleznev. Following his dramatic capture via expulsion from the Maldives in 2014, agents cracked his seized laptop with the password 'ochko123' to reveal 1.7 million stolen credit cards. Despite defense claims of government framing and tampering, meticulous Windows forensic artifacts secured Seleznev's conviction on 38 counts and an ultimate 27-year prison sentence.
## Atmosphere & style The talk combines the dry, deadpan wit of seasoned federal prosecutors with the energetic cadence of an elite technical conference. Barbosa and Chun playfully bounce off each other, cracking insider jokes about government minders, FSB surveillance, and terrible cybercriminal operational security. Beneath the lighthearted banter, however, lies a gripping, procedural narrative that underscores the genuine tension of international fugitive apprehensions and the devastating financial ruin inflicted on small mom-and-pop businesses.
## Bulletin - [42:20](https://www.youtube.com/watch?v=6Chp12sEnWk&t=2540s) Prolific Russian cybercriminal Roman Seleznev was sentenced to 27 years in federal prison following his conviction on 38 counts stemming from breaches of over 400 point-of-sale systems and at least $169 million in calculated fraud losses. - [23:06](https://www.youtube.com/watch?v=6Chp12sEnWk&t=1386s) Seleznev was apprehended in July 2014 via an expulsion operation in the Maldives after U.S. Secret Service agents intercepted him at the Malé airport and transferred him directly to Guam on a private charter flight. - [25:31](https://www.youtube.com/watch?v=6Chp12sEnWk&t=1531s) Forensic examiners bypassed Seleznev's unencrypted seized laptop using his recurring handle password 'ochko123', uncovering 1.7 million stolen payment card numbers, tutorials for encoding counterfeit cards, and PACER query logs tracking his own federal indictments. - [29:41](https://www.youtube.com/watch?v=6Chp12sEnWk&t=1781s) Prosecutors thoroughly dismantled the defense's forensic tampering claims by demonstrating that post-arrest file timestamp updates were produced by Windows 8 Connected Standby background tasks, while Volume Shadow Copies corroborated the files' pre-arrest existence.
## Key takeaways - [00:00](https://www.youtube.com/watch?v=6Chp12sEnWk&t=0s) Proving attribution beyond a reasonable doubt to a federal jury required prosecutors to reconstruct an extensive electronic trail establishing exactly who operated the keyboard across three successive carding personas: nCuX, Track2, and 2Pac. - [04:12](https://www.youtube.com/watch?v=6Chp12sEnWk&t=252s) An early 2009 diplomatic outreach to Russia's FSB backfired when investigators shared dossiers identifying Seleznev, prompting his immediate fake retirement as nCuX and re-emergence months later under new aliases on Carder.su. - [12:05](https://www.youtube.com/watch?v=6Chp12sEnWk&t=725s) Seleznev's point-of-sale campaign relied on simple automated RDP port scans and brute-forced default vendor passwords to deploy RAM scrapers across hundreds of U.S. businesses, including Schlotzsky's Deli and Seattle's Broadway Grill. - [14:48](https://www.youtube.com/watch?v=6Chp12sEnWk&t=888s) A court-ordered pen-trap and search warrant on a domestic HopOne hosting server in Virginia exposed an automated clearinghouse containing roughly 400,000 stolen cards organized in flat files named by victim IP addresses. - [14:48](https://www.youtube.com/watch?v=6Chp12sEnWk&t=888s) Critical attribution broke open through severe operational security failures when Seleznev used card-shop registration emails to establish personal PayPal accounts, purchase flower deliveries, and book flights under his true identity. - [17:49](https://www.youtube.com/watch?v=6Chp12sEnWk&t=1069s) Archived Secret Service logs from a 2007 CarderPlanet prosecution yielded historical chat logs where Seleznev had voluntarily provided his real name, physical address, and personal emails without tradecraft precautions. - [19:08](https://www.youtube.com/watch?v=6Chp12sEnWk&t=1148s) Plans to apprehend Seleznev following his March 2011 federal indictment were disrupted when a terrorist bombing at Café Argana in Marrakech left him critically injured and comatose in Russia for months. - [21:21](https://www.youtube.com/watch?v=6Chp12sEnWk&t=1281s) Following recovery, Seleznev evolved from an individual POS hacker into a premier dark web carding broker via 2pac.cc, monetizing massive corporate breach dumps originating from retailers such as Target, Home Depot, and Neiman Marcus. - [23:06](https://www.youtube.com/watch?v=6Chp12sEnWk&t=1386s) Because Russia does not extradite its citizens, U.S. authorities relied on a high-speed interagency expulsion agreement with the Maldivian government rather than a multi-year formal extradition treaty. - [29:41](https://www.youtube.com/watch?v=6Chp12sEnWk&t=1781s) Recorded jailhouse phone calls between Seleznev and his father revealed overt discussions to pay off prosecutors with a proposed $10 million bribe, effectively eliminating any potential for a negotiated plea agreement. - [32:48](https://www.youtube.com/watch?v=6Chp12sEnWk&t=1968s) System Resource Usage Monitor (SRUM) data, cellular SIM logs, and network connection artifacts tied the laptop directly to local physical use under user account 'Smouse' at the Kanifushi resort prior to arrest. - [44:00](https://www.youtube.com/watch?v=6Chp12sEnWk&t=2640s) The primary economic and human toll of Seleznev's carding enterprise fell on approximately 400 small businesses and restaurants that suffered severe regulatory penalties and bankruptcies, rather than on affluent corporate chains or reimbursed consumers.
## Detailed walkthrough ### [00:00](https://www.youtube.com/watch?v=6Chp12sEnWk&t=0s) Introductions, Quirks, and the Public Trial Record
Prosecutor Norman Barbosa introduces himself as a computer crimes prosecutor from the U.S. Attorney’s Office in Seattle. Joining him is co-counsel Harold Chun, a former trial attorney from Main Justice in Washington, D.C., who “took the big money after we won this case” and moved to Google. Barbosa thanks an audience member for lending him a laptop after his own computer started screaming on his way to the conference with an error declaring it was about to suffer a catastrophic failure—prompting the joke that it was either the hackers or the FSB. Playing off the conference game "spot the Fed," Barbosa notes that the prosecution team instead plays "spot the FSB agent." He also reveals that their internal minders nixed his preferred title for the talk: *"Ochko123: Why you shouldn't use butthole123 as the password to your hacking empire."*
Barbosa explains that this presentation is a rare opportunity for Department of Justice attorneys to detail the specific electronic evidence gathered during a major computer crimes investigation. When a case goes to trial before a jury of twelve, prosecutors must prove attribution beyond a reasonable doubt—demonstrating conclusively who sat behind the keyboard—yielding far more public documentation than cases resolved by plea agreements. Although Barbosa, Chun, and Seattle AUSA Seth Wilkinson tried the case, Barbosa gives credit to the original investigative team who led the case prior to retirement: Assistant U.S. Attorney Katherine Worman (Barbosa's mentor) and lead investigator Detective David Dunn.
- **Presenters:** Norman Barbosa (Assistant U.S. Attorney, Western District of Washington) and Harold Chun (former Trial Attorney, DOJ Computer Crime and Intellectual Property Section / Main Justice; now Google). - **Core legal challenge:** Proving attribution—establishing to a 12-person jury precisely which human was operating the machine. - **Original investigative leaders:** Former AUSA Katherine Worman and Detective David Dunn.
---
[02:46](https://www.youtube.com/watch?v=6Chp12sEnWk&t=166s) The Rise of Roman Seleznev and International Fallout
Roman Seleznev was one of the world's most prolific traffickers in stolen credit card data between roughly 2005 and his arrest in 2014. Before his capture, he had already been indicted across three separate U.S. federal courts for an array of cybercrime charges. A Russian national, Seleznev maintained homes in Vladivostok, Moscow, and Bali, Indonesia. Multiple attempts to capture him between 2011 and 2014 had failed. His father was a member of the Russian parliament, and his deep political ties created immense geopolitical friction surrounding his eventual 2014 apprehension in the Maldives.
The arrest ignited intense diplomatic fallout: Barbosa and the trial team were placed on a Russian government blacklist, barring them from traveling to Russia. Barbosa reflects with regret, noting he had studied Russian in Moscow and hopes the tensions resolve one day. He emphasizes that Seleznev's vast financial resources fueled aggressive obstruction efforts during the trial and supported a high-powered, well-financed defense team.
```mermaid flowchart LR accTitle: Evolution of Seleznev's Carding Personas accDescr: Timeline tracing Roman Seleznev's three major online aliases from 2002 through 2014. subgraph P1["Chapter 1: 2002–2009"] A["nCuX / 'Psycho'<br>(CardingWorld, dumps & PII)"] end subgraph P2["Chapter 2: 2009–2012"] B["Track2 / Bulba<br>(Carder.su trusted vendor)"] end subgraph P3["Chapter 3: 2012–2014"] C["2Pac / Posdump<br>(Automated card shops)"] end A -->|"Fakes retirement (2009)"| B B -->|"Moroccan bombing / rebrand"| C ```
- **Indictments:** Charged across 3 federal judicial districts. - **Residences:** Vladivostok, Moscow, and Bali (Indonesia). - **Political impact:** Son of a Russian parliamentarian; capture resulted in DOJ prosecutors being formally blacklisted from Russia. - **Operational lifespan:** Active from 2002 until his arrest in July 2014.
---
[04:12](https://www.youtube.com/watch?v=6Chp12sEnWk&t=252s) The Three Chapters: nCuX, the Moscow Meeting, and the "Retirement"
Seleznev's career as an online carder divides into three distinct eras marked by shifting forum handles: **nCuX**, **Track2**, and **2Pac**. From 2002 to 2009, he built his initial presence under the handle "nCuX." In Cyrillic, this transliterates as "Псих" (Psikh or "Psycho"), a nickname given by friends due to his hot temper. Early on, he operated on CardingWorld and related forums trading full identities (PII including Social Security numbers and dates of birth). By 2005, recognizing credit cards offered faster and simpler monetization, he pivoted into card dumps.
This shift brought him to the attention of the U.S. Secret Service Cyber Intelligence Section (CIS) in Washington, D.C. Combining open-source intelligence and street-level detective work, CIS determined by 2009 that nCuX was likely Roman Valerevich Seleznev of Vladivostok. In 2009, representatives from the Secret Service and the FBI traveled to Moscow to meet directly with Russia's FSB, sharing substantive investigative dossiers identifying Seleznev as the suspect behind nCuX. The cooperation backfired immediately: within approximately one month of that meeting, nCuX vanished from the web, shuttered his accounts, and posted across forums that he was retiring forever. The sudden burned trail forced the Secret Service to regroup and rethink how they handled international collaboration.
---
[06:57](https://www.youtube.com/watch?v=6Chp12sEnWk&t=417s) Track2 Arrives on Carder.su and the Schlotzsky's Deli Intrusion
Seleznev had not retired; he had simply rebranded. In September 2009, he resurfaced under the handle **Track2** (along with the brand **Bulba**). On the very day he registered on **Carder.su**—then one of the largest cybercrime forums in the world—he was immediately awarded the rare status of "trusted vendor of dumps." As Barbosa explains, “This isn't just some brand-new hacker, some brand-new carder that has a small stash of credit cards; this is somebody who already must have some kind of reputation in the background of the carding community.” The administrators of Carder.su even granted Track2 a temporary monopoly, purging rival vendors to protect his market share. By May 2010, the Secret Service CIS had opened a formal investigation focused on Track2.
Around that same time in May 2010, Detective David Dunn, working with the regional computer crimes task force in Seattle, responded to an intrusion at a Schlotzsky’s Deli franchise in Coeur d’Alene, Idaho. Dunn imaged the point-of-sale (POS) systems and captured volatile RAM, instantly spotting the cash registers beaconing stolen card data directly out to a Russian IP address. Weeks later, common point of purchase (CPP) analysis linked a batch of compromised cards to that Schlotzsky’s breach, leading investigators to a suspect in Ohio whose machine had been imaged.
Dunn reviewed the Ohio suspect's drive and uncovered web browsing history for two storefront domains: `track2.name` and `bulba.cc`. Chat logs showed the user conversing with an individual using the handle Track2, who explained that while his primary outlet `track2.name` was offline, the buyer could purchase numbers via his reseller portal, `bulba.cc`. Recognizing both operations were tied to the same operator, Dunn began working the infrastructure: checking domain registrations, extracting registration emails, and tracking down associated U.S.-based email accounts. Partnering with the U.S. Attorney’s Office for the Eastern District of Virginia and Secret Service CIS, investigators began issuing federal warrants in September 2010, kicking off a long wait for returns from domestic email providers.
- **Carder.su monopoly:** Track2 joined in September 2009 and received immediate verified vendor status, with administrators banning competitors. - **Physical intrusion locus:** Point-of-sale terminals at Schlotzsky's Deli in Coeur d'Alene, Idaho. - **Technical evidence:** Volatile memory (RAM) scrapers transmitting card transactions straight to a Russian IP. - **Identified card shops:** `track2.name` and reseller site `bulba.cc`. - **Warrant phase:** Initiated in September 2010 in the Eastern District of Virginia against U.S.-hosted email and domain infrastructure.
[10:49](https://www.youtube.com/watch?v=6Chp12sEnWk&t=649s) The Broadway Grill Intrusion: A Case in Seattle's Backyard
While Detective Dunn was waiting for leads to develop in the Schlotzsky's Deli investigation, another intrusion suddenly surfaced right in his own backyard. The target was the Broadway Grill, a beloved, long-running restaurant situated on Capitol Hill in Seattle. Detective Dunn received an urgent call from a local Seattle-area bank fraud investigator warning that their fraud models had flagged a massive spike in stolen cards tracing directly back to charges made at the Broadway Grill. Dunn and a fellow detective rushed out to examine the restaurant's point-of-sale system, only to discover an astonishingly insecure setup: the computers were poorly configured, leaving roughly 32,000 customer credit card numbers sitting unencrypted in plain text.
Forensic analysis of the system image revealed that these stolen card numbers had been siphoned off and transmitted to the exact same foreign IP address previously flagged in the Schlotzsky's Deli intrusion. Furthermore, when Dunn analyzed the attacker's forensic footprint, he found that whoever planted the malware had manually opened a web browser on the Broadway Grill terminal and typed in an IP address corresponding to the identical Schlotzsky's Deli malware staging server. This discovery represented a critical turning point for the investigation. Norman Barbosa noted the profound practical impact of finding a local victim: “so he realizes well now I got a case in my backyard I'm gonna open up a case in the Western District of Washington and I no longer have to travel to Virginia or Idaho to deal with my process which is pretty fortunate for our office because at that point the case really really sped up”.
- **Victim:** The Broadway Grill, a staple eatery on Capitol Hill in Seattle, Washington. - **Exposure:** Approximately 32,000 credit card numbers stored in plain text due to poor point-of-sale system configuration. - **Forensic Link:** Plaintext data exfiltrated to the identical IP address identified in the Schlotzsky's Deli breach; malware had been manually retrieved via browser from that server. - **Jurisdictional Shift:** The local Seattle connection allowed Dunn to open an official case in the Western District of Washington (WDWA), eliminating the logistical delays of coordinating process out of Virginia or Idaho.
[12:05](https://www.youtube.com/watch?v=6Chp12sEnWk&t=725s) The HopOne Server and the Anatomy of Seleznev's POS Empire
Detective Dunn began aggressively serving legal process, pulling Whois registration records for the automated vending websites and issuing subpoenas and warrants for the associated Yahoo email accounts. While the original Schlotzsky's breach had sent stolen data straight to a server located in Russia, Dunn discovered that the suspect had just purchased a dedicated server hosted at HopOne Internet Corporation in McLean, Virginia. Having a domestic server operated by an American provider was a massive breakthrough. Investigators immediately obtained a court-authorized pen register and trap-and-trace order (pen-trap) on the HopOne box. While a pen-trap does not allow authorities to inspect the underlying content of communications, it granted real-time visibility into the source and destination IP addresses, port numbers, and the volume of data moving in and out of the server.
Monitoring the HopOne server revealed connections to hundreds of remote machines scattered across the United States. Cross-referencing those inbound IPs quickly uncovered a striking pattern: nearly every connecting machine was a restaurant operating a similar point-of-sale software architecture. Dunn had stumbled upon a national automated clearinghouse for restaurant hacks, allowing him to rapidly identify dozens of active restaurant victims across the country, including Seattle's Grand Central Baking Company. The architecture of Roman Seleznev's operation was surprisingly straightforward rather than a convoluted, multi-tier botnet. As Norman Barbosa characterized it: “It's not a terribly complicated one this isn't a botnet with all kinds of multiple layers of stuff this was pretty basic”. Seleznev sat at the center, running automated port scans across the internet looking for open Remote Desktop Protocol (RDP) connections. Whenever he spotted an exposed port, he brute-forced the credentials—frequently exploiting common default passwords used by third-party POS vendors—compromised the point-of-sale system, installed his RAM-scraping malware, and systematically funneled stolen card dumps into three primary staging servers: the HopOne server in Virginia, a server in Ukraine, and an exfiltration server referred to as "Shmak-and-Smouse."
```mermaid flowchart TD accTitle: Architecture of Roman Seleznev's POS Hacking Operation accDescr: Diagram illustrating how Seleznev identified vulnerable point-of-sale machines, deployed malware, and routed card data into centralized staging servers.
subgraph Hacker ["Attacker"] RS["Roman Seleznev\n(Vladivostok / Overseas)"] end
subgraph Targets ["Victim Point-of-Sale Systems"] BG["Broadway Grill\n(Seattle, WA)"] SD["Schlotzsky's Deli\n(Kootenai County, ID)"] GCB["Grand Central Baking\n& Hundreds of US Eateries"] end
subgraph Exfiltration ["Central Collection Infrastructure"] HO["HopOne Server\n(McLean, Virginia)"] UK["Ukraine Server"] SS["'Shmak-and-Smouse' Server"] end
RS -->|"Port scans internet for open RDP (Port 3389)"| Targets RS -->|"Brute-forces vendor/default credentials"| Targets Targets -->|"Automated plain-text exfiltration\n(files named by victim IP)"| Exfiltration RS -->|"Administers malware, downloads dumps\n& conducts personal browsing"| HO ```
[14:48](https://www.youtube.com/watch?v=6Chp12sEnWk&t=888s) OPSEC Blunders: Unmasking Roman Through Yahoo, PayPal, and Travel Caches
When federal agents executed a search warrant on the HopOne server, they discovered a goldmine of evidence: hundreds of exfiltration files containing approximately 400,000 freshly stolen credit card numbers. Seleznev had obligingly automated the organization of his loot, scripting his malware to post stolen data directly into flat text files titled with the unique IP address of each restaurant victim. This naming scheme made identifying victims, issuing breach notifications, and coordinating local forensics seamless for law enforcement.
The case transitioned from tracking compromised infrastructure to solid personal attribution when investigators scrutinized the Yahoo email accounts linked to the domain registrations of his automated card shops. Despite his technical sophistication as an intruder, Seleznev committed catastrophic operational security blunders by blurring his illicit infrastructure with his everyday domestic life. In the "Ruben Semby Lynch" Yahoo account—which was used to register his Track2 automated card-vending site—Dunn found that Roman had used the address to register a personal PayPal account. Norman Barbosa highlighted the investigative gift of Seleznev turning to domestic platforms: “In that email account he found that Roman had at least once made the mistake of using it for some of his personal business opening up a PayPal account unfortunately another American business that we were able to serve legal process upon and get copies of his records”. The subpoenaed PayPal records contained a residential address: Ostryakova 25, kv. 113, in Vladivostok, Russia—an exact match for the home address later recorded in his Russian passport.
A second personal email address, `bookscafe@yahoo.com`, proved even more devastating to Seleznev's anonymity. He had used the account continuously since 2006, linking his earlier hacker moniker `ncuX` directly to his current carding ventures. The account was filled with deeply personal transactions: - **A Flower Delivery Order:** Seleznev ordered a bouquet for his wife under his real name, providing a personal contact phone number that corroborated other records. The attached card message read affectionately: “you are the most beautiful but little Ava is more beautiful in all his daughter's name is Ava which was also in his passport at the time of his arrest”. - **Russian E-Commerce Purchases:** Order confirmations from domestic Russian online shops shipped directly to his residential properties in Vladivostok. - **HopOne Server Web History:** Seleznev used the HopOne collection server as a virtual private desktop for casual personal browsing and vacation logistics. Agents recovered a cached web receipt for an airline ticket that displayed his full name, date of birth, and complete Russian passport number for travel to his second home in Bali, Indonesia.
[17:49](https://www.youtube.com/watch?v=6Chp12sEnWk&t=1069s) The Secret Service Vault: The CarderPlanet Chat Archive
As Secret Service cyber intelligence agents assisted Detective Dunn in assembling the attribution dossier, they turned to their internal institutional archives, unearthing cold evidence that cemented Seleznev's multi-decade history in the criminal underground. In doing so, investigators demonstrated how veteran cybercrime syndicates remain deeply interconnected over decades. Agents pulled an archived chat log from a landmark 2007 Eastern District of New York prosecution stemming from the takedown of CarderPlanet—an inquiry originally launched around 2002 or 2003.
One of the key subjects convicted of money laundering in that New York prosecution was a criminal associate named Cesar Carranza. When forensic examiners extracted data from Carranza's seized computer, they discovered an unencrypted 2007 chat session with an individual operating under the handle `ncuX-111`. During the exchange, Seleznev showed an astonishing absence of tradecraft. Norman Barbosa pointed out that “on his computer that Secret Service had was a chat between him and NCU x-111 in which NCO x-111 not exercising any operational security at all gives his full name and address as well as a couple of emails that tied to many of his carding carding forum registrations”. This historical chat corroborated the physical addresses, names, and electronic handles that Dunn was currently finding in Seleznev's modern operations, removing any lingering doubt about the identity behind the keyboard.
[19:08](https://www.youtube.com/watch?v=6Chp12sEnWk&t=1148s) Indictment, the Marrakech Bombing, and the Global Hunt
Armored with extensive digital forensics, server logs, and attribution exhibits, Detective Dunn and Assistant United States Attorney Kathryn Warma presented their case to a federal grand jury in Seattle. In March 2011, the grand jury returned a comprehensive indictment charging Roman Seleznev with dozens of felony counts, including bank fraud, computer fraud, intentional damage to protected computers, possession of unauthorized access devices, and aggravated identity theft. Armed with the indictment, federal agents began laying plans to apprehend him whenever he traveled outside the extradition sanctuary of the Russian Federation.
Those apprehension plans were violently derailed almost immediately. In April 2011, Seleznev and his wife were vacationing in Marrakech, Morocco, and were seated on the second-floor terrace of Café Argana when a terrorist detonated a massive shrapnel bomb. The explosion ripped through the second floor, inflicting horrific casualties. Seleznev sustained devastating traumatic brain injuries and severe physical wounds. He was emergency-medevacked back to Moscow in critical condition, where he remained comatose for months and underwent extensive neurosurgical procedures.
Back in Seattle, Detective Dunn kept a vigilant eye on Seleznev's carding infrastructure, specifically his flagship automated vending shop, Bulba.cc. The criminal storefront suddenly stalled; available credit card dumps ceased updating, and an administrator stepped in to post an alert to restless underworld customers: “Somebody running the site for him would post things such as sorry the boss has been in an accident you know you got to hold on you got to wait and eventually the shop closed and approximately I think it was January of 2012 when bold Assisi closed”.
Even as Bulba.cc shuttered and Seleznev withdrew into physical rehabilitation, Dunn and AUSA Warma refused to abandon the pursuit: - **The South Korea Strategy:** Flight records indicated that Seleznev routinely transited through South Korea en route to his vacation villa in Indonesia. U.S. prosecutors coordinated with South Korean authorities to secure a provisional arrest warrant to seize him during a layover for extradition. However, after recovering from the bombing, Seleznev altered his travel patterns and booked direct flights to Indonesia, bypassing Korean airspace entirely. - **The German False Alarm:** An Interpol alert flared when an individual with a name nearly identical to Seleznev's triggered border controls in Germany. Investigators launched an urgent, cross-continental fire drill to intercept him, only to discover at the eleventh hour that German authorities had flagged the wrong traveler. - **Lures and Alternative Venues:** U.S. authorities explored options to lure Seleznev to Australia or encourage Indonesian authorities to expel him, but every initial diplomatic and investigative maneuver hit a dead end, keeping the mega-carder tantalizingly out of reach.
[21:21](https://www.youtube.com/watch?v=6Chp12sEnWk&t=1281s) Roman's Carding Empire (2pac.cc) and Reselling Stolen Breaches
Explaining why Roman Seleznev could not simply be picked up at home, Norm Barbosa points out that the Russian Federation does not extradite its own citizens, and US law enforcement had virtually no track record of productive cooperation with Russian authorities on the matter. As Barbosa put it, “Unfortunately Russia will not extradite their citizens and as you'd seen earlier we didn't have a great history of cooperation on the case with them.” While shielded from extradition in Russia, Seleznev launched a massive new carding empire centered around his automated vending shop, 2pac.cc. Barbosa presents an advertisement from Seleznev’s desktop, joking that the image is probably beaconing back to the Russians during the talk. The shop immediately tripped the alarms of the Secret Service Cyber Intelligence Section due to its unprecedented volume and the high-profile origins of its inventory.
Seleznev was no longer merely selling payment card records harvested through his own point-of-sale malware exploits. His standing in the carding underground was so formidable that top-tier international hackers sought him out as their primary broker and reseller. His platform stocked stolen payment data originating from landmark corporate breaches, including Target, Home Depot, and Neiman Marcus. He actively marketed his brokering services on dark web carding forums, promising hackers that he could command top dollar for their stolen dumps. Chat logs later seized from his personal computer laid bare his extensive business negotiations and immense illicit revenue. He funneled these proceeds into a lifestyle of lavish vacations across Bali, Indonesia, China, and the Maldives, posing for photos with luxury sports cars and enjoying high-end beach resorts.
- 2pac.cc functioned as an automated clearinghouse for Seleznev’s own dumps as well as dumps supplied by other elite cybercriminals. - The platform carried stolen payment data from major retail breaches, including Home Depot, Neiman Marcus, and Target. - Seleznev regularly traveled to luxury destinations outside Russia, notably the Maldives, Indonesia, and China.
[23:06](https://www.youtube.com/watch?v=6Chp12sEnWk&t=1386s) The Maldives Operation and Hasty Transfer to Guam
Barbosa recounts his sudden entry into the case around July 1 or July 2, 2014, when he was serving as the secondary federal prosecutor behind Kathryn Warma. While driving into the office and illegally talking on his cell phone, Barbosa received a frantic call from a supervisor in Harold Chun’s Department of Justice section in Washington, D.C., announcing that Roman Seleznev had just been located vacationing in the Maldives. Barbosa’s immediate, bewildered reaction was to ask who Seleznev was and where on earth the Maldives were. He was immediately pulled into an emergency interagency conference call connecting over twenty officials across the State Department, Department of Justice, the Secret Service, and US embassies in Moscow and Sri Lanka.
```mermaid flowchart TD accTitle: Timeline of Roman Seleznev's Capture in the Maldives accDescr: Chronology of the July 2014 operation tracking and arresting Seleznev in the Maldives. subgraph S1["Detection & Deployment"] A["July 1, 2014<br/>Seleznev located vacationing in Maldives"] --> B["July 3, 2014<br/>US Secret Service agents arrive on the ground"] end subgraph S2["Takedown & Transfer"] B --> C["July 5, 2014<br/>Seleznev arrives at Malé airport from resort"] C --> D["Maldivian authorities & USSS confront Seleznev"] D --> E["Boarded onto private charter flight within 3-hour window"] end subgraph S3["Custody & Arraignment"] E --> F["July 6, 2014<br/>Landed on US soil at Hagåtña Detention Facility, Guam"] F --> G["August 2014<br/>Transferred to Seattle for initial federal appearance"] end ```
While formal international extraditions routinely drag on between six months and four years, this operation unfolded with extraordinary velocity. Within 48 hours of detecting him on July 1, Secret Service agents were boots-on-the-ground in the Maldives. On July 5, Seleznev boarded a domestic connection from his secluded beach resort to the central international airport in Malé. In a rapid three-hour window, Maldivian authorities and Secret Service agents confronted him, served the arrest warrant, escorted him onto an awaiting chartered private aircraft, and took off for Guam. Although the United States had no formal bilateral extradition treaty with the Maldives, the local government agreed to expel Seleznev based on an urgent, high-level diplomatic appeal outlining his international cybercrime profile. Reflecting on the capture, Barbosa observed, “It was a very very successful operation an incredible example of helpful international cooperation in a in a tricky situation.” Seleznev was incarcerated at the Hagåtña Detention Facility in Guam by July 6, mounted legal challenges against his transfer, and ultimately made his initial appearance in federal court in Seattle that August.
[25:31](https://www.youtube.com/watch?v=6Chp12sEnWk&t=1531s) Unlocking the Laptop: Ochko123 and 1.7 Million Credit Cards
Harold Chun takes the stage to describe the evidentiary windfall seized during the Malé takedown, which included Seleznev’s personal laptop, iPhone, passport, and customs documents. This physical cache decisively substantiated years of digital forensics and attribution derived from remote server seizures and monitored email accounts. Throughout the multi-year investigation, agents had continually flagged infrastructure tied to specific handles and usernames, particularly recurring combinations of `NCUX`, `smells`, and `ochko`. When Secret Service forensic examiners sat down to unlock the seized computer, they entered the obvious candidate based on his historical aliases: `ochko123`. Chun quipped that the case agent insisted it was his very first guess, pointing out to the audience that "ochko" is Russian slang for "butthole."
Upon gaining access, investigators discovered 1.7 million stolen credit card numbers stored directly on the machine. Chun underscored the devastating weight of this find, remarking, “There's not much to say when you have 1.7 million credit card numbers with you when you're on vacation this was made the case more or less a slam dunk.” In addition to raw dumps, the laptop contained custom tutorials Seleznev had authored to instruct novice criminals on how to monetize stolen data. Titled as a guide on how to buy dumps and use them to make and swipe counterfeit cards in physical retail stores, the document explicitly acknowledged the crimes while outlining the necessary hardware—such as the MSR206 magnetic stripe card reader/writer—and detailing step-by-step encoding procedures to drive customer demand back to his carding shops. Furthermore, the laptop revealed web browsing logs from PACER (Public Access to Court Electronic Records). Prior to taking foreign trips, Seleznev had used his own PACER account to check whether sealed or unsealed federal indictments had been filed under his legal name or his long-standing online handles, such as "Bulba," inadvertently cementing the connection between his true identity and his hacker personas.
- Investigators unlocked Seleznev’s primary laptop using the password `ochko123`. - The machine held an unencrypted cache of 1.7 million stolen credit card numbers. - Seleznev authored step-by-step tutorials promoting the purchase of MSR206 encoders and plastic card blanks to expand the consumer base for his dumps. - PACER query logs on the laptop proved Seleznev actively researched his own name and hacker aliases (including "Bulba") in US federal court records before traveling internationally.
[29:41](https://www.youtube.com/watch?v=6Chp12sEnWk&t=1781s) Defense Strategies: Bribes, Jail Calls, and the Connected Standby Argument
Faced with 1.7 million credit cards on his personal machine, Seleznev pursued unconventional strategies rather than negotiating an ordinary resolution. Initially, discussions focused on whether his father, a member of the Russian parliament with political clout, could pressure the US government into returning him. Recorded jail calls quickly shifted to schemes to pay off the prosecution. Chun shares snippets of recorded detention conversations between Seleznev and his father deliberating an upfront bribe, with the father suggesting they simply pay everyone in advance and Seleznev enthusiastically agreeing that the prosecutors should be promised a lump sum equivalent to what they would make in an entire year. Intelligence subsequently indicated the proposed payoff was approximately $10 million. Chun notes that this loose talk effectively destroyed any path toward a negotiated plea: “If there's talk about bribing a prosecutor you know what it makes it really hard for a prosecutor to do to plea a case out right everything you do is now being scrutinized at that moment.”
Other recorded detention phone calls featured transparent, cryptic codes involving an "Uncle Andrei," mysterious hospital visits, and sorcerers. When these avenues collapsed, Seleznev’s defense team took the case to trial on a framing theory, alleging that either the United States government or an anonymous rival hacker had maliciously planted the 1.7 million credit card records onto his machine. The entire defense hinged on forensic metadata: thousands of files on the seized laptop showed "modified" and "accessed" timestamps dated days after Seleznev’s arrest in the Maldives. However, Chun clarifies the mundane technical reality behind the anomaly: the computer was a hybrid Windows 8 tablet device that agents had never fully shut down following the seizure. Operating in Windows 8 "Connected Standby" mode, background operating system processes, automated maintenance routines, and real-time antivirus scans continued executing while the hardware remained powered on, routinely updating file system access and modification timestamps across the storage volume.
[32:48](https://www.youtube.com/watch?v=6Chp12sEnWk&t=1968s) Debunking the Defense: Windows Artifacts and the Kanifushi Trail
To counter the defense team’s claim that Roman Seleznev’s seized laptop had been tampered with or planted, the prosecution turned to digital forensic experts. The government needed concrete system evidence showing who had actually used the machine last and where that activity took place. Because the laptop was a Windows machine, it was filled with rich built-in forensic artifacts: registry keys, event logs, the System Resource Usage Monitor (SRUM), the USN Journal (which logs continuous filesystem activity), and Volume Shadow Copies (automatic restore points that preserve previous states of the filesystem and files). The prosecution seized on this wealth of operating system artifacts, jokingly warning the audience: “And for the Black Hats out there, this is how the Feds are going to try to catch you—take note.”
```mermaid flowchart TD accTitle: Windows Forensic Artifacts Pipeline accDescr: Diagram illustrating how Windows forensic artifacts tied Roman Seleznev to the laptop and his stay in the Maldives. subgraph EvidenceSources["System Artifacts"] SRUM["SRUM & Event Logs"] NetLogs["Network & Cellular Logs"] VSC["Volume Shadow Copies"] end subgraph ForensicFindings["Identified Activity"] User["User: Smouse (SID S-1-5-...)"] Loc["Wi-Fi: Kanifushi & MegaFon SIM"] Prog["Last Execution: Tor Browser"] end subgraph Conclusion["Trial Impact"] Proof["Proved Direct Human Use Prior to Arrest"] end
SRUM --> User SRUM --> Prog NetLogs --> Loc VSC --> Proof User --> Proof Loc --> Proof Prog --> Proof ```
The network connection logs proved decisive. Forensics demonstrated that the last wireless network the laptop had connected to was named "Kanifushi," spanning an initial connection on Saturday, June 21, until its final disconnection around July 3. Kanifushi was the name of the luxury resort in the Maldives where Seleznev was staying—an opulent retreat backed up by hotel receipts showing a $20,000 bill. The laptop’s integrated cellular hardware also revealed that the last inserted SIM card connected to MegaFon, a major Russian cellular carrier. Forensic examination of the security event logs and SRUM corroborated that the user active on the laptop was not accessing it remotely over the internet, but was physically typing on the keyboard under the username "Smouse"—the primary local profile originally configured by Seleznev. Matching the Security Identifier (SID) confirmed that the final human-initiated program executed on the machine before capture was the Tor browser, followed exclusively by background operating system processes without any human intervention.
- **Network connections:** Wi-Fi logs established continuous use on the resort network "Kanifushi" from June 21 through July 3, 2014. - **Cellular logs:** The laptop's embedded SIM registered connections with Russian provider MegaFon. - **User profile:** Security event logs showed direct, local console logins under the account "Smouse" (matching SID `S-1-5-...`). - **Final application:** The last human-initiated process recorded in SRUM was the Tor browser, followed strictly by automated Windows system activity (SID `S-1-5-18`).
[36:32](https://www.youtube.com/watch?v=6Chp12sEnWk&t=2192s) Shadow Copies, Cloud Backups, and Jury Conviction
The electronic trail extended far beyond live system logs. Investigators methodically extracted corroborating files from unallocated clusters and slack space, pulling up deleted materials and archive fragments. Crucially, the team leveraged Windows Volume Shadow Copies. For nearly every trial exhibit introduced into evidence, forensic analysts pulled an identical earlier version out of the shadow copy snapshots, proving through earlier system timestamps that the files were created and modified on the laptop long before Seleznev’s arrest.
Furthermore, investigators discovered widespread digital cross-references across cloud storage accounts and Seleznev’s mobile phone. Photographs, administrative documents, copies of his passport, and server configurations were duplicated across these platforms, directly binding his physical identity to the laptop and his international cybercrime infrastructure. Faced with this overwhelming mosaic of digital and physical proof, a federal jury in Seattle deliberated for only a few hours before convicting Seleznev on 38 counts.
- **Filesystem extraction:** Deleted items recovered from filesystem slack space and unallocated space directly matched evidence catalogs. - **Volume Shadow Copies:** With only one exception, every digital exhibit was successfully pulled from historic Volume Shadow Copies, conclusively proving the files existed on the machine prior to government custody. - **Corroborating cloud records:** Mobile devices and cloud storage held matching photographs, identity papers, and server backups linking Seleznev directly to his carding operations. - **Verdict:** A federal jury in Seattle returned a guilty verdict across 38 counts after only a few hours of deliberation.
[38:06](https://www.youtube.com/watch?v=6Chp12sEnWk&t=2286s) Q&A: Expulsion over Extradition and Operational Scope
Opening the floor to audience questions, the presenters first addressed how Seleznev was brought into American custody from the Maldives, an archipelago nation without an extradition treaty with the United States. Norman Barbosa clarified that the transfer was not an extradition at all, but rather an expulsion: “We asked the Maldivian government if they would expel him into our custody on the basis of a US arrest warrant and indictment, and they said yes.” When asked whether full-disk encryption had presented an obstacle, the presenters noted that encryption was surprisingly not an issue on his seized laptop, prompting a dry piece of advice to the audience: “Lesson: you should encrypt devices.”
Another attendee inquired about the broader syndicate behind Seleznev, asking whether the takedown managed to dismantle his entire operation or if broader political and conspiratorial networks persisted. Harold Chun responded with humor about ongoing casework: “Crime has not gone away; I have job security and I will continue to work on this problem.” Barbosa emphasized that while carding ecosystems have many participants, Seleznev personally drove the core activity of this enterprise, maintaining centralized, hands-on control rather than delegating it to an expansive command hierarchy.
- **Legal mechanism:** Seleznev was expelled directly into U.S. custody by Maldivian authorities rather than formally extradited. - **Device encryption:** Full-disk encryption was entirely absent on the target laptop, eliminating a major technical barrier for investigators. - **Enterprise structure:** While linked to wider criminal trading forums, Seleznev personally operated the bulk of the hacking and point-of-sale infrastructure.
[40:00](https://www.youtube.com/watch?v=6Chp12sEnWk&t=2400s) Q&A: Operational Security Blunders and Case Timing
The discussion then shifted to Seleznev's operational security (OpSec) failures, which an audience member compared to the capture of the dark web market AlphaBay's administrator, who famously included his personal Hotmail address in site welcome and password reset emails. Asked whether high-tier cybercriminals are adopting better OpSec, the speakers agreed that while operational security has evolved substantially since Seleznev’s heyday, maintaining an ongoing criminal enterprise leaves hackers structurally vulnerable. As Chun explained, the difficulty lies in execution over time: “I do think though the hard part of a ongoing hacking empire, however, is keeping yourself—your online profile and your actual self—separate completely.” He pointed out that single glitches—a VPN dropping out, an IP address leak, or a hardware configuration error—give law enforcement the tiny opening they need to unravel an identity.
Addressing whether the government could have won a conviction without recovering the laptop password or accessing the physical machine, the prosecutors expressed absolute confidence. They had already secured an indictment before possessing the laptop, relying on the massive trail of external network evidence, server logs, and financial flows assembled prior to his capture. Asked why there was a multi-year gap between Seleznev's 2011 injury in Morocco and his 2014 arrest, Barbosa noted that tracking international fugitives who reside in non-extradition jurisdictions requires patience and fortune: “It often takes a very long time for us to get lucky and get a tip as to where somebody might be.”
- **OpSec vulnerability:** Persistent online operations inevitably experience technical leaks (VPN failures, IP leaks, hardware identifier reuse) that investigators exploit. - **Pre-arrest case strength:** Prosecutors were prepared to proceed to trial solely on pre-arrest electronic wire and server evidence had the physical laptop proved inaccessible. - **Timing gap:** The 2011–2014 delay stemmed from Seleznev residing safely inside Russia until actionable intelligence surfaced revealing his travel to the Maldives.
[42:20](https://www.youtube.com/watch?v=6Chp12sEnWk&t=2540s) Q&A: Russian Law Enforcement and a 27-Year Sentence
An attendee recounted speaking with a prominent Russian-American defense attorney who had considered representing Seleznev before passing on the case, having concluded the defendant was stubbornly unreasonable. The attendee asked whether the earlier, compromised outreach to the Russian FSB had fundamentally altered how American law enforcement handles cooperative outreach abroad. Barbosa declined to address broader policy decisions set by the Department of Justice in Washington, D.C., but acknowledged the reality on the ground: “I can only say that it had an impact on this case; we had to take it into consideration in this particular case and it impacted how we went forward.”
The session concluded with a discussion of Seleznev’s ultimate punishment. Sentenced on April 21, 2017, in Seattle federal court, Seleznev received 27 years in federal prison. The severe penalty was driven by the federal sentencing guidelines, which weighed a conservatively calculated fraud loss of $169 million—based strictly on stolen credit cards recovered directly from his devices, leaving out millions more in uncharged or unrecovered cards. In addition to the sheer monetary damage, the presiding judge weighed heavily Seleznev’s unrepentant conduct and his repeated, blatant attempts to obstruct justice throughout the judicial proceedings.
- **Sentence:** 27 years of incarceration, handed down on April 21, 2017, in Seattle federal court. - **Restitution and loss:** Loss calculations established at least $169 million, derived purely from cards extracted from his seized machines. - **Aggravating factors:** Extensive post-arrest obstruction of justice substantially elevated the final judicial sentence.
[44:00](https://www.youtube.com/watch?v=6Chp12sEnWk&t=2640s) Sentencing, Perjury, and the Devastating Impact on Victims
The prosecution details the aftermath of Roman Seleznev’s trial and the courtroom dynamics during sentencing. Throughout multiple pretrial and post-trial hearings, Seleznev repeatedly took the stand and lied under oath. The presiding judge saw straight through his deceit and made a specific factual finding that Seleznev had committed perjury in a calculated attempt to sway judicial rulings. The speakers point out the tactical folly of this approach: “the judge saw through it and specifically found that he had lied to the court in an effort to to sway particular rulings which is never a good thing to do when you're going to be in front of that same judge for sentencing.” When computing his punishment under the United States Federal Sentencing Guidelines, the loss amounts and offense characteristics caused the calculation to go off the charts of the sentencing table, which called for a mandatory recommendation of life imprisonment. Ultimately, the judge granted a substantial downward departure from life, imposing what the court deemed an appropriate sentence under statutory sentencing factors.
```mermaid flowchart TD accTitle: Roman Seleznev Sentencing and Victim Impact accDescr: Chart outlining the sentencing guidelines calculation and the devastating financial fallout for hacked small businesses.
subgraph Courtroom ["Judicial Proceedings"] Perjury["Seleznev Perjury in Hearings<br/>(Judge finds intentional lies)"] Guidelines["Federal Sentencing Guidelines<br/>(Off the charts -> calls for Life)"] Sentence["Downward Departure<br/>(Lengthy prison term imposed)"] Perjury --> Guidelines --> Sentence end
subgraph Victims ["Victim Impact Scope"] Hacks["~400 Hacked Businesses<br/>(Nationwide footprint)"] SmallBiz["Mom-and-Pop Shops & Diners<br/>(Lack corporate reserves)"] Fallout["Severe Financial Devastation<br/>(Broadway Grill bankruptcy)"] Hacks --> SmallBiz --> Fallout end ```
The speakers stress that the human cost of carding schemes is frequently misunderstood. The public often views cardholders whose numbers are compromised as the primary victims, but the true burden falls heavily on the compromised businesses themselves. Seleznev victimized roughly 400 merchants across the United States. Crucially, these were not massive, cash-rich enterprises; they were small mom-and-pop shops and local restaurants that lacked financial resilience. A number of them were ruined entirely; for example, the Broadway Grill went bankrupt within months to about a year following the security breach. On a broader level, the financial devastation rippled through local communities across the country. Compounding this outcome, law enforcement has been unable to recover any stolen funds due to the immense difficulties of international legal assistance when trying to locate and seize offshore bank accounts.
- The federal sentencing guidelines calculation was literally off the chart and called for a sentence of life imprisonment, though the judge departed downward. - Seleznev compromised approximately 400 businesses nationwide, disproportionately harming small, independent retailers. - Seattle-area restaurant Broadway Grill went out of business and filed for bankruptcy within months to a year of the cyber intrusion. - No illicitly obtained funds have been recovered by federal authorities to date.
---
[45:35](https://www.youtube.com/watch?v=6Chp12sEnWk&t=2735s) Audience Q&A: Mobile Forensics, Pending Indictments, and Stolen Data Remediation
The session transitions into an open audience Q&A covering the operational and forensic intricacies of the investigation:
- **The Pass on Indonesia:** An audience member inquires why investigators decided against apprehending Seleznev during his prior travels in Indonesia. The speaker responds that it was an internal operational decision not to move forward in that jurisdiction, declining to elaborate further. - **Forensics on Seleznev's iPhone:** Asked about the mobile phone seized during the arrest, the prosecutors explain that investigators ran multiple forensic searches. Early on, the government secured an Apple unlock order under the All Writs Act that yielded substantial evidence, conducted just before Apple halted compliance with such orders. Technicians subsequently brute-forced the device passcode to recover the remaining files. While the extracted mobile data was not heavily featured at trial, specific photos pulled from the phone were admitted as trial exhibits. - **Pending Indictments in Other Jurisdictions:** When asked about two separate pending federal indictments against Seleznev, the prosecutor declines to comment on active cases, stating: “he is presumed innocent until proven guilty on those cases and I so I can't comment on where that may lead.” The speaker notes that Seleznev is currently transferred to Atlanta to face further proceedings. - **Maldives Travel Patterns:** An attendee jokingly asks if law enforcement monitored whether other Russian cybercriminals stopped vacationing in the Maldives following Seleznev's apprehension, drawing laughter from the room. - **Bank Notification and Card Invalidation:** Another attendee asks how investigators remediated the compromised financial data found on Seleznev's seized laptop. The speakers reveal that law enforcement contacted roughly 3,700 distinct issuing banks across the globe to alert them to specific compromised payment cards, prompting a speaker to remark: “I didn't know there were that many banks they were and they were all over the world.”
---
[47:28](https://www.youtube.com/watch?v=6Chp12sEnWk&t=2848s) Audience Q&A: Interagency Coordination and Merchant Liability
The final questions focus on interagency equities and the legal standing of the compromised merchants:
- **Declassifying Law Enforcement Techniques:** An audience member questions how the team coordinated with other federal stakeholders that might hesitate to reveal sensitive investigative tradecraft in open court, asking whether it was worth potentially burning investigative tools just to convict a single cybercriminal. The speaker dismisses the premise, stating: “I don't think we actually blew any techniques that weren't public that wasn't a concern here.” They add humorously that the very fact they are standing on stage at Black Hat delivering the briefing confirms that all internal equities were cleared. - **The Maldives Tip:** A listener asks who provided the actionable intelligence tip that alerted the U.S. Secret Service to Seleznev's departure from the Maldives, prompting the rush to apprehend him. The speaker firmly shuts down the inquiry: “I can't tell you.” - **Cleartext Storage and Merchant Liability:** The final question addresses merchant liability, asking if businesses that held cardholder data unencrypted suffered criminal penalties. The speaker clarifies that unencrypted storage was not the norm across the board, although there was an egregious outlier involving a merchant storing 32,000 cleartext card records. The compromised businesses faced zero criminal liability. Instead, their losses stemmed from payment network fines, regulatory compliance penalties, and lost business revenue. The speaker concludes by noting that while numerous system vulnerabilities existed across the victim businesses, attributing root security flaws was not the focus of the prosecution. The session concludes as the presenters are signaled for time.
## Notable quotes > [40:00](https://www.youtube.com/watch?v=6Chp12sEnWk&t=2400s) the hard part of a ongoing hacking empire, however, is keeping yourself—your online profile and your actual self—separate completely. — Harold Chun
## Mentioned Norman Barbosa, Harold Chun, Roman Seleznev, Seth Wilkinson, Katherine Worman, David Dunn, Cesar Carranza, Federal Bureau of Investigation, United States Secret Service, Federal Security Service, CardingWorld, Carder.su, CarderPlanet, HopOne Internet Corporation, Schlotzsky's Deli, Broadway Grill, Grand Central Baking Company, Yahoo, PayPal, PACER, Apple, Target, Home Depot, Neiman Marcus, MegaFon, Tor
## Video description Best of Black Hat USA 2017 Briefings Winner
How did the Feds catch the notorious Russian computer hacker Roman Seleznev - the person responsible for over 400 point of sale hacks and at least $169 million in credit card fraud? What challenges did the government face piecing together the international trail of electronic evidence that he left? How was Seleznev located and ultimately arrested? This presentation will begin with a review of the investigation that will include a summary of the electronic evidence that was collected and the methods used to collect that evidence.
by Harold Chun & Norman Barbosa
Read More: https://www.blackhat.com/us-17/briefings/schedule/index.html#ochko123---how-the-feds-caught-russian-mega-carder-roman-seleznev-6677
[Source](https://www.youtube.com/watch?v=6Chp12sEnWk)