WEBVTT
1
00:00:12.000 --> 00:00:16.519
Imagine, if you will, a hidden war, not fought on battlefields,
2
00:00:16.559 --> 00:00:20.640
but in the unseen digital corridors where the most vital
3
00:00:20.719 --> 00:00:24.839
financial secrets live, the very data that dictates the pulse
4
00:00:24.920 --> 00:00:29.239
of global markets. It's not just protected by these powerful institutions, right,
5
00:00:29.559 --> 00:00:34.439
it's actively sought after by shadowy figures in this high stakes,
6
00:00:35.439 --> 00:00:37.119
almost cinematic digital game.
7
00:00:37.280 --> 00:00:40.119
Yeah, it sounds like a movie plot, but it's frighteningly real.
8
00:00:40.200 --> 00:00:43.240
This isn't Hollywood. It's the chilling reality of a really
9
00:00:43.240 --> 00:00:48.240
sophisticated cyber financial crime that honestly shook the US financial landscape,
10
00:00:48.439 --> 00:00:49.960
shook the foundations of trust.
11
00:00:50.240 --> 00:00:52.520
It really is a profound wake up call reminder that
12
00:00:52.600 --> 00:00:56.240
this battle for economic integrity isn't just in boardrooms or
13
00:00:56.280 --> 00:00:57.039
on trading floors.
14
00:00:57.119 --> 00:00:59.520
No, it's fought deep inside the Internet, where these incredibly
15
00:00:59.560 --> 00:01:02.560
skilled vyebercriminals are just constantly probing, looking for that one
16
00:01:02.600 --> 00:01:03.799
weakness they can exploit.
17
00:01:04.120 --> 00:01:07.640
And today that's exactly what we're diving into, headfirst, into
18
00:01:07.640 --> 00:01:10.280
that unseen battle. We're going to unravel the audacious story
19
00:01:10.319 --> 00:01:15.280
of Artemachenko and Alexandra Aramenko, two Ukrainian nationals accused of
20
00:01:15.400 --> 00:01:20.840
orchestrating this incredibly elaborate global hacking and insider trading conspiracy.
21
00:01:20.920 --> 00:01:23.079
And their target wasn't just you know, a company or
22
00:01:23.120 --> 00:01:26.439
a bank. They went for the absolute heart of America's
23
00:01:26.480 --> 00:01:31.920
financial disclosure system, the US Securities and Exchange Commission, the SEC.
24
00:01:32.200 --> 00:01:34.519
Wow. So our mission for you today is to pull
25
00:01:34.560 --> 00:01:36.200
back the curtain on this alleged scheme.
26
00:01:36.280 --> 00:01:39.439
Yeah, you'll discover the really intricate, almost surgical methods they
27
00:01:39.480 --> 00:01:41.719
reportedly used to breach what should be one of the
28
00:01:41.719 --> 00:01:44.439
most secure financial databases in the world.
29
00:01:44.599 --> 00:01:48.480
And the profits, Yeah, the astonishing profits they allegedly pulled in,
30
00:01:48.519 --> 00:01:50.280
sometimes in just minutes m M.
31
00:01:50.760 --> 00:01:54.480
And then there's the chase, the relentless multi agency pursuit
32
00:01:54.519 --> 00:01:57.319
by US authorities that's now led to this huge one
33
00:01:57.359 --> 00:01:58.959
million dollar bounty.
34
00:01:58.519 --> 00:02:01.159
On their heads. Exactly, this is just a dry rundown
35
00:02:01.200 --> 00:02:03.120
of facts. We want this to feel like a gripping
36
00:02:03.120 --> 00:02:07.719
story deception, credible speed, these invisible battles fought over information.
37
00:02:08.000 --> 00:02:10.800
We'll expose the full alleged scope, break down the precise
38
00:02:10.879 --> 00:02:14.199
legal charges they're facing now, and really explore why this
39
00:02:14.319 --> 00:02:18.520
whole saga is such a critical, maybe even unsettling reminder
40
00:02:18.680 --> 00:02:22.000
of just how fragile the digital foundations of our economy
41
00:02:22.080 --> 00:02:22.800
might actually be.
42
00:02:23.159 --> 00:02:25.479
So let's peel back those layers. Let's get into this
43
00:02:25.560 --> 00:02:30.199
extraordinary tale. Okay. To really grasp the gravity, the sophistication
44
00:02:30.280 --> 00:02:34.280
of this digital heist, we absolutely have to start with
45
00:02:34.319 --> 00:02:35.400
the alleged masterminds.
46
00:02:35.439 --> 00:02:38.240
Right. Every good story needs its central figures.
47
00:02:37.879 --> 00:02:40.319
And in this one, two names really stand out. First up,
48
00:02:40.639 --> 00:02:43.639
we have the person authorities called the architect, the recruiter,
49
00:02:44.360 --> 00:02:46.319
ardem Vyekoslavovich Redschhenko.
50
00:02:46.599 --> 00:02:49.080
Yeah, and what we know about Radschhenko publicly is well,
51
00:02:49.120 --> 00:02:52.439
it's almost as interesting as the allegations themselves. Born June fourth,
52
00:02:52.560 --> 00:02:56.120
nineteen ninety two, Ukrainian national. Okay, the US Secret Service
53
00:02:56.159 --> 00:02:58.840
profile gives physical details five foot eight, one hundred and
54
00:02:58.840 --> 00:03:02.479
thirty five pounds, brown hair, brown eyes. Now these details
55
00:03:02.479 --> 00:03:05.080
they see mundane, right, the standard info, but they're not.
56
00:03:05.120 --> 00:03:08.000
They're part of an official wanted fugitive profile. This isn't
57
00:03:08.000 --> 00:03:12.840
just biography. It's part of an active global manhunt. It
58
00:03:12.879 --> 00:03:15.919
really underscores his current status a man on the run, which.
59
00:03:15.719 --> 00:03:20.840
Makes him fascinating but also you know, dangerous. He's not history,
60
00:03:20.879 --> 00:03:24.479
he's still out there. So if he's the alleged ring leader,
61
00:03:24.520 --> 00:03:27.960
the architect. As you said, what kind of operation did
62
00:03:28.000 --> 00:03:29.599
he build? Was it hierarchical?
63
00:03:30.000 --> 00:03:32.680
Well, the indictment paints him as the central figure, Yeah,
64
00:03:32.759 --> 00:03:36.439
the one who recruited Alexander Vatali Vishieramenko and other hackers
65
00:03:36.439 --> 00:03:40.240
in Ukraine. Okay, And it specifically mentions him managing their
66
00:03:40.280 --> 00:03:41.120
criminal efforts.
67
00:03:41.400 --> 00:03:45.080
Managing criminal efforts? Yeah, what did that actually mean in
68
00:03:45.120 --> 00:03:47.120
a complex cyber conspiracy like this one.
69
00:03:47.159 --> 00:03:49.719
That's a really good question, and the indictment hints at
70
00:03:49.759 --> 00:03:54.120
something quite deliberate, almost like a corporate structure. Oddly enough,
71
00:03:54.280 --> 00:03:57.280
managing criminal efforts here seems to mean way more than
72
00:03:57.360 --> 00:04:01.680
just giving orders. It suggests strategic plan, resource allocation, oversight.
73
00:04:02.199 --> 00:04:05.599
It kind of elevates Radschenko beyond just being a hacker himself.
74
00:04:05.759 --> 00:04:07.680
So he wasn't just directing the technical.
75
00:04:07.319 --> 00:04:10.960
Side allegedly not. He was building and maintaining this whole
76
00:04:11.039 --> 00:04:14.360
illicit enterprise. It wasn't just a smash and grab. It
77
00:04:14.400 --> 00:04:17.839
seems like it was a meticulously planned operation, almost like
78
00:04:17.879 --> 00:04:19.600
a business model for cybercrime.
79
00:04:19.680 --> 00:04:23.120
And the evidence for this planning it's pretty striking, right.
80
00:04:23.160 --> 00:04:28.560
The indictment says Redchenko, the alleged manager, kept detailed personal notes. Yeah,
81
00:04:28.600 --> 00:04:32.319
it's incredible, not just random jottings, but like a strategic
82
00:04:32.439 --> 00:04:36.680
outline of what the SEC does and chillingly how they
83
00:04:36.720 --> 00:04:40.720
could get illicit access to its networks. It shows real calculation.
84
00:04:40.360 --> 00:04:43.000
It really does. These notes give this almost chilling window
85
00:04:43.040 --> 00:04:46.399
into his thinking. He clearly understood his target, the heart
86
00:04:46.439 --> 00:04:49.199
of the US financial system. Listen to this direct quote
87
00:04:49.199 --> 00:04:52.160
from his alleged notes. Okay, SEC is a resource where
88
00:04:52.199 --> 00:04:55.720
all quarterly and annual performance reports of US companies are available.
89
00:04:56.040 --> 00:04:59.040
SEC regulates the stock market. Every company is required to
90
00:04:59.040 --> 00:05:02.160
report to the SEC its financial results. Every company is
91
00:05:02.199 --> 00:05:05.839
required to report important issues such as bankruptcyes or CEO replacements.
92
00:05:06.279 --> 00:05:09.879
There's plenty of additional information available, such as database access information,
93
00:05:10.040 --> 00:05:12.040
initial codes, networks access, etc.
94
00:05:12.439 --> 00:05:17.360
Wow, that's incredibly specific. It's not just knowing how to
95
00:05:17.399 --> 00:05:20.600
break in, but understanding the whole ecosystem, the value of
96
00:05:20.639 --> 00:05:23.199
the information, how to leverage it exactly.
97
00:05:23.240 --> 00:05:27.480
It reveals someone highly intelligent calculating, someone who really got
98
00:05:27.480 --> 00:05:30.279
that information is the currency now and he knew how
99
00:05:30.279 --> 00:05:32.120
to convert it into illicted cash.
100
00:05:32.519 --> 00:05:34.879
It sounds almost academic his approach to crime.
101
00:05:35.000 --> 00:05:39.839
It does a deep understanding of market mechanics, regulatory processes,
102
00:05:40.279 --> 00:05:43.360
not just technical weak spots. He saw the SEC as
103
00:05:43.360 --> 00:05:46.920
the central nervous system for Wall Street, the ultimate gatekeeper.
104
00:05:47.000 --> 00:05:49.759
And the seriousness of that alleged role is clear from
105
00:05:49.759 --> 00:05:53.920
his current status still a wanted fugitive and that reward
106
00:05:54.600 --> 00:05:57.399
a one million dollar reward from the US Department of
107
00:05:57.439 --> 00:06:00.399
State for information leading to his arrest conviction.
108
00:06:00.759 --> 00:06:04.040
And crucially, it's not just for hacking, it's specifically for
109
00:06:04.120 --> 00:06:06.800
participating in transnational organized crime.
110
00:06:06.920 --> 00:06:09.519
Right, that designation really elevates it. It's a matter of
111
00:06:09.639 --> 00:06:11.480
national even international security.
112
00:06:11.600 --> 00:06:15.800
So if Richenko was the strategist, the architect, then Alexander
113
00:06:15.879 --> 00:06:19.759
Vittalievich Ramenko was well undoubtedly the hands on hacking.
114
00:06:19.480 --> 00:06:21.839
Maestro okay the technical expert born July.
115
00:06:21.680 --> 00:06:24.959
Twenty three to nineteen ninety one, also Ukrainian, and he
116
00:06:25.040 --> 00:06:30.800
operated under known aliases in the digital underworld, Zelurimir and Lamares.
117
00:06:31.480 --> 00:06:34.319
And those aliases aren't just random, right, they signify something
118
00:06:34.399 --> 00:06:35.360
in that world. Yeah.
119
00:06:35.639 --> 00:06:38.000
Alis Is like these often come with a reputation. They
120
00:06:38.040 --> 00:06:41.240
suggest a history, a certain notoriety in the dark corners
121
00:06:41.279 --> 00:06:42.600
of the Internet, and.
122
00:06:42.519 --> 00:06:46.160
His reputation, well, it precedes him in a pretty alarming way,
123
00:06:46.319 --> 00:06:50.199
you have to understand this alleged sec hack wasn't his
124
00:06:50.240 --> 00:06:53.240
first major cybercrime, not by a long shot.
125
00:06:53.360 --> 00:06:55.959
No, absolutely not. He was the subject of a separate,
126
00:06:56.079 --> 00:07:00.120
massive federal indictment back in August twenty fifteen. Understanding that
127
00:07:00.199 --> 00:07:03.639
prior case is really fundamental to grasping his expertise and
128
00:07:03.720 --> 00:07:05.639
his frankly frightening track record.
129
00:07:05.680 --> 00:07:08.279
Okay, tell us about that. The newswire hacking scheme.
130
00:07:08.160 --> 00:07:11.160
That's the one. It reveals the sustained campaign of well
131
00:07:11.199 --> 00:07:14.399
digital terror, starting way back in February twenty ten, lasting
132
00:07:14.399 --> 00:07:17.240
over five years until twenty fifteen. Earmenker and his co
133
00:07:17.240 --> 00:07:21.879
conspirators allegedly systematically hacked into the networks of major newswire organizations,
134
00:07:21.920 --> 00:07:26.720
which ones market Wired, pr Newswire, and Business Wire. Their
135
00:07:26.759 --> 00:07:32.199
goal was chillingly simple but incredibly effective steel confidential press
136
00:07:32.240 --> 00:07:36.519
releases stuff with material non public information before it hit
137
00:07:36.560 --> 00:07:37.439
the public domain.
138
00:07:37.839 --> 00:07:41.399
So like getting earnings reports, acquisition news, clinical trial results
139
00:07:42.079 --> 00:07:44.000
before anyone else knew exactly.
140
00:07:44.079 --> 00:07:46.600
Imagine having that kind of advanced knowledge.
141
00:07:46.199 --> 00:07:48.839
A scale of that previous operation. Yeah, it was huge,
142
00:07:48.879 --> 00:07:49.839
wasn't it staggering?
143
00:07:50.120 --> 00:07:52.920
The indictment mentions more than one hundred and fifty thousand
144
00:07:53.040 --> 00:07:54.560
stolen releases.
145
00:07:54.160 --> 00:07:55.319
One hundred and fifty thousand.
146
00:07:55.399 --> 00:07:58.600
Yeah, this wasn't small time. It was industrial scale information
147
00:07:58.759 --> 00:08:03.360
theft and the profit over thirty million dollars in illicit
148
00:08:03.439 --> 00:08:04.600
trading gains.
149
00:08:04.319 --> 00:08:08.120
Thirty million dollars, yeah, just from trading on stolen news releases.
150
00:08:08.319 --> 00:08:11.360
Right, it shows an incredible ability to monetize stolen data.
151
00:08:11.720 --> 00:08:14.399
The charges from that prior scheme paint a really vivid
152
00:08:14.439 --> 00:08:20.199
picture wire fraud, securities, fraud, conspiracies for both money laundering, conspiracy,
153
00:08:20.240 --> 00:08:23.839
computer fraud, computer fraud conspiracy, aggravated identity.
154
00:08:23.480 --> 00:08:24.720
Thought, that's a serious list.
155
00:08:25.000 --> 00:08:28.759
It's a testament to a highly skilled, dangerous cyber criminal
156
00:08:29.079 --> 00:08:34.039
who had already mastered exploiting confidential information for huge financial gain.
157
00:08:34.480 --> 00:08:35.840
He had the technical chops.
158
00:08:36.000 --> 00:08:39.720
So this is the guy this season, hacker, proven multimillion
159
00:08:39.799 --> 00:08:45.159
dollar digital thief who was then allegedly recruited by Ardim
160
00:08:45.360 --> 00:08:49.480
Vyatchislaviovich read Chenko for the sec job exactly.
161
00:08:49.480 --> 00:08:51.840
That tells you the kind of team they were allegedly building.
162
00:08:52.159 --> 00:08:56.879
Strategic genius plus top tier technical execution, a formidable duo.
163
00:08:57.080 --> 00:09:00.720
And like Brichenko Heremenko is also still a one fugitive
164
00:09:01.240 --> 00:09:03.639
that joint one million dollar reward applies tim too.
165
00:09:04.159 --> 00:09:07.480
The hunt for both is very much active, spanning continents. Okay,
166
00:09:07.480 --> 00:09:09.879
so we've met the alleged players. Now let's shift focus
167
00:09:09.919 --> 00:09:13.039
to the target itself, the vault of American financial secrets.
168
00:09:13.039 --> 00:09:13.879
They allegedly went.
169
00:09:13.840 --> 00:09:18.240
After the US Securities in Exchange Commission. The SEC the
170
00:09:18.279 --> 00:09:19.960
guardian of the markets pretty much.
171
00:09:20.000 --> 00:09:23.960
Its core mission is vital maintaining fair, orderly and efficient markets.
172
00:09:24.000 --> 00:09:27.159
They're the referees, essentially making sure everyone plays by the rules,
173
00:09:27.159 --> 00:09:29.799
that investors get accurate, timely information.
174
00:09:29.480 --> 00:09:32.279
Protecting the average show from getting fleeced, right.
175
00:09:32.320 --> 00:09:35.480
And that critical role makes it almost obvious why the
176
00:09:35.559 --> 00:09:38.879
SEC became such a high value target for hackers.
177
00:09:38.519 --> 00:09:40.559
Like these, Because it's a central vault exactly.
178
00:09:40.639 --> 00:09:45.639
It's the repository for highly confidential business information from pretty
179
00:09:45.679 --> 00:09:49.159
much every publicly traded company in the US. Think about it.
180
00:09:49.480 --> 00:09:55.039
Earnings reports, acquisitions, major financial filings. It all has to
181
00:09:55.080 --> 00:09:56.480
go through the SEC first.
182
00:09:56.600 --> 00:10:02.279
And this information, especially earnings reports, CEO changes, bankruptcies, it
183
00:10:02.320 --> 00:10:04.240
moves markets right when it becomes public.
184
00:10:04.320 --> 00:10:07.480
Absolutely, it can and often does affect the stock price.
185
00:10:07.720 --> 00:10:10.480
So the hacker's goal was to exploit that tiny but
186
00:10:10.559 --> 00:10:14.240
incredibly valuable window. The gap between the SEC getting the
187
00:10:14.320 --> 00:10:15.559
data and the public.
188
00:10:15.279 --> 00:10:19.080
Getting it an informational gold mine, huge potential profits in minutes.
189
00:10:19.279 --> 00:10:22.440
To handle this constant flood of data, the SEC uses
190
00:10:22.440 --> 00:10:27.320
its electronic filing system ADGRR Electronic Data Gathering, Analysis and
191
00:10:27.360 --> 00:10:28.240
Retrieval System.
192
00:10:28.360 --> 00:10:31.240
That's the digital gateway where companies submit everything ten tas,
193
00:10:31.279 --> 00:10:32.200
ten qs, eight ks.
194
00:10:32.320 --> 00:10:35.759
That's it. It's the lifeblood of transparency in US markets.
195
00:10:36.240 --> 00:10:39.440
But here's the critical vulnerability, the sort of ironic twists
196
00:10:39.440 --> 00:10:42.720
they allegedly found and exploited edgy or allowed companies to
197
00:10:42.759 --> 00:10:47.120
submit test filings hours, maybe even days before the official
198
00:10:47.159 --> 00:10:48.200
public release.
199
00:10:48.080 --> 00:10:50.480
Test filings just to check formatting and stuff.
200
00:10:50.600 --> 00:10:54.639
Yeah, that was the idea. But crucially, these test filings
201
00:10:54.639 --> 00:10:58.559
often contained information that was the same or substantially similar
202
00:10:58.600 --> 00:11:01.240
to the material information was eventually released.
203
00:11:00.960 --> 00:11:03.879
To the public whoe. So they were basically pre release
204
00:11:04.000 --> 00:11:06.519
copies of sensitive market moving info.
205
00:11:06.759 --> 00:11:12.120
In effect, yes, material non public information, a genuine treasure
206
00:11:12.200 --> 00:11:16.440
trove for insider trading. Imagine getting a tech giant's earnings
207
00:11:16.559 --> 00:11:20.639
or pharma trial result or a merger announcement before anyone
208
00:11:20.679 --> 00:11:21.759
else legally could.
209
00:11:22.039 --> 00:11:24.759
That's an unbelievable advantage. It turned a convenience feature into
210
00:11:24.799 --> 00:11:25.919
a massive security hole.
211
00:11:26.039 --> 00:11:29.639
Precisely, and just for the legal side the jurisdiction, those
212
00:11:29.759 --> 00:11:33.840
EDDYGR servers holding this data were physically located in New Jersey.
213
00:11:33.600 --> 00:11:36.200
Okay, establishing the US connection for prosecution.
214
00:11:36.600 --> 00:11:40.000
Right and beyond the technical breach, this whole scheme was
215
00:11:40.000 --> 00:11:43.159
a direct attack on a core principle SEC regulation fair
216
00:11:43.159 --> 00:11:45.759
disclosure or reg FD, which.
217
00:11:45.600 --> 00:11:48.759
Says companies can't selectively leak important info early.
218
00:11:49.120 --> 00:11:53.399
Exactly, it prohibits giving material non public info to say,
219
00:11:53.919 --> 00:11:56.879
analysts or big shareholders before the general public gets it.
220
00:11:57.240 --> 00:11:59.960
What the hackers allegedly did was a calculated way around
221
00:12:00.159 --> 00:12:04.639
that rule, giving themselves and their recruited traders this massive, unfair,
222
00:12:04.799 --> 00:12:05.799
illegal edge.
223
00:12:05.879 --> 00:12:09.240
It's basically digital cheating on a huge scale, undermining the
224
00:12:09.279 --> 00:12:11.559
whole system's trust. All right, So we've got the players
225
00:12:11.679 --> 00:12:16.240
the target, Now the breach itself. How did Radchenko and
226
00:12:16.320 --> 00:12:20.799
ironmenco allegedly get inside this supposedly secure digital fortress.
227
00:12:20.879 --> 00:12:23.720
Well, the endictment lays out of timeline. It allegedly started
228
00:12:23.720 --> 00:12:27.399
around February twenty sixteen and went on until about March
229
00:12:27.519 --> 00:12:30.159
twenty seventeen, So it sustained year long.
230
00:12:30.000 --> 00:12:32.279
Campaign, not just a quick smashing grap No.
231
00:12:32.240 --> 00:12:36.080
Definitely not. They allegedly gain unauthorized access through a series
232
00:12:36.120 --> 00:12:40.399
of sophisticated and relentless cyber attacks. That phrasing suggests a constant,
233
00:12:40.440 --> 00:12:43.519
adaptive effort using multiple techniques, a digital siege.
234
00:12:43.559 --> 00:12:46.039
Really, and their toolkit was pretty advanced, wasn't it. What
235
00:12:46.080 --> 00:12:47.000
techniques did they use?
236
00:12:47.240 --> 00:12:50.600
Well? One mentioned is directory to versal attacks. Think of
237
00:12:50.639 --> 00:12:54.679
it like finding a hidden back corridor and a secure
238
00:12:54.720 --> 00:12:58.159
building that lets you bypass security and get into restricted areas.
239
00:12:58.240 --> 00:13:01.120
So exploding a web server vulnerable to get places they.
240
00:13:01.000 --> 00:13:05.559
Shouldn't exactly, It needs a precise technical understanding of how
241
00:13:05.639 --> 00:13:08.360
servers are set up and where weaknesses might lie.
242
00:13:08.720 --> 00:13:11.679
And then there were phishing attacks too, mm hmm. More
243
00:13:11.679 --> 00:13:13.399
common but still effective.
244
00:13:13.279 --> 00:13:16.519
Very effective, especially how they allegedly did it. These weren't
245
00:13:16.559 --> 00:13:21.039
just generic spam emails. They were carefully crafted malicious email
246
00:13:21.120 --> 00:13:24.480
sent directly to SEC employees, made to look like they
247
00:13:24.519 --> 00:13:26.039
came from other SEC employees.
248
00:13:26.120 --> 00:13:27.440
Oh, so they look legitimate.
249
00:13:27.799 --> 00:13:32.320
Tricky, very The goal was twofold steal credentials like usernames
250
00:13:32.320 --> 00:13:34.759
and passwords, the keys to the kingdom, and also install
251
00:13:34.879 --> 00:13:39.600
malware onto SEC computers, turn the SEC's own infrastructure against itself, and.
252
00:13:39.559 --> 00:13:42.720
Did that work? Did they manage to infect SEC computers?
253
00:13:42.840 --> 00:13:46.200
Allegedly Yes, The indictment says they successfully infected a number
254
00:13:46.200 --> 00:13:50.000
of SEC computers with malware. Once those machines were compromised,
255
00:13:50.000 --> 00:13:51.600
they became like inside.
256
00:13:51.159 --> 00:13:53.799
Agents trojan horses exactly.
257
00:13:53.679 --> 00:13:56.799
Letting the hackers probe the network from within, map it out,
258
00:13:57.039 --> 00:14:00.879
find critical systems, and ultimately steal info to get deeper access,
259
00:14:00.960 --> 00:14:05.960
especially to those test filings. Insidious internal spying, and.
260
00:14:05.919 --> 00:14:07.759
All the while they were trying to cover their tracks.
261
00:14:07.759 --> 00:14:12.279
Oh. Absolutely, they allegedly took steps to conceal and misrepresent
262
00:14:12.320 --> 00:14:17.200
their identities, standard practice for sophisticated cyber criminals, using things
263
00:14:17.240 --> 00:14:21.320
like VPNs anonymizers, routing traffic through hacked servers all over
264
00:14:21.360 --> 00:14:24.720
the world, making the chase much harder for investigators.
265
00:14:24.799 --> 00:14:27.639
Now here's where Iromenco's pass comes back into play, right,
266
00:14:27.960 --> 00:14:31.559
linking his old methods to this news scheme precisely.
267
00:14:31.639 --> 00:14:34.600
This is a crucial forensic link. The indictment says the
268
00:14:34.600 --> 00:14:38.200
conspirators allegedly employed some of the same methods that Iromenco
269
00:14:38.279 --> 00:14:40.399
had used in the newswire hacking scheme.
270
00:14:40.360 --> 00:14:44.480
So not just a similar crime, but using his signature techniques.
271
00:14:44.120 --> 00:14:47.559
In many ways, yes, like leaving identifiable clues. For instance,
272
00:14:47.639 --> 00:14:51.080
one clear digital fingerprint was the alleged use of an
273
00:14:51.159 --> 00:14:54.360
IP address in Romania that Iromenco controlled.
274
00:14:54.000 --> 00:14:55.960
An IP address he'd used before.
275
00:14:55.879 --> 00:15:00.080
Yes, one previously associated with the server Iromenco used in
276
00:15:00.120 --> 00:15:03.919
the Newswire hacking scheme. That's not just coincidence. It suggests
277
00:15:04.000 --> 00:15:07.840
continuity using the same tools and infrastructure. It's like finding
278
00:15:07.919 --> 00:15:10.399
the same rare tool at two different crime.
279
00:15:10.159 --> 00:15:13.799
Scenes, forensically linking him any other digital signatures.
280
00:15:14.200 --> 00:15:17.279
There was also the alleged use of an uncommon user
281
00:15:17.320 --> 00:15:20.879
agent string. Your browser sends the string to websites to
282
00:15:20.960 --> 00:15:24.679
identify itself. Most are standard, but using an uncommon one
283
00:15:24.720 --> 00:15:28.039
and the same uncommon one across different hacking campaigns. That's
284
00:15:28.039 --> 00:15:31.759
like leaving a very specific, unusual footprint. Another forensic link
285
00:15:31.799 --> 00:15:35.320
pointing to Iramenco's known digital habits from the earlier scheme,
286
00:15:35.799 --> 00:15:36.960
a unique calling card.
287
00:15:37.159 --> 00:15:40.120
Wow. And then there was this Lithuanian server that sounds.
288
00:15:39.879 --> 00:15:44.039
Important, hugely important. This server was allegedly their central hub,
289
00:15:44.200 --> 00:15:48.320
their digital data pipeline. Red Chenko, Aromenco and others allegedly
290
00:15:48.399 --> 00:15:53.200
purchased the Lithuanian server using a Bitcoin address controlled by Radchenko.
291
00:15:52.919 --> 00:15:55.840
Using bitcoin for anonymity.
292
00:15:55.480 --> 00:16:01.080
Partly Yeah, Bitcoin offers pseudoanonymity and makes cross order payments easier,
293
00:16:01.399 --> 00:16:03.759
which is common in these kinds of operations to obscure
294
00:16:03.799 --> 00:16:06.720
financial trails. But the key here is that the bitcoin
295
00:16:06.759 --> 00:16:10.639
address was allegedly controlled by red Chenko. That provides a
296
00:16:10.639 --> 00:16:13.879
direct financial link back to the supposed mastermind and.
297
00:16:13.879 --> 00:16:17.559
This Lithuanian server. This was where the stolen data ended up.
298
00:16:17.799 --> 00:16:22.840
That was the alleged destination. Between May and October twenty sixteen,
299
00:16:23.399 --> 00:16:27.200
thousands of those confidential test filings full of material non
300
00:16:27.200 --> 00:16:31.240
public information were exfiltrated, stolen, and moved out from the
301
00:16:31.320 --> 00:16:35.399
SEC's network to this Lithuanian server under the conspirator's control.
302
00:16:35.519 --> 00:16:37.679
Thousands. So it wasn't a trickle. It was a flood
303
00:16:37.720 --> 00:16:38.519
of stolen.
304
00:16:38.159 --> 00:16:41.559
Secrets Torrent, underscoring the sheer volume and systematic nature of
305
00:16:41.600 --> 00:16:45.279
the alleged operation. So the breach happened, the fortress was infiltrated.
306
00:16:45.320 --> 00:16:48.559
Now the focus shifts the heist and the harvest. How
307
00:16:48.559 --> 00:16:50.720
did they actually make money from these stolen secrets?
308
00:16:50.759 --> 00:16:53.559
We know they stole thousands of these confidential test filings,
309
00:16:53.840 --> 00:16:56.320
a treasure chest to market intelligence.
310
00:16:55.960 --> 00:16:59.759
And the alleged profit mechanism was twofold, showing a real
311
00:17:00.039 --> 00:17:04.640
understanding of the markets. First, they were apparently selling access
312
00:17:04.680 --> 00:17:07.400
to the non public information contained in these yet to
313
00:17:07.400 --> 00:17:09.440
be disclosed reports.
314
00:17:08.839 --> 00:17:11.640
Like selling subscriptions to an illegal insider newsfeed.
315
00:17:11.960 --> 00:17:16.000
Kind of yeah, guaranteeing advance knowledge no one else had. Second,
316
00:17:16.079 --> 00:17:18.960
and maybe even bolder, was trading in the securities of
317
00:17:18.960 --> 00:17:21.839
the companies before the investing public learned the same information.
318
00:17:22.119 --> 00:17:25.720
Classic insider trading, but turbocharged with direct access to the
319
00:17:25.759 --> 00:17:27.000
source data exactly.
320
00:17:27.519 --> 00:17:30.920
And Redchenko, the alleged architect, wasn't just directing the hacking,
321
00:17:31.000 --> 00:17:34.240
He was allegedly hands on and monetizing it too. The
322
00:17:34.279 --> 00:17:37.839
indictment says he actively recruited traders to join the conspiracy,
323
00:17:38.279 --> 00:17:41.000
visiting them the stolen filings, So it wasn't just.
324
00:17:40.960 --> 00:17:45.160
The two of them. It was a network hackers, maybe analysts, traders.
325
00:17:45.359 --> 00:17:48.519
It looks that way, a well oiled machine with different roles.
326
00:17:48.559 --> 00:17:51.559
Hackers get the data, maybe someone sifts through it, Traders
327
00:17:51.599 --> 00:17:56.559
execute the transactions. It suggests a sophisticated criminal enterprise built
328
00:17:56.599 --> 00:17:58.440
to scale up the profits.
329
00:17:58.000 --> 00:18:01.599
And the impact, according to authorities, was pretty severe. Beyond
330
00:18:01.680 --> 00:18:02.519
just the money they made.
331
00:18:02.720 --> 00:18:05.240
Oh yeah, it compromised the integrity of the market and
332
00:18:05.279 --> 00:18:08.640
deprived honest investors of a level playing field. It's about
333
00:18:08.720 --> 00:18:12.799
undermining trust eroding confidence that the market is fair.
334
00:18:12.920 --> 00:18:15.200
Okay, let's make this real. You mentioned as specific case
335
00:18:15.200 --> 00:18:17.279
studying the indictment Public Company one.
336
00:18:17.440 --> 00:18:21.359
Yes, this one instance from May nineteen, twenty sixteen, really
337
00:18:21.359 --> 00:18:25.200
illustrates the incredible speed and precision. It's a snapshot of
338
00:18:25.200 --> 00:18:27.720
the alleged crime unfolding minute by minute.
339
00:18:27.799 --> 00:18:30.359
All right, let's walk through it. Paint the picture. May
340
00:18:30.440 --> 00:18:31.559
nineteen twenty sixteen.
341
00:18:31.640 --> 00:18:34.359
Okay, picture this. It's three point three to two pm
342
00:18:34.480 --> 00:18:37.640
Eastern daylight time. A test filing for Public Company one
343
00:18:37.799 --> 00:18:41.640
goes onto the SEC's a DJR servers contains sensitive non
344
00:18:41.680 --> 00:18:43.720
public info about its second quarter results.
345
00:18:43.799 --> 00:18:47.480
Okay, the starting gun. The info is in the vault briefly, briefly,
346
00:18:47.519 --> 00:18:47.960
as a word.
347
00:18:48.000 --> 00:18:51.039
Just six minutes later, at three three eight pm, Retchenko,
348
00:18:51.319 --> 00:18:55.200
Aromenko and others allegedly use that Lithuanian server to access
349
00:18:55.279 --> 00:18:58.519
EDDDR without authorization. They steal the test filing.
350
00:18:58.720 --> 00:19:02.519
Six minutes that's credibly fast. The data is compromised and the.
351
00:19:02.480 --> 00:19:05.720
Clock is ticking for them to profit. Between three point
352
00:19:05.720 --> 00:19:08.079
four two pm and three point five nine pm, just
353
00:19:08.200 --> 00:19:11.279
seventeen minutes after they allegedly stole the data, a trading
354
00:19:11.279 --> 00:19:15.039
account linked to CC one, a co conspirator, goes into overdrive.
355
00:19:15.119 --> 00:19:15.640
What do they do?
356
00:19:15.839 --> 00:19:19.160
This account purchase approximately one hundred and twenty one thousand
357
00:19:19.240 --> 00:19:21.880
shares of the stock of Public Company one for more
358
00:19:21.920 --> 00:19:24.359
than approximately two point four million dollars.
359
00:19:24.680 --> 00:19:27.920
Whoa big trades based on info nobody else.
360
00:19:27.720 --> 00:19:32.279
Has exactly covered high volume trading. Then, at four oh
361
00:19:32.440 --> 00:19:35.359
two pm, just three minutes after those illicit buys stopped,
362
00:19:35.640 --> 00:19:39.960
Public Company one officially releases its earnings report, announcing record
363
00:19:40.000 --> 00:19:41.279
earnings expected.
364
00:19:40.839 --> 00:19:43.119
For the year. So the public finally gets the news
365
00:19:43.119 --> 00:19:45.440
the conspirators have allegedly been trading on for almost half
366
00:19:45.480 --> 00:19:46.000
an hour.
367
00:19:46.960 --> 00:19:49.400
And the payoff. By the end of the next trading
368
00:19:49.480 --> 00:19:51.720
day that CC one account had sold the shares bought
369
00:19:51.759 --> 00:19:54.400
the day before, The profit more than two hundred and
370
00:19:54.440 --> 00:19:55.519
seventy thousand dollars a.
371
00:19:55.559 --> 00:19:58.839
Quarter of a million dollars in roughly twenty four hours
372
00:19:58.920 --> 00:20:00.160
just from that one stole the.
373
00:20:00.160 --> 00:20:03.720
Filing allegedly Yes, it's a chillingly effective example speed precision
374
00:20:03.799 --> 00:20:05.240
exploitation of stolen data.
375
00:20:05.319 --> 00:20:07.160
And this wasn't just a one off, right, They kept
376
00:20:07.160 --> 00:20:08.519
doing this, Far from it.
377
00:20:08.759 --> 00:20:12.319
The indictment list several other documented thefts, showing it was systematic.
378
00:20:12.920 --> 00:20:16.559
They allegedly used the Lithuanian server again and again to
379
00:20:16.720 --> 00:20:19.799
steal filings for Public Company two on July twenty second,
380
00:20:20.079 --> 00:20:23.440
Public Company three on July twenty ninth, Public Company four
381
00:20:23.640 --> 00:20:26.240
on August fourth, Public Company five.
382
00:20:26.119 --> 00:20:29.079
On August eighth, All in twenty sixteen, and didn't they
383
00:20:29.119 --> 00:20:30.319
hit Public Company one again?
384
00:20:30.440 --> 00:20:34.240
They did brazenly. They allegedly targeted Public Company one again
385
00:20:34.359 --> 00:20:35.640
on August seventeenth.
386
00:20:35.680 --> 00:20:39.880
Wow, that persistence really suggests a professional operation, not just
387
00:20:40.000 --> 00:20:42.359
random hacks. They knew they had a working method and
388
00:20:42.440 --> 00:20:43.400
just kept exploiting it.
389
00:20:43.480 --> 00:20:46.119
Okay, so we've seen the alleged scheme, the scale of it. Now,
390
00:20:46.160 --> 00:20:48.240
how did the law finally start catching up?
391
00:20:48.559 --> 00:20:52.160
Well? On January fifteen, twenty nineteen, a federal grand jury
392
00:20:52.160 --> 00:20:54.920
in New Jersey formally indicted Rodchenko and Iramenko.
393
00:20:55.200 --> 00:20:57.640
Right, but that indictment stayed under seal for a while.
394
00:20:57.400 --> 00:21:00.680
Didn't it. It did until October twenty nine, twenty. That's
395
00:21:00.680 --> 00:21:03.480
pretty common, right to allow more investigation or prevent fugitives
396
00:21:03.480 --> 00:21:04.200
getting tipped off.
397
00:21:04.279 --> 00:21:06.799
Exactly a strategic move. And this wasn't a minor indictment.
398
00:21:06.799 --> 00:21:08.599
It was a sixteen count indictment.
399
00:21:09.119 --> 00:21:12.599
Sixteen counts. That really shows the breadth and severity of
400
00:21:12.640 --> 00:21:16.640
the alleged crimes. Prosecutors broke down every alleged legal act.
401
00:21:17.039 --> 00:21:20.599
And it wasn't just criminal charges. The SEC filed its
402
00:21:20.640 --> 00:21:24.880
own separate civil complaint against Aramenco and others too, So a.
403
00:21:24.799 --> 00:21:28.839
Two prompt legal attack, criminal and civil. That shows how
404
00:21:28.880 --> 00:21:31.000
seriously authorities take this kind of thing.
405
00:21:31.200 --> 00:21:34.920
Absolutely, when market integrity and cybersecurity are hit, they throw
406
00:21:34.960 --> 00:21:35.519
the book at it.
407
00:21:35.640 --> 00:21:38.200
Let's unpack those charges. What exactly are they accused of?
408
00:21:38.359 --> 00:21:42.680
Okay, First up is securities fraud conspiracy count one. That's
409
00:21:42.720 --> 00:21:46.640
basically an agreement to manipulate the stock market using deceptive methods,
410
00:21:47.039 --> 00:21:52.079
specifically using that stolen material non public information to trade.
411
00:21:51.960 --> 00:21:55.039
So conspiring to cheat investors essentially.
412
00:21:54.759 --> 00:21:57.359
Yes, proving intent to defraud is key there. Then there's
413
00:21:57.400 --> 00:21:59.000
wire fraud conspiracy count three.
414
00:21:59.119 --> 00:21:59.799
How's it different?
415
00:22:00.039 --> 00:22:03.400
It's broader, alleging a scheme to defraud the SEC itself
416
00:22:03.440 --> 00:22:06.160
and the companies of their right to control their confidential
417
00:22:06.160 --> 00:22:11.519
information and crucially using wire communications the Internet basically across
418
00:22:11.599 --> 00:22:14.079
state and international lines to do it, so.
419
00:22:14.000 --> 00:22:15.920
That covers the whole digital infrastructure they used.
420
00:22:16.039 --> 00:22:18.759
Right then you have the substance of wire fraud Counts
421
00:22:18.759 --> 00:22:22.039
four through nine. These aren't about the agreement. They're about
422
00:22:22.160 --> 00:22:25.759
the specific acts of transmitting fraudulent stuff via wire.
423
00:22:25.640 --> 00:22:29.160
Like using the Lithuanian server to access ADJR on those
424
00:22:29.160 --> 00:22:32.200
specific dates for companies one, two, three, four.
425
00:22:32.119 --> 00:22:36.400
Five Exactly, each one of those alleged digital actions is
426
00:22:36.440 --> 00:22:40.279
a separate wire fraud charge, building the case piece by piece.
427
00:22:40.400 --> 00:22:41.200
Okay, what else?
428
00:22:41.440 --> 00:22:45.400
Computer fraud conspiracy count two This is about the agreement
429
00:22:45.440 --> 00:22:51.000
to intentionally access computers without authorization, specifically breaking into a
430
00:22:51.079 --> 00:22:55.000
US government agency system the SEC and a protected computer
431
00:22:55.319 --> 00:22:59.039
to get information for commercial advantage and private financial gain.
432
00:22:59.359 --> 00:23:01.880
And the info had to be worth more than five thousand.
433
00:23:01.519 --> 00:23:04.319
Dollars, so just breaking in was illegal even before the
434
00:23:04.359 --> 00:23:05.400
trading correct.
435
00:23:05.480 --> 00:23:08.720
The unauthorized access itself is a federal crime. And finally,
436
00:23:08.799 --> 00:23:12.119
the substance of computer fraud Counts ten through sixteen.
437
00:23:11.799 --> 00:23:13.880
These are the specific hacks, yes.
438
00:23:14.359 --> 00:23:18.599
Mirroring those overt acts We discussed accessing at GR from
439
00:23:18.599 --> 00:23:22.480
that Romanian IP address back in May twenty sixteen, repeatedly
440
00:23:22.519 --> 00:23:25.599
accessing it from the Lithuanian server to steal those specific
441
00:23:25.640 --> 00:23:29.079
test filings on those dates in May, July August twenty sixteen.
442
00:23:29.559 --> 00:23:32.599
Each unauthorized access is another charge.
443
00:23:32.440 --> 00:23:34.839
Okay, a mountain of charges. What kind of penalties are
444
00:23:34.839 --> 00:23:36.920
we talking? If they're caught and convicted.
445
00:23:36.680 --> 00:23:40.079
They're severe For wire fraud and wire fraud conspiracy, the
446
00:23:40.079 --> 00:23:43.400
maximum is twenty years in prison per count plus finds
447
00:23:43.519 --> 00:23:46.480
up to two hundred and fifty thousand dollars or potentially
448
00:23:46.519 --> 00:23:48.599
twice the amount game or loss from the crime.
449
00:23:48.720 --> 00:23:50.880
Twenty years per count. Wow. And the other.
450
00:23:50.799 --> 00:23:55.039
Charges securities fraud conspiracy, computer fraud conspiracy, and the computer
451
00:23:55.119 --> 00:23:58.119
fraud counts, those carry a maximum of five years in
452
00:23:58.160 --> 00:24:01.720
prison per count plus similar fines, so significant time potentially,
453
00:24:01.960 --> 00:24:02.319
it's not.
454
00:24:02.319 --> 00:24:05.119
Just prison time, right. There's forfeiture, yeah, taking the money
455
00:24:05.119 --> 00:24:05.920
back exactly.
456
00:24:06.279 --> 00:24:09.960
The indictment includes forfeiture allegations. If convicted, they'd have to
457
00:24:10.000 --> 00:24:13.000
forfeit any property derived from the crime proceeds or used
458
00:24:13.000 --> 00:24:13.759
to commit the crime.
459
00:24:13.920 --> 00:24:14.960
Hitting them in the wallet.
460
00:24:15.240 --> 00:24:18.039
Right, And there's a substitute assets provision.
461
00:24:18.359 --> 00:24:19.319
This is important.
462
00:24:19.960 --> 00:24:22.920
If the original illicit profits the trading gains can't be found,
463
00:24:23.039 --> 00:24:25.640
maybe they've been laundered or moved offshore. Then what then
464
00:24:25.640 --> 00:24:28.680
The government can seize other property belonging to them up
465
00:24:28.680 --> 00:24:31.079
to the value of the illicit gains. Makes it much
466
00:24:31.119 --> 00:24:33.200
harder to just hide the money and enjoy it later.
467
00:24:33.480 --> 00:24:36.279
Bringing a case like this together, yeah, it must take
468
00:24:36.319 --> 00:24:38.400
a huge team effort, oh massive.
469
00:24:38.680 --> 00:24:42.680
The indictment credits a whole coalition US Secret Service FBI,
470
00:24:43.160 --> 00:24:47.519
the DOJ's Computer Crime and Intellectual Property Section CCIPS, the
471
00:24:47.640 --> 00:24:50.720
US Attorney's Office in New Jersey, and the SEC's own
472
00:24:50.799 --> 00:24:52.400
Market Abuse and cyber.
473
00:24:52.119 --> 00:24:54.039
Units, each bringing different expertise.
474
00:24:54.240 --> 00:24:58.720
Absolutely Secret Service on financial infrastructure and tracing money, FBI
475
00:24:58.799 --> 00:25:03.640
on cybercrime networks, CCIPS providing the legal expertise on cyber law,
476
00:25:03.920 --> 00:25:07.680
the US Attorney prosecuting, and the SEC providing insight from
477
00:25:07.680 --> 00:25:11.240
the target itself. It's a complex dance of information sharing
478
00:25:11.279 --> 00:25:13.759
and coordination, especially across borders, and we always have to
479
00:25:13.759 --> 00:25:18.400
add the legal caveat crucially important. The charges and allegations
480
00:25:18.799 --> 00:25:22.920
are merely accusations, and the defendant is presumed innocent unless
481
00:25:22.920 --> 00:25:26.720
and until proving VOLTI. That's fundamental, no matter how strong
482
00:25:26.720 --> 00:25:30.319
the case looks. So we've gone through the scheme, the players,
483
00:25:30.440 --> 00:25:34.319
the methods, the charges. But the story isn't over, no.
484
00:25:34.400 --> 00:25:37.920
Because as we speak, Artem Rechenko and Alexander Iromenko are
485
00:25:37.960 --> 00:25:41.160
still out there, fugitives on the global stage. They are
486
00:25:41.200 --> 00:25:43.359
whereabouts unknown to US authorities.
487
00:25:43.400 --> 00:25:47.000
They're actively wanted, prominently listed on the Secret Service's Most
488
00:25:47.039 --> 00:25:50.640
Wanted Fugitives list. This isn't a cold case. It's an ongoing,
489
00:25:50.720 --> 00:25:51.559
active pursuit.
490
00:25:51.680 --> 00:25:55.599
And the fact that they're Ukrainian citizens that complicates things,
491
00:25:55.640 --> 00:25:58.160
doesn't it. Extradition isn't simple, not at all.
492
00:25:58.240 --> 00:26:03.319
That transnational element is a huge challenge. It involves international law, diplomacy, politics,
493
00:26:03.359 --> 00:26:05.839
things that can really slow down or even stop extradition.
494
00:26:06.359 --> 00:26:08.599
It shows how hard it is to catch cyber criminals
495
00:26:08.640 --> 00:26:11.359
who operate across borders using the Internet to just.
496
00:26:11.720 --> 00:26:15.200
Vanish vanish into the digital ether. But the US government
497
00:26:15.279 --> 00:26:17.240
is putting serious money behind finding them.
498
00:26:17.440 --> 00:26:19.880
They are. The State Department has offered a reward of
499
00:26:20.000 --> 00:26:22.839
up to one million dollars for information leading to the
500
00:26:22.960 --> 00:26:26.880
arrest and or conviction of Radchenko and Ironmenco.
501
00:26:26.880 --> 00:26:31.000
And that reward specifies transnational organized crime, right, not just hacking.
502
00:26:31.319 --> 00:26:35.559
Correct. That designation highlights the global threat they're seen to represent.
503
00:26:35.640 --> 00:26:36.839
It's a serious label.
504
00:26:37.160 --> 00:26:40.640
That million dollars is a big incentive, a beacon for justice,
505
00:26:40.759 --> 00:26:43.119
hoping someone somewhere knows something it really is.
506
00:26:43.200 --> 00:26:45.799
It shows how determined the US is to hold them accountable,
507
00:26:45.880 --> 00:26:47.000
even across borders.
508
00:26:47.079 --> 00:26:50.559
And if anyone listening does have information, the official contact
509
00:26:50.640 --> 00:26:53.400
is the US Secret Service at most wanted at first,
510
00:26:53.400 --> 00:26:54.880
dot DHS, dot CoV.
511
00:26:55.880 --> 00:26:58.880
In cases like these, sometimes the smallest detail can break
512
00:26:58.920 --> 00:26:59.720
it wide open.
513
00:27:00.000 --> 00:27:03.400
We've really navigated this intricate web of digital deceit today,
514
00:27:03.720 --> 00:27:07.680
from sophisticated hacks like directory traversal and targeted fishing.
515
00:27:07.440 --> 00:27:12.039
Right the techniques used to allegedly breach the SEC zone systems.
516
00:27:11.880 --> 00:27:15.559
To that high speed insider trading allegedly netting huge sums
517
00:27:15.559 --> 00:27:18.799
in minutes. This deep dive has tried to lay bare
518
00:27:19.000 --> 00:27:23.680
the meticulous planning, the brazen execution, and the frankly profound
519
00:27:23.720 --> 00:27:29.200
impact of this alleged SEC hacking scheme by Richenko and Hiromenco.
520
00:27:29.720 --> 00:27:32.480
It's such a vivid picture of true crime and our
521
00:27:32.519 --> 00:27:35.480
digital age, and a really stark reminder of this constant,
522
00:27:35.599 --> 00:27:39.440
often invisible battle being fought online to protect our financial systems,
523
00:27:39.480 --> 00:27:41.079
protect the fairness of the markets.
524
00:27:41.279 --> 00:27:44.759
It shows the chilling ingenuity of cyber criminals, but also
525
00:27:45.079 --> 00:27:48.079
the relentless work of law enforcement trying to keep pace.
526
00:27:47.960 --> 00:27:51.559
Yeah, adapting constantly to bring people who exploit our interconnected
527
00:27:51.599 --> 00:27:52.759
world to justice.
528
00:27:53.039 --> 00:27:56.319
But as these two alleged masterminds remain at large, with
529
00:27:56.400 --> 00:27:59.400
that million dollar reward hanging over them, it does leave
530
00:27:59.440 --> 00:28:03.039
you wondering, in this world where data flows instantly, where
531
00:28:03.079 --> 00:28:06.240
digital identities can be in just how secure are the
532
00:28:06.319 --> 00:28:09.880
digital foundations of our global economy really? It's a sobering thought,
533
00:28:10.039 --> 00:28:12.400
and what does justice even look like when perpetrators can
534
00:28:12.440 --> 00:28:15.759
just disappear into the vastness of the internet. Exactly what
535
00:28:15.960 --> 00:28:19.160
new tools, what new kinds of international teamwork might we
536
00:28:19.240 --> 00:28:22.599
need to actually catch these digital fugitives to truly secure
537
00:28:22.640 --> 00:28:23.599
our digital future.
538
00:28:23.759 --> 00:28:26.599
It's a huge question, one that echoes long after the
539
00:28:26.640 --> 00:28:29.119
case is closed or in this instance, remains wide open.
540
00:28:29.200 --> 00:28:30.799
A challenge for all of us really
1
00:00:12.000 --> 00:00:16.519
Imagine, if you will, a hidden war, not fought on battlefields,
2
00:00:16.559 --> 00:00:20.640
but in the unseen digital corridors where the most vital
3
00:00:20.719 --> 00:00:24.839
financial secrets live, the very data that dictates the pulse
4
00:00:24.920 --> 00:00:29.239
of global markets. It's not just protected by these powerful institutions, right,
5
00:00:29.559 --> 00:00:34.439
it's actively sought after by shadowy figures in this high stakes,
6
00:00:35.439 --> 00:00:37.119
almost cinematic digital game.
7
00:00:37.280 --> 00:00:40.119
Yeah, it sounds like a movie plot, but it's frighteningly real.
8
00:00:40.200 --> 00:00:43.240
This isn't Hollywood. It's the chilling reality of a really
9
00:00:43.240 --> 00:00:48.240
sophisticated cyber financial crime that honestly shook the US financial landscape,
10
00:00:48.439 --> 00:00:49.960
shook the foundations of trust.
11
00:00:50.240 --> 00:00:52.520
It really is a profound wake up call reminder that
12
00:00:52.600 --> 00:00:56.240
this battle for economic integrity isn't just in boardrooms or
13
00:00:56.280 --> 00:00:57.039
on trading floors.
14
00:00:57.119 --> 00:00:59.520
No, it's fought deep inside the Internet, where these incredibly
15
00:00:59.560 --> 00:01:02.560
skilled vyebercriminals are just constantly probing, looking for that one
16
00:01:02.600 --> 00:01:03.799
weakness they can exploit.
17
00:01:04.120 --> 00:01:07.640
And today that's exactly what we're diving into, headfirst, into
18
00:01:07.640 --> 00:01:10.280
that unseen battle. We're going to unravel the audacious story
19
00:01:10.319 --> 00:01:15.280
of Artemachenko and Alexandra Aramenko, two Ukrainian nationals accused of
20
00:01:15.400 --> 00:01:20.840
orchestrating this incredibly elaborate global hacking and insider trading conspiracy.
21
00:01:20.920 --> 00:01:23.079
And their target wasn't just you know, a company or
22
00:01:23.120 --> 00:01:26.439
a bank. They went for the absolute heart of America's
23
00:01:26.480 --> 00:01:31.920
financial disclosure system, the US Securities and Exchange Commission, the SEC.
24
00:01:32.200 --> 00:01:34.519
Wow. So our mission for you today is to pull
25
00:01:34.560 --> 00:01:36.200
back the curtain on this alleged scheme.
26
00:01:36.280 --> 00:01:39.439
Yeah, you'll discover the really intricate, almost surgical methods they
27
00:01:39.480 --> 00:01:41.719
reportedly used to breach what should be one of the
28
00:01:41.719 --> 00:01:44.439
most secure financial databases in the world.
29
00:01:44.599 --> 00:01:48.480
And the profits, Yeah, the astonishing profits they allegedly pulled in,
30
00:01:48.519 --> 00:01:50.280
sometimes in just minutes m M.
31
00:01:50.760 --> 00:01:54.480
And then there's the chase, the relentless multi agency pursuit
32
00:01:54.519 --> 00:01:57.319
by US authorities that's now led to this huge one
33
00:01:57.359 --> 00:01:58.959
million dollar bounty.
34
00:01:58.519 --> 00:02:01.159
On their heads. Exactly, this is just a dry rundown
35
00:02:01.200 --> 00:02:03.120
of facts. We want this to feel like a gripping
36
00:02:03.120 --> 00:02:07.719
story deception, credible speed, these invisible battles fought over information.
37
00:02:08.000 --> 00:02:10.800
We'll expose the full alleged scope, break down the precise
38
00:02:10.879 --> 00:02:14.199
legal charges they're facing now, and really explore why this
39
00:02:14.319 --> 00:02:18.520
whole saga is such a critical, maybe even unsettling reminder
40
00:02:18.680 --> 00:02:22.000
of just how fragile the digital foundations of our economy
41
00:02:22.080 --> 00:02:22.800
might actually be.
42
00:02:23.159 --> 00:02:25.479
So let's peel back those layers. Let's get into this
43
00:02:25.560 --> 00:02:30.199
extraordinary tale. Okay. To really grasp the gravity, the sophistication
44
00:02:30.280 --> 00:02:34.280
of this digital heist, we absolutely have to start with
45
00:02:34.319 --> 00:02:35.400
the alleged masterminds.
46
00:02:35.439 --> 00:02:38.240
Right. Every good story needs its central figures.
47
00:02:37.879 --> 00:02:40.319
And in this one, two names really stand out. First up,
48
00:02:40.639 --> 00:02:43.639
we have the person authorities called the architect, the recruiter,
49
00:02:44.360 --> 00:02:46.319
ardem Vyekoslavovich Redschhenko.
50
00:02:46.599 --> 00:02:49.080
Yeah, and what we know about Radschhenko publicly is well,
51
00:02:49.120 --> 00:02:52.439
it's almost as interesting as the allegations themselves. Born June fourth,
52
00:02:52.560 --> 00:02:56.120
nineteen ninety two, Ukrainian national. Okay, the US Secret Service
53
00:02:56.159 --> 00:02:58.840
profile gives physical details five foot eight, one hundred and
54
00:02:58.840 --> 00:03:02.479
thirty five pounds, brown hair, brown eyes. Now these details
55
00:03:02.479 --> 00:03:05.080
they see mundane, right, the standard info, but they're not.
56
00:03:05.120 --> 00:03:08.000
They're part of an official wanted fugitive profile. This isn't
57
00:03:08.000 --> 00:03:12.840
just biography. It's part of an active global manhunt. It
58
00:03:12.879 --> 00:03:15.919
really underscores his current status a man on the run, which.
59
00:03:15.719 --> 00:03:20.840
Makes him fascinating but also you know, dangerous. He's not history,
60
00:03:20.879 --> 00:03:24.479
he's still out there. So if he's the alleged ring leader,
61
00:03:24.520 --> 00:03:27.960
the architect. As you said, what kind of operation did
62
00:03:28.000 --> 00:03:29.599
he build? Was it hierarchical?
63
00:03:30.000 --> 00:03:32.680
Well, the indictment paints him as the central figure, Yeah,
64
00:03:32.759 --> 00:03:36.439
the one who recruited Alexander Vatali Vishieramenko and other hackers
65
00:03:36.439 --> 00:03:40.240
in Ukraine. Okay, And it specifically mentions him managing their
66
00:03:40.280 --> 00:03:41.120
criminal efforts.
67
00:03:41.400 --> 00:03:45.080
Managing criminal efforts? Yeah, what did that actually mean in
68
00:03:45.120 --> 00:03:47.120
a complex cyber conspiracy like this one.
69
00:03:47.159 --> 00:03:49.719
That's a really good question, and the indictment hints at
70
00:03:49.759 --> 00:03:54.120
something quite deliberate, almost like a corporate structure. Oddly enough,
71
00:03:54.280 --> 00:03:57.280
managing criminal efforts here seems to mean way more than
72
00:03:57.360 --> 00:04:01.680
just giving orders. It suggests strategic plan, resource allocation, oversight.
73
00:04:02.199 --> 00:04:05.599
It kind of elevates Radschenko beyond just being a hacker himself.
74
00:04:05.759 --> 00:04:07.680
So he wasn't just directing the technical.
75
00:04:07.319 --> 00:04:10.960
Side allegedly not. He was building and maintaining this whole
76
00:04:11.039 --> 00:04:14.360
illicit enterprise. It wasn't just a smash and grab. It
77
00:04:14.400 --> 00:04:17.839
seems like it was a meticulously planned operation, almost like
78
00:04:17.879 --> 00:04:19.600
a business model for cybercrime.
79
00:04:19.680 --> 00:04:23.120
And the evidence for this planning it's pretty striking, right.
80
00:04:23.160 --> 00:04:28.560
The indictment says Redchenko, the alleged manager, kept detailed personal notes. Yeah,
81
00:04:28.600 --> 00:04:32.319
it's incredible, not just random jottings, but like a strategic
82
00:04:32.439 --> 00:04:36.680
outline of what the SEC does and chillingly how they
83
00:04:36.720 --> 00:04:40.720
could get illicit access to its networks. It shows real calculation.
84
00:04:40.360 --> 00:04:43.000
It really does. These notes give this almost chilling window
85
00:04:43.040 --> 00:04:46.399
into his thinking. He clearly understood his target, the heart
86
00:04:46.439 --> 00:04:49.199
of the US financial system. Listen to this direct quote
87
00:04:49.199 --> 00:04:52.160
from his alleged notes. Okay, SEC is a resource where
88
00:04:52.199 --> 00:04:55.720
all quarterly and annual performance reports of US companies are available.
89
00:04:56.040 --> 00:04:59.040
SEC regulates the stock market. Every company is required to
90
00:04:59.040 --> 00:05:02.160
report to the SEC its financial results. Every company is
91
00:05:02.199 --> 00:05:05.839
required to report important issues such as bankruptcyes or CEO replacements.
92
00:05:06.279 --> 00:05:09.879
There's plenty of additional information available, such as database access information,
93
00:05:10.040 --> 00:05:12.040
initial codes, networks access, etc.
94
00:05:12.439 --> 00:05:17.360
Wow, that's incredibly specific. It's not just knowing how to
95
00:05:17.399 --> 00:05:20.600
break in, but understanding the whole ecosystem, the value of
96
00:05:20.639 --> 00:05:23.199
the information, how to leverage it exactly.
97
00:05:23.240 --> 00:05:27.480
It reveals someone highly intelligent calculating, someone who really got
98
00:05:27.480 --> 00:05:30.279
that information is the currency now and he knew how
99
00:05:30.279 --> 00:05:32.120
to convert it into illicted cash.
100
00:05:32.519 --> 00:05:34.879
It sounds almost academic his approach to crime.
101
00:05:35.000 --> 00:05:39.839
It does a deep understanding of market mechanics, regulatory processes,
102
00:05:40.279 --> 00:05:43.360
not just technical weak spots. He saw the SEC as
103
00:05:43.360 --> 00:05:46.920
the central nervous system for Wall Street, the ultimate gatekeeper.
104
00:05:47.000 --> 00:05:49.759
And the seriousness of that alleged role is clear from
105
00:05:49.759 --> 00:05:53.920
his current status still a wanted fugitive and that reward
106
00:05:54.600 --> 00:05:57.399
a one million dollar reward from the US Department of
107
00:05:57.439 --> 00:06:00.399
State for information leading to his arrest conviction.
108
00:06:00.759 --> 00:06:04.040
And crucially, it's not just for hacking, it's specifically for
109
00:06:04.120 --> 00:06:06.800
participating in transnational organized crime.
110
00:06:06.920 --> 00:06:09.519
Right, that designation really elevates it. It's a matter of
111
00:06:09.639 --> 00:06:11.480
national even international security.
112
00:06:11.600 --> 00:06:15.800
So if Richenko was the strategist, the architect, then Alexander
113
00:06:15.879 --> 00:06:19.759
Vittalievich Ramenko was well undoubtedly the hands on hacking.
114
00:06:19.480 --> 00:06:21.839
Maestro okay the technical expert born July.
115
00:06:21.680 --> 00:06:24.959
Twenty three to nineteen ninety one, also Ukrainian, and he
116
00:06:25.040 --> 00:06:30.800
operated under known aliases in the digital underworld, Zelurimir and Lamares.
117
00:06:31.480 --> 00:06:34.319
And those aliases aren't just random, right, they signify something
118
00:06:34.399 --> 00:06:35.360
in that world. Yeah.
119
00:06:35.639 --> 00:06:38.000
Alis Is like these often come with a reputation. They
120
00:06:38.040 --> 00:06:41.240
suggest a history, a certain notoriety in the dark corners
121
00:06:41.279 --> 00:06:42.600
of the Internet, and.
122
00:06:42.519 --> 00:06:46.160
His reputation, well, it precedes him in a pretty alarming way,
123
00:06:46.319 --> 00:06:50.199
you have to understand this alleged sec hack wasn't his
124
00:06:50.240 --> 00:06:53.240
first major cybercrime, not by a long shot.
125
00:06:53.360 --> 00:06:55.959
No, absolutely not. He was the subject of a separate,
126
00:06:56.079 --> 00:07:00.120
massive federal indictment back in August twenty fifteen. Understanding that
127
00:07:00.199 --> 00:07:03.639
prior case is really fundamental to grasping his expertise and
128
00:07:03.720 --> 00:07:05.639
his frankly frightening track record.
129
00:07:05.680 --> 00:07:08.279
Okay, tell us about that. The newswire hacking scheme.
130
00:07:08.160 --> 00:07:11.160
That's the one. It reveals the sustained campaign of well
131
00:07:11.199 --> 00:07:14.399
digital terror, starting way back in February twenty ten, lasting
132
00:07:14.399 --> 00:07:17.240
over five years until twenty fifteen. Earmenker and his co
133
00:07:17.240 --> 00:07:21.879
conspirators allegedly systematically hacked into the networks of major newswire organizations,
134
00:07:21.920 --> 00:07:26.720
which ones market Wired, pr Newswire, and Business Wire. Their
135
00:07:26.759 --> 00:07:32.199
goal was chillingly simple but incredibly effective steel confidential press
136
00:07:32.240 --> 00:07:36.519
releases stuff with material non public information before it hit
137
00:07:36.560 --> 00:07:37.439
the public domain.
138
00:07:37.839 --> 00:07:41.399
So like getting earnings reports, acquisition news, clinical trial results
139
00:07:42.079 --> 00:07:44.000
before anyone else knew exactly.
140
00:07:44.079 --> 00:07:46.600
Imagine having that kind of advanced knowledge.
141
00:07:46.199 --> 00:07:48.839
A scale of that previous operation. Yeah, it was huge,
142
00:07:48.879 --> 00:07:49.839
wasn't it staggering?
143
00:07:50.120 --> 00:07:52.920
The indictment mentions more than one hundred and fifty thousand
144
00:07:53.040 --> 00:07:54.560
stolen releases.
145
00:07:54.160 --> 00:07:55.319
One hundred and fifty thousand.
146
00:07:55.399 --> 00:07:58.600
Yeah, this wasn't small time. It was industrial scale information
147
00:07:58.759 --> 00:08:03.360
theft and the profit over thirty million dollars in illicit
148
00:08:03.439 --> 00:08:04.600
trading gains.
149
00:08:04.319 --> 00:08:08.120
Thirty million dollars, yeah, just from trading on stolen news releases.
150
00:08:08.319 --> 00:08:11.360
Right, it shows an incredible ability to monetize stolen data.
151
00:08:11.720 --> 00:08:14.399
The charges from that prior scheme paint a really vivid
152
00:08:14.439 --> 00:08:20.199
picture wire fraud, securities, fraud, conspiracies for both money laundering, conspiracy,
153
00:08:20.240 --> 00:08:23.839
computer fraud, computer fraud conspiracy, aggravated identity.
154
00:08:23.480 --> 00:08:24.720
Thought, that's a serious list.
155
00:08:25.000 --> 00:08:28.759
It's a testament to a highly skilled, dangerous cyber criminal
156
00:08:29.079 --> 00:08:34.039
who had already mastered exploiting confidential information for huge financial gain.
157
00:08:34.480 --> 00:08:35.840
He had the technical chops.
158
00:08:36.000 --> 00:08:39.720
So this is the guy this season, hacker, proven multimillion
159
00:08:39.799 --> 00:08:45.159
dollar digital thief who was then allegedly recruited by Ardim
160
00:08:45.360 --> 00:08:49.480
Vyatchislaviovich read Chenko for the sec job exactly.
161
00:08:49.480 --> 00:08:51.840
That tells you the kind of team they were allegedly building.
162
00:08:52.159 --> 00:08:56.879
Strategic genius plus top tier technical execution, a formidable duo.
163
00:08:57.080 --> 00:09:00.720
And like Brichenko Heremenko is also still a one fugitive
164
00:09:01.240 --> 00:09:03.639
that joint one million dollar reward applies tim too.
165
00:09:04.159 --> 00:09:07.480
The hunt for both is very much active, spanning continents. Okay,
166
00:09:07.480 --> 00:09:09.879
so we've met the alleged players. Now let's shift focus
167
00:09:09.919 --> 00:09:13.039
to the target itself, the vault of American financial secrets.
168
00:09:13.039 --> 00:09:13.879
They allegedly went.
169
00:09:13.840 --> 00:09:18.240
After the US Securities in Exchange Commission. The SEC the
170
00:09:18.279 --> 00:09:19.960
guardian of the markets pretty much.
171
00:09:20.000 --> 00:09:23.960
Its core mission is vital maintaining fair, orderly and efficient markets.
172
00:09:24.000 --> 00:09:27.159
They're the referees, essentially making sure everyone plays by the rules,
173
00:09:27.159 --> 00:09:29.799
that investors get accurate, timely information.
174
00:09:29.480 --> 00:09:32.279
Protecting the average show from getting fleeced, right.
175
00:09:32.320 --> 00:09:35.480
And that critical role makes it almost obvious why the
176
00:09:35.559 --> 00:09:38.879
SEC became such a high value target for hackers.
177
00:09:38.519 --> 00:09:40.559
Like these, Because it's a central vault exactly.
178
00:09:40.639 --> 00:09:45.639
It's the repository for highly confidential business information from pretty
179
00:09:45.679 --> 00:09:49.159
much every publicly traded company in the US. Think about it.
180
00:09:49.480 --> 00:09:55.039
Earnings reports, acquisitions, major financial filings. It all has to
181
00:09:55.080 --> 00:09:56.480
go through the SEC first.
182
00:09:56.600 --> 00:10:02.279
And this information, especially earnings reports, CEO changes, bankruptcies, it
183
00:10:02.320 --> 00:10:04.240
moves markets right when it becomes public.
184
00:10:04.320 --> 00:10:07.480
Absolutely, it can and often does affect the stock price.
185
00:10:07.720 --> 00:10:10.480
So the hacker's goal was to exploit that tiny but
186
00:10:10.559 --> 00:10:14.240
incredibly valuable window. The gap between the SEC getting the
187
00:10:14.320 --> 00:10:15.559
data and the public.
188
00:10:15.279 --> 00:10:19.080
Getting it an informational gold mine, huge potential profits in minutes.
189
00:10:19.279 --> 00:10:22.440
To handle this constant flood of data, the SEC uses
190
00:10:22.440 --> 00:10:27.320
its electronic filing system ADGRR Electronic Data Gathering, Analysis and
191
00:10:27.360 --> 00:10:28.240
Retrieval System.
192
00:10:28.360 --> 00:10:31.240
That's the digital gateway where companies submit everything ten tas,
193
00:10:31.279 --> 00:10:32.200
ten qs, eight ks.
194
00:10:32.320 --> 00:10:35.759
That's it. It's the lifeblood of transparency in US markets.
195
00:10:36.240 --> 00:10:39.440
But here's the critical vulnerability, the sort of ironic twists
196
00:10:39.440 --> 00:10:42.720
they allegedly found and exploited edgy or allowed companies to
197
00:10:42.759 --> 00:10:47.120
submit test filings hours, maybe even days before the official
198
00:10:47.159 --> 00:10:48.200
public release.
199
00:10:48.080 --> 00:10:50.480
Test filings just to check formatting and stuff.
200
00:10:50.600 --> 00:10:54.639
Yeah, that was the idea. But crucially, these test filings
201
00:10:54.639 --> 00:10:58.559
often contained information that was the same or substantially similar
202
00:10:58.600 --> 00:11:01.240
to the material information was eventually released.
203
00:11:00.960 --> 00:11:03.879
To the public whoe. So they were basically pre release
204
00:11:04.000 --> 00:11:06.519
copies of sensitive market moving info.
205
00:11:06.759 --> 00:11:12.120
In effect, yes, material non public information, a genuine treasure
206
00:11:12.200 --> 00:11:16.440
trove for insider trading. Imagine getting a tech giant's earnings
207
00:11:16.559 --> 00:11:20.639
or pharma trial result or a merger announcement before anyone
208
00:11:20.679 --> 00:11:21.759
else legally could.
209
00:11:22.039 --> 00:11:24.759
That's an unbelievable advantage. It turned a convenience feature into
210
00:11:24.799 --> 00:11:25.919
a massive security hole.
211
00:11:26.039 --> 00:11:29.639
Precisely, and just for the legal side the jurisdiction, those
212
00:11:29.759 --> 00:11:33.840
EDDYGR servers holding this data were physically located in New Jersey.
213
00:11:33.600 --> 00:11:36.200
Okay, establishing the US connection for prosecution.
214
00:11:36.600 --> 00:11:40.000
Right and beyond the technical breach, this whole scheme was
215
00:11:40.000 --> 00:11:43.159
a direct attack on a core principle SEC regulation fair
216
00:11:43.159 --> 00:11:45.759
disclosure or reg FD, which.
217
00:11:45.600 --> 00:11:48.759
Says companies can't selectively leak important info early.
218
00:11:49.120 --> 00:11:53.399
Exactly, it prohibits giving material non public info to say,
219
00:11:53.919 --> 00:11:56.879
analysts or big shareholders before the general public gets it.
220
00:11:57.240 --> 00:11:59.960
What the hackers allegedly did was a calculated way around
221
00:12:00.159 --> 00:12:04.639
that rule, giving themselves and their recruited traders this massive, unfair,
222
00:12:04.799 --> 00:12:05.799
illegal edge.
223
00:12:05.879 --> 00:12:09.240
It's basically digital cheating on a huge scale, undermining the
224
00:12:09.279 --> 00:12:11.559
whole system's trust. All right, So we've got the players
225
00:12:11.679 --> 00:12:16.240
the target, Now the breach itself. How did Radchenko and
226
00:12:16.320 --> 00:12:20.799
ironmenco allegedly get inside this supposedly secure digital fortress.
227
00:12:20.879 --> 00:12:23.720
Well, the endictment lays out of timeline. It allegedly started
228
00:12:23.720 --> 00:12:27.399
around February twenty sixteen and went on until about March
229
00:12:27.519 --> 00:12:30.159
twenty seventeen, So it sustained year long.
230
00:12:30.000 --> 00:12:32.279
Campaign, not just a quick smashing grap No.
231
00:12:32.240 --> 00:12:36.080
Definitely not. They allegedly gain unauthorized access through a series
232
00:12:36.120 --> 00:12:40.399
of sophisticated and relentless cyber attacks. That phrasing suggests a constant,
233
00:12:40.440 --> 00:12:43.519
adaptive effort using multiple techniques, a digital siege.
234
00:12:43.559 --> 00:12:46.039
Really, and their toolkit was pretty advanced, wasn't it. What
235
00:12:46.080 --> 00:12:47.000
techniques did they use?
236
00:12:47.240 --> 00:12:50.600
Well? One mentioned is directory to versal attacks. Think of
237
00:12:50.639 --> 00:12:54.679
it like finding a hidden back corridor and a secure
238
00:12:54.720 --> 00:12:58.159
building that lets you bypass security and get into restricted areas.
239
00:12:58.240 --> 00:13:01.120
So exploding a web server vulnerable to get places they.
240
00:13:01.000 --> 00:13:05.559
Shouldn't exactly, It needs a precise technical understanding of how
241
00:13:05.639 --> 00:13:08.360
servers are set up and where weaknesses might lie.
242
00:13:08.720 --> 00:13:11.679
And then there were phishing attacks too, mm hmm. More
243
00:13:11.679 --> 00:13:13.399
common but still effective.
244
00:13:13.279 --> 00:13:16.519
Very effective, especially how they allegedly did it. These weren't
245
00:13:16.559 --> 00:13:21.039
just generic spam emails. They were carefully crafted malicious email
246
00:13:21.120 --> 00:13:24.480
sent directly to SEC employees, made to look like they
247
00:13:24.519 --> 00:13:26.039
came from other SEC employees.
248
00:13:26.120 --> 00:13:27.440
Oh, so they look legitimate.
249
00:13:27.799 --> 00:13:32.320
Tricky, very The goal was twofold steal credentials like usernames
250
00:13:32.320 --> 00:13:34.759
and passwords, the keys to the kingdom, and also install
251
00:13:34.879 --> 00:13:39.600
malware onto SEC computers, turn the SEC's own infrastructure against itself, and.
252
00:13:39.559 --> 00:13:42.720
Did that work? Did they manage to infect SEC computers?
253
00:13:42.840 --> 00:13:46.200
Allegedly Yes, The indictment says they successfully infected a number
254
00:13:46.200 --> 00:13:50.000
of SEC computers with malware. Once those machines were compromised,
255
00:13:50.000 --> 00:13:51.600
they became like inside.
256
00:13:51.159 --> 00:13:53.799
Agents trojan horses exactly.
257
00:13:53.679 --> 00:13:56.799
Letting the hackers probe the network from within, map it out,
258
00:13:57.039 --> 00:14:00.879
find critical systems, and ultimately steal info to get deeper access,
259
00:14:00.960 --> 00:14:05.960
especially to those test filings. Insidious internal spying, and.
260
00:14:05.919 --> 00:14:07.759
All the while they were trying to cover their tracks.
261
00:14:07.759 --> 00:14:12.279
Oh. Absolutely, they allegedly took steps to conceal and misrepresent
262
00:14:12.320 --> 00:14:17.200
their identities, standard practice for sophisticated cyber criminals, using things
263
00:14:17.240 --> 00:14:21.320
like VPNs anonymizers, routing traffic through hacked servers all over
264
00:14:21.360 --> 00:14:24.720
the world, making the chase much harder for investigators.
265
00:14:24.799 --> 00:14:27.639
Now here's where Iromenco's pass comes back into play, right,
266
00:14:27.960 --> 00:14:31.559
linking his old methods to this news scheme precisely.
267
00:14:31.639 --> 00:14:34.600
This is a crucial forensic link. The indictment says the
268
00:14:34.600 --> 00:14:38.200
conspirators allegedly employed some of the same methods that Iromenco
269
00:14:38.279 --> 00:14:40.399
had used in the newswire hacking scheme.
270
00:14:40.360 --> 00:14:44.480
So not just a similar crime, but using his signature techniques.
271
00:14:44.120 --> 00:14:47.559
In many ways, yes, like leaving identifiable clues. For instance,
272
00:14:47.639 --> 00:14:51.080
one clear digital fingerprint was the alleged use of an
273
00:14:51.159 --> 00:14:54.360
IP address in Romania that Iromenco controlled.
274
00:14:54.000 --> 00:14:55.960
An IP address he'd used before.
275
00:14:55.879 --> 00:15:00.080
Yes, one previously associated with the server Iromenco used in
276
00:15:00.120 --> 00:15:03.919
the Newswire hacking scheme. That's not just coincidence. It suggests
277
00:15:04.000 --> 00:15:07.840
continuity using the same tools and infrastructure. It's like finding
278
00:15:07.919 --> 00:15:10.399
the same rare tool at two different crime.
279
00:15:10.159 --> 00:15:13.799
Scenes, forensically linking him any other digital signatures.
280
00:15:14.200 --> 00:15:17.279
There was also the alleged use of an uncommon user
281
00:15:17.320 --> 00:15:20.879
agent string. Your browser sends the string to websites to
282
00:15:20.960 --> 00:15:24.679
identify itself. Most are standard, but using an uncommon one
283
00:15:24.720 --> 00:15:28.039
and the same uncommon one across different hacking campaigns. That's
284
00:15:28.039 --> 00:15:31.759
like leaving a very specific, unusual footprint. Another forensic link
285
00:15:31.799 --> 00:15:35.320
pointing to Iramenco's known digital habits from the earlier scheme,
286
00:15:35.799 --> 00:15:36.960
a unique calling card.
287
00:15:37.159 --> 00:15:40.120
Wow. And then there was this Lithuanian server that sounds.
288
00:15:39.879 --> 00:15:44.039
Important, hugely important. This server was allegedly their central hub,
289
00:15:44.200 --> 00:15:48.320
their digital data pipeline. Red Chenko, Aromenco and others allegedly
290
00:15:48.399 --> 00:15:53.200
purchased the Lithuanian server using a Bitcoin address controlled by Radchenko.
291
00:15:52.919 --> 00:15:55.840
Using bitcoin for anonymity.
292
00:15:55.480 --> 00:16:01.080
Partly Yeah, Bitcoin offers pseudoanonymity and makes cross order payments easier,
293
00:16:01.399 --> 00:16:03.759
which is common in these kinds of operations to obscure
294
00:16:03.799 --> 00:16:06.720
financial trails. But the key here is that the bitcoin
295
00:16:06.759 --> 00:16:10.639
address was allegedly controlled by red Chenko. That provides a
296
00:16:10.639 --> 00:16:13.879
direct financial link back to the supposed mastermind and.
297
00:16:13.879 --> 00:16:17.559
This Lithuanian server. This was where the stolen data ended up.
298
00:16:17.799 --> 00:16:22.840
That was the alleged destination. Between May and October twenty sixteen,
299
00:16:23.399 --> 00:16:27.200
thousands of those confidential test filings full of material non
300
00:16:27.200 --> 00:16:31.240
public information were exfiltrated, stolen, and moved out from the
301
00:16:31.320 --> 00:16:35.399
SEC's network to this Lithuanian server under the conspirator's control.
302
00:16:35.519 --> 00:16:37.679
Thousands. So it wasn't a trickle. It was a flood
303
00:16:37.720 --> 00:16:38.519
of stolen.
304
00:16:38.159 --> 00:16:41.559
Secrets Torrent, underscoring the sheer volume and systematic nature of
305
00:16:41.600 --> 00:16:45.279
the alleged operation. So the breach happened, the fortress was infiltrated.
306
00:16:45.320 --> 00:16:48.559
Now the focus shifts the heist and the harvest. How
307
00:16:48.559 --> 00:16:50.720
did they actually make money from these stolen secrets?
308
00:16:50.759 --> 00:16:53.559
We know they stole thousands of these confidential test filings,
309
00:16:53.840 --> 00:16:56.320
a treasure chest to market intelligence.
310
00:16:55.960 --> 00:16:59.759
And the alleged profit mechanism was twofold, showing a real
311
00:17:00.039 --> 00:17:04.640
understanding of the markets. First, they were apparently selling access
312
00:17:04.680 --> 00:17:07.400
to the non public information contained in these yet to
313
00:17:07.400 --> 00:17:09.440
be disclosed reports.
314
00:17:08.839 --> 00:17:11.640
Like selling subscriptions to an illegal insider newsfeed.
315
00:17:11.960 --> 00:17:16.000
Kind of yeah, guaranteeing advance knowledge no one else had. Second,
316
00:17:16.079 --> 00:17:18.960
and maybe even bolder, was trading in the securities of
317
00:17:18.960 --> 00:17:21.839
the companies before the investing public learned the same information.
318
00:17:22.119 --> 00:17:25.720
Classic insider trading, but turbocharged with direct access to the
319
00:17:25.759 --> 00:17:27.000
source data exactly.
320
00:17:27.519 --> 00:17:30.920
And Redchenko, the alleged architect, wasn't just directing the hacking,
321
00:17:31.000 --> 00:17:34.240
He was allegedly hands on and monetizing it too. The
322
00:17:34.279 --> 00:17:37.839
indictment says he actively recruited traders to join the conspiracy,
323
00:17:38.279 --> 00:17:41.000
visiting them the stolen filings, So it wasn't just.
324
00:17:40.960 --> 00:17:45.160
The two of them. It was a network hackers, maybe analysts, traders.
325
00:17:45.359 --> 00:17:48.519
It looks that way, a well oiled machine with different roles.
326
00:17:48.559 --> 00:17:51.559
Hackers get the data, maybe someone sifts through it, Traders
327
00:17:51.599 --> 00:17:56.559
execute the transactions. It suggests a sophisticated criminal enterprise built
328
00:17:56.599 --> 00:17:58.440
to scale up the profits.
329
00:17:58.000 --> 00:18:01.599
And the impact, according to authorities, was pretty severe. Beyond
330
00:18:01.680 --> 00:18:02.519
just the money they made.
331
00:18:02.720 --> 00:18:05.240
Oh yeah, it compromised the integrity of the market and
332
00:18:05.279 --> 00:18:08.640
deprived honest investors of a level playing field. It's about
333
00:18:08.720 --> 00:18:12.799
undermining trust eroding confidence that the market is fair.
334
00:18:12.920 --> 00:18:15.200
Okay, let's make this real. You mentioned as specific case
335
00:18:15.200 --> 00:18:17.279
studying the indictment Public Company one.
336
00:18:17.440 --> 00:18:21.359
Yes, this one instance from May nineteen, twenty sixteen, really
337
00:18:21.359 --> 00:18:25.200
illustrates the incredible speed and precision. It's a snapshot of
338
00:18:25.200 --> 00:18:27.720
the alleged crime unfolding minute by minute.
339
00:18:27.799 --> 00:18:30.359
All right, let's walk through it. Paint the picture. May
340
00:18:30.440 --> 00:18:31.559
nineteen twenty sixteen.
341
00:18:31.640 --> 00:18:34.359
Okay, picture this. It's three point three to two pm
342
00:18:34.480 --> 00:18:37.640
Eastern daylight time. A test filing for Public Company one
343
00:18:37.799 --> 00:18:41.640
goes onto the SEC's a DJR servers contains sensitive non
344
00:18:41.680 --> 00:18:43.720
public info about its second quarter results.
345
00:18:43.799 --> 00:18:47.480
Okay, the starting gun. The info is in the vault briefly, briefly,
346
00:18:47.519 --> 00:18:47.960
as a word.
347
00:18:48.000 --> 00:18:51.039
Just six minutes later, at three three eight pm, Retchenko,
348
00:18:51.319 --> 00:18:55.200
Aromenko and others allegedly use that Lithuanian server to access
349
00:18:55.279 --> 00:18:58.519
EDDDR without authorization. They steal the test filing.
350
00:18:58.720 --> 00:19:02.519
Six minutes that's credibly fast. The data is compromised and the.
351
00:19:02.480 --> 00:19:05.720
Clock is ticking for them to profit. Between three point
352
00:19:05.720 --> 00:19:08.079
four two pm and three point five nine pm, just
353
00:19:08.200 --> 00:19:11.279
seventeen minutes after they allegedly stole the data, a trading
354
00:19:11.279 --> 00:19:15.039
account linked to CC one, a co conspirator, goes into overdrive.
355
00:19:15.119 --> 00:19:15.640
What do they do?
356
00:19:15.839 --> 00:19:19.160
This account purchase approximately one hundred and twenty one thousand
357
00:19:19.240 --> 00:19:21.880
shares of the stock of Public Company one for more
358
00:19:21.920 --> 00:19:24.359
than approximately two point four million dollars.
359
00:19:24.680 --> 00:19:27.920
Whoa big trades based on info nobody else.
360
00:19:27.720 --> 00:19:32.279
Has exactly covered high volume trading. Then, at four oh
361
00:19:32.440 --> 00:19:35.359
two pm, just three minutes after those illicit buys stopped,
362
00:19:35.640 --> 00:19:39.960
Public Company one officially releases its earnings report, announcing record
363
00:19:40.000 --> 00:19:41.279
earnings expected.
364
00:19:40.839 --> 00:19:43.119
For the year. So the public finally gets the news
365
00:19:43.119 --> 00:19:45.440
the conspirators have allegedly been trading on for almost half
366
00:19:45.480 --> 00:19:46.000
an hour.
367
00:19:46.960 --> 00:19:49.400
And the payoff. By the end of the next trading
368
00:19:49.480 --> 00:19:51.720
day that CC one account had sold the shares bought
369
00:19:51.759 --> 00:19:54.400
the day before, The profit more than two hundred and
370
00:19:54.440 --> 00:19:55.519
seventy thousand dollars a.
371
00:19:55.559 --> 00:19:58.839
Quarter of a million dollars in roughly twenty four hours
372
00:19:58.920 --> 00:20:00.160
just from that one stole the.
373
00:20:00.160 --> 00:20:03.720
Filing allegedly Yes, it's a chillingly effective example speed precision
374
00:20:03.799 --> 00:20:05.240
exploitation of stolen data.
375
00:20:05.319 --> 00:20:07.160
And this wasn't just a one off, right, They kept
376
00:20:07.160 --> 00:20:08.519
doing this, Far from it.
377
00:20:08.759 --> 00:20:12.319
The indictment list several other documented thefts, showing it was systematic.
378
00:20:12.920 --> 00:20:16.559
They allegedly used the Lithuanian server again and again to
379
00:20:16.720 --> 00:20:19.799
steal filings for Public Company two on July twenty second,
380
00:20:20.079 --> 00:20:23.440
Public Company three on July twenty ninth, Public Company four
381
00:20:23.640 --> 00:20:26.240
on August fourth, Public Company five.
382
00:20:26.119 --> 00:20:29.079
On August eighth, All in twenty sixteen, and didn't they
383
00:20:29.119 --> 00:20:30.319
hit Public Company one again?
384
00:20:30.440 --> 00:20:34.240
They did brazenly. They allegedly targeted Public Company one again
385
00:20:34.359 --> 00:20:35.640
on August seventeenth.
386
00:20:35.680 --> 00:20:39.880
Wow, that persistence really suggests a professional operation, not just
387
00:20:40.000 --> 00:20:42.359
random hacks. They knew they had a working method and
388
00:20:42.440 --> 00:20:43.400
just kept exploiting it.
389
00:20:43.480 --> 00:20:46.119
Okay, so we've seen the alleged scheme, the scale of it. Now,
390
00:20:46.160 --> 00:20:48.240
how did the law finally start catching up?
391
00:20:48.559 --> 00:20:52.160
Well? On January fifteen, twenty nineteen, a federal grand jury
392
00:20:52.160 --> 00:20:54.920
in New Jersey formally indicted Rodchenko and Iramenko.
393
00:20:55.200 --> 00:20:57.640
Right, but that indictment stayed under seal for a while.
394
00:20:57.400 --> 00:21:00.680
Didn't it. It did until October twenty nine, twenty. That's
395
00:21:00.680 --> 00:21:03.480
pretty common, right to allow more investigation or prevent fugitives
396
00:21:03.480 --> 00:21:04.200
getting tipped off.
397
00:21:04.279 --> 00:21:06.799
Exactly a strategic move. And this wasn't a minor indictment.
398
00:21:06.799 --> 00:21:08.599
It was a sixteen count indictment.
399
00:21:09.119 --> 00:21:12.599
Sixteen counts. That really shows the breadth and severity of
400
00:21:12.640 --> 00:21:16.640
the alleged crimes. Prosecutors broke down every alleged legal act.
401
00:21:17.039 --> 00:21:20.599
And it wasn't just criminal charges. The SEC filed its
402
00:21:20.640 --> 00:21:24.880
own separate civil complaint against Aramenco and others too, So a.
403
00:21:24.799 --> 00:21:28.839
Two prompt legal attack, criminal and civil. That shows how
404
00:21:28.880 --> 00:21:31.000
seriously authorities take this kind of thing.
405
00:21:31.200 --> 00:21:34.920
Absolutely, when market integrity and cybersecurity are hit, they throw
406
00:21:34.960 --> 00:21:35.519
the book at it.
407
00:21:35.640 --> 00:21:38.200
Let's unpack those charges. What exactly are they accused of?
408
00:21:38.359 --> 00:21:42.680
Okay, First up is securities fraud conspiracy count one. That's
409
00:21:42.720 --> 00:21:46.640
basically an agreement to manipulate the stock market using deceptive methods,
410
00:21:47.039 --> 00:21:52.079
specifically using that stolen material non public information to trade.
411
00:21:51.960 --> 00:21:55.039
So conspiring to cheat investors essentially.
412
00:21:54.759 --> 00:21:57.359
Yes, proving intent to defraud is key there. Then there's
413
00:21:57.400 --> 00:21:59.000
wire fraud conspiracy count three.
414
00:21:59.119 --> 00:21:59.799
How's it different?
415
00:22:00.039 --> 00:22:03.400
It's broader, alleging a scheme to defraud the SEC itself
416
00:22:03.440 --> 00:22:06.160
and the companies of their right to control their confidential
417
00:22:06.160 --> 00:22:11.519
information and crucially using wire communications the Internet basically across
418
00:22:11.599 --> 00:22:14.079
state and international lines to do it, so.
419
00:22:14.000 --> 00:22:15.920
That covers the whole digital infrastructure they used.
420
00:22:16.039 --> 00:22:18.759
Right then you have the substance of wire fraud Counts
421
00:22:18.759 --> 00:22:22.039
four through nine. These aren't about the agreement. They're about
422
00:22:22.160 --> 00:22:25.759
the specific acts of transmitting fraudulent stuff via wire.
423
00:22:25.640 --> 00:22:29.160
Like using the Lithuanian server to access ADJR on those
424
00:22:29.160 --> 00:22:32.200
specific dates for companies one, two, three, four.
425
00:22:32.119 --> 00:22:36.400
Five Exactly, each one of those alleged digital actions is
426
00:22:36.440 --> 00:22:40.279
a separate wire fraud charge, building the case piece by piece.
427
00:22:40.400 --> 00:22:41.200
Okay, what else?
428
00:22:41.440 --> 00:22:45.400
Computer fraud conspiracy count two This is about the agreement
429
00:22:45.440 --> 00:22:51.000
to intentionally access computers without authorization, specifically breaking into a
430
00:22:51.079 --> 00:22:55.000
US government agency system the SEC and a protected computer
431
00:22:55.319 --> 00:22:59.039
to get information for commercial advantage and private financial gain.
432
00:22:59.359 --> 00:23:01.880
And the info had to be worth more than five thousand.
433
00:23:01.519 --> 00:23:04.319
Dollars, so just breaking in was illegal even before the
434
00:23:04.359 --> 00:23:05.400
trading correct.
435
00:23:05.480 --> 00:23:08.720
The unauthorized access itself is a federal crime. And finally,
436
00:23:08.799 --> 00:23:12.119
the substance of computer fraud Counts ten through sixteen.
437
00:23:11.799 --> 00:23:13.880
These are the specific hacks, yes.
438
00:23:14.359 --> 00:23:18.599
Mirroring those overt acts We discussed accessing at GR from
439
00:23:18.599 --> 00:23:22.480
that Romanian IP address back in May twenty sixteen, repeatedly
440
00:23:22.519 --> 00:23:25.599
accessing it from the Lithuanian server to steal those specific
441
00:23:25.640 --> 00:23:29.079
test filings on those dates in May, July August twenty sixteen.
442
00:23:29.559 --> 00:23:32.599
Each unauthorized access is another charge.
443
00:23:32.440 --> 00:23:34.839
Okay, a mountain of charges. What kind of penalties are
444
00:23:34.839 --> 00:23:36.920
we talking? If they're caught and convicted.
445
00:23:36.680 --> 00:23:40.079
They're severe For wire fraud and wire fraud conspiracy, the
446
00:23:40.079 --> 00:23:43.400
maximum is twenty years in prison per count plus finds
447
00:23:43.519 --> 00:23:46.480
up to two hundred and fifty thousand dollars or potentially
448
00:23:46.519 --> 00:23:48.599
twice the amount game or loss from the crime.
449
00:23:48.720 --> 00:23:50.880
Twenty years per count. Wow. And the other.
450
00:23:50.799 --> 00:23:55.039
Charges securities fraud conspiracy, computer fraud conspiracy, and the computer
451
00:23:55.119 --> 00:23:58.119
fraud counts, those carry a maximum of five years in
452
00:23:58.160 --> 00:24:01.720
prison per count plus similar fines, so significant time potentially,
453
00:24:01.960 --> 00:24:02.319
it's not.
454
00:24:02.319 --> 00:24:05.119
Just prison time, right. There's forfeiture, yeah, taking the money
455
00:24:05.119 --> 00:24:05.920
back exactly.
456
00:24:06.279 --> 00:24:09.960
The indictment includes forfeiture allegations. If convicted, they'd have to
457
00:24:10.000 --> 00:24:13.000
forfeit any property derived from the crime proceeds or used
458
00:24:13.000 --> 00:24:13.759
to commit the crime.
459
00:24:13.920 --> 00:24:14.960
Hitting them in the wallet.
460
00:24:15.240 --> 00:24:18.039
Right, And there's a substitute assets provision.
461
00:24:18.359 --> 00:24:19.319
This is important.
462
00:24:19.960 --> 00:24:22.920
If the original illicit profits the trading gains can't be found,
463
00:24:23.039 --> 00:24:25.640
maybe they've been laundered or moved offshore. Then what then
464
00:24:25.640 --> 00:24:28.680
The government can seize other property belonging to them up
465
00:24:28.680 --> 00:24:31.079
to the value of the illicit gains. Makes it much
466
00:24:31.119 --> 00:24:33.200
harder to just hide the money and enjoy it later.
467
00:24:33.480 --> 00:24:36.279
Bringing a case like this together, yeah, it must take
468
00:24:36.319 --> 00:24:38.400
a huge team effort, oh massive.
469
00:24:38.680 --> 00:24:42.680
The indictment credits a whole coalition US Secret Service FBI,
470
00:24:43.160 --> 00:24:47.519
the DOJ's Computer Crime and Intellectual Property Section CCIPS, the
471
00:24:47.640 --> 00:24:50.720
US Attorney's Office in New Jersey, and the SEC's own
472
00:24:50.799 --> 00:24:52.400
Market Abuse and cyber.
473
00:24:52.119 --> 00:24:54.039
Units, each bringing different expertise.
474
00:24:54.240 --> 00:24:58.720
Absolutely Secret Service on financial infrastructure and tracing money, FBI
475
00:24:58.799 --> 00:25:03.640
on cybercrime networks, CCIPS providing the legal expertise on cyber law,
476
00:25:03.920 --> 00:25:07.680
the US Attorney prosecuting, and the SEC providing insight from
477
00:25:07.680 --> 00:25:11.240
the target itself. It's a complex dance of information sharing
478
00:25:11.279 --> 00:25:13.759
and coordination, especially across borders, and we always have to
479
00:25:13.759 --> 00:25:18.400
add the legal caveat crucially important. The charges and allegations
480
00:25:18.799 --> 00:25:22.920
are merely accusations, and the defendant is presumed innocent unless
481
00:25:22.920 --> 00:25:26.720
and until proving VOLTI. That's fundamental, no matter how strong
482
00:25:26.720 --> 00:25:30.319
the case looks. So we've gone through the scheme, the players,
483
00:25:30.440 --> 00:25:34.319
the methods, the charges. But the story isn't over, no.
484
00:25:34.400 --> 00:25:37.920
Because as we speak, Artem Rechenko and Alexander Iromenko are
485
00:25:37.960 --> 00:25:41.160
still out there, fugitives on the global stage. They are
486
00:25:41.200 --> 00:25:43.359
whereabouts unknown to US authorities.
487
00:25:43.400 --> 00:25:47.000
They're actively wanted, prominently listed on the Secret Service's Most
488
00:25:47.039 --> 00:25:50.640
Wanted Fugitives list. This isn't a cold case. It's an ongoing,
489
00:25:50.720 --> 00:25:51.559
active pursuit.
490
00:25:51.680 --> 00:25:55.599
And the fact that they're Ukrainian citizens that complicates things,
491
00:25:55.640 --> 00:25:58.160
doesn't it. Extradition isn't simple, not at all.
492
00:25:58.240 --> 00:26:03.319
That transnational element is a huge challenge. It involves international law, diplomacy, politics,
493
00:26:03.359 --> 00:26:05.839
things that can really slow down or even stop extradition.
494
00:26:06.359 --> 00:26:08.599
It shows how hard it is to catch cyber criminals
495
00:26:08.640 --> 00:26:11.359
who operate across borders using the Internet to just.
496
00:26:11.720 --> 00:26:15.200
Vanish vanish into the digital ether. But the US government
497
00:26:15.279 --> 00:26:17.240
is putting serious money behind finding them.
498
00:26:17.440 --> 00:26:19.880
They are. The State Department has offered a reward of
499
00:26:20.000 --> 00:26:22.839
up to one million dollars for information leading to the
500
00:26:22.960 --> 00:26:26.880
arrest and or conviction of Radchenko and Ironmenco.
501
00:26:26.880 --> 00:26:31.000
And that reward specifies transnational organized crime, right, not just hacking.
502
00:26:31.319 --> 00:26:35.559
Correct. That designation highlights the global threat they're seen to represent.
503
00:26:35.640 --> 00:26:36.839
It's a serious label.
504
00:26:37.160 --> 00:26:40.640
That million dollars is a big incentive, a beacon for justice,
505
00:26:40.759 --> 00:26:43.119
hoping someone somewhere knows something it really is.
506
00:26:43.200 --> 00:26:45.799
It shows how determined the US is to hold them accountable,
507
00:26:45.880 --> 00:26:47.000
even across borders.
508
00:26:47.079 --> 00:26:50.559
And if anyone listening does have information, the official contact
509
00:26:50.640 --> 00:26:53.400
is the US Secret Service at most wanted at first,
510
00:26:53.400 --> 00:26:54.880
dot DHS, dot CoV.
511
00:26:55.880 --> 00:26:58.880
In cases like these, sometimes the smallest detail can break
512
00:26:58.920 --> 00:26:59.720
it wide open.
513
00:27:00.000 --> 00:27:03.400
We've really navigated this intricate web of digital deceit today,
514
00:27:03.720 --> 00:27:07.680
from sophisticated hacks like directory traversal and targeted fishing.
515
00:27:07.440 --> 00:27:12.039
Right the techniques used to allegedly breach the SEC zone systems.
516
00:27:11.880 --> 00:27:15.559
To that high speed insider trading allegedly netting huge sums
517
00:27:15.559 --> 00:27:18.799
in minutes. This deep dive has tried to lay bare
518
00:27:19.000 --> 00:27:23.680
the meticulous planning, the brazen execution, and the frankly profound
519
00:27:23.720 --> 00:27:29.200
impact of this alleged SEC hacking scheme by Richenko and Hiromenco.
520
00:27:29.720 --> 00:27:32.480
It's such a vivid picture of true crime and our
521
00:27:32.519 --> 00:27:35.480
digital age, and a really stark reminder of this constant,
522
00:27:35.599 --> 00:27:39.440
often invisible battle being fought online to protect our financial systems,
523
00:27:39.480 --> 00:27:41.079
protect the fairness of the markets.
524
00:27:41.279 --> 00:27:44.759
It shows the chilling ingenuity of cyber criminals, but also
525
00:27:45.079 --> 00:27:48.079
the relentless work of law enforcement trying to keep pace.
526
00:27:47.960 --> 00:27:51.559
Yeah, adapting constantly to bring people who exploit our interconnected
527
00:27:51.599 --> 00:27:52.759
world to justice.
528
00:27:53.039 --> 00:27:56.319
But as these two alleged masterminds remain at large, with
529
00:27:56.400 --> 00:27:59.400
that million dollar reward hanging over them, it does leave
530
00:27:59.440 --> 00:28:03.039
you wondering, in this world where data flows instantly, where
531
00:28:03.079 --> 00:28:06.240
digital identities can be in just how secure are the
532
00:28:06.319 --> 00:28:09.880
digital foundations of our global economy really? It's a sobering thought,
533
00:28:10.039 --> 00:28:12.400
and what does justice even look like when perpetrators can
534
00:28:12.440 --> 00:28:15.759
just disappear into the vastness of the internet. Exactly what
535
00:28:15.960 --> 00:28:19.160
new tools, what new kinds of international teamwork might we
536
00:28:19.240 --> 00:28:22.599
need to actually catch these digital fugitives to truly secure
537
00:28:22.640 --> 00:28:23.599
our digital future.
538
00:28:23.759 --> 00:28:26.599
It's a huge question, one that echoes long after the
539
00:28:26.640 --> 00:28:29.119
case is closed or in this instance, remains wide open.
540
00:28:29.200 --> 00:28:30.799
A challenge for all of us really
