Russian Web Developer Extradited to U.S. to Face Charges in Bank Account Takeover Scheme That Stole Millions

ATLANTA — A Russian national and web developer accused of helping run a transnational cyber-fraud conspiracy responsible for large-scale bank account takeovers was arraigned Friday in the Northern District of Georgia after being extradited from the Republic of Georgia, the Justice Department announced.

Sergei Anatolyevich Filimonov, 36, was indicted by a federal grand jury on Nov. 4, 2025, on charges relating to a credential-harvesting and bank-fraud operation that targeted victims across the United States.

According to court documents, Filimonov and his co-conspirators executed a sophisticated scheme involving spoofed domains that mimicked the websites of federally insured financial institutions. The conspirators purchased sponsored search-engine links to divert unsuspecting banking customers to fraudulent login pages, where victims entered their credentials. The conspirators then used the stolen credentials to access bank accounts, review account balances, and initiate unauthorized wire transfers to steal funds.

The indictment also alleges that Filimonov developed and maintained online infrastructure supporting the operation, including interactive databases storing more than 5,000 stolen login credentials and software designed to capture and transmit sensitive authentication data.

Filimonov and his conspirators allegedly attempted to obtain millions of dollars from victim accounts, including accounts held by companies located in the Northern District of Georgia. In connection with the charged scheme, the Department of Justice previously seized the domain web3adspanels.org, which operated as a backend server storing stolen credentials harvested from fraudulent banking websites. The seized backend database contained thousands of compromised credentials, including those belonging to victims located in the Northern District of Georgia.

Filimonov is charged with conspiracy to commit bank and wire fraud; access device fraud conspiracy; multiple counts of bank and wire fraud; possession of unauthorized access devices; possession of device-making equipment; effecting transactions with unauthorized access devices; and aggravated identity theft.

If convicted, he faces a minimum penalty of two years in prison and a maximum penalty of 175 years in prison.
An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

Creator of Rydox Cybercrime Marketplace Pleads Guilty After Extradition From Kosovo

Ardit Kutleshi admitted running an illicit website used to buy and sell stolen personal information, access devices, and cybercrime tools, prosecutors said.

PITTSBURGH — A Kosovar national pleaded guilty in federal court in the Western District of Pennsylvania to charges related to his creation and operation of Rydox, an illicit online marketplace where cybercriminals bought, sold, and traded stolen personal information, access devices, and other tools for carrying out cybercrime and fraud, the Justice Department announced.

Ardit Kutleshi, 28, pleaded guilty to aggravated identity theft and money laundering conspiracy. He is scheduled to be sentenced on Feb. 9, 2027, and faces a mandatory minimum penalty of two years in prison on the aggravated identity theft count and a maximum penalty of 20 years on the money laundering conspiracy count. A federal district court judge will determine the sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

According to court documents, Rydox had conducted over 7,600 transactions since at least 2016 involving stolen personally identifiable information, stolen access devices, means of identification, and cybercrime tools and services, receiving at least $232,000 in revenue. Those transactions involved the sale of personally identifiable information stolen from victims located in the United States.

Kutleshi was arrested by Kosovo law enforcement in December 2024 and extradited from Kosovo to the United States in 2025. In December 2024, the United States also judicially seized the domain www.Rydox.cc, which hosted and facilitated access to the Rydox website. The seizure prevented the owners and third parties from using the site to continue buying and selling cybercrime tools and stolen personal identifying information of U.S. citizens.

“The guilty plea of Ardit Kutleshi for operating the Rydox marketplace exposes a sophisticated scheme to profit from stolen identities and cybercrime tools,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division. “This guilty plea sends a strong message to all cybercriminals that the Justice Department will identify, arrest, and prosecute cybercriminals regardless of where they are in the world through international cooperation, technical expertise, and cutting-edge law enforcement.”

U.S. Attorney Troy Rivetti of the Western District of Pennsylvania said Kutleshi and his brother, Jetmir, operated the marketplace for their own gain. Jetmir Kutleshi pleaded guilty and was sentenced in December 2025 prior to his deportation back to Kosovo, according to Rivetti.

“These types of cybercrimes cause not only financial loss, but also ongoing psychological harm to the victims who lose both money as well as trust in institutions and the online market infrastructure,” Rivetti said. “Our office will continue to work with our law enforcement partners to find and prosecute individuals who attempt to profit from the illegal sharing and sale of other people’s personal information and access devices, and related cybercrime.”

FBI Cyber Division Assistant Director Brett Leatherman said Rydox put cybercriminal tools and sensitive data up for sale, including the stolen identities and logins of thousands of people.

“The FBI and its foreign partners shut the marketplace down, and now the man who created it and ran it pleaded guilty,” Leatherman said. “We will continue to use every legal tool at our disposal to extradite cybercriminals and take down their infrastructure.”