The Moscow City Court will consider the case of those accused of hacker attacks on Sberbank and VTB

The Moscow City Court has begun hearing the case of Yevgeny and Dmitry Popelysh, natives of the city of Khartsyzsk in the Donetsk People’s Republic, who are accused of embezzling money from the accounts of Sberbank clients and VTB 24 in 2013. In November 2022, the Gagarin Court found them guilty and sentenced them to seven years in a penal colony, but ruled that the sentence had been served, taking into account the time spent by the brothers in a pre-trial detention center and under house arrest. Popelyshi’s defense appealed the verdict and now intends to get their acquittal.

According to the prosecution, the Popelysh brothers, along with accomplices Daniil Sharychev, Petr Belsky, and Alexander Sarbin, redirected requests from bank customers to a phishing site using the Patchet.Ib and Qhost malware they purchased. The damage in the case amounted to 720,000 rubles.

The twins from Donbass first came to the attention of law enforcement in 2011. They were arrested in connection with phishing attacks that also affected clients of large Russian banks. According to the verdict, more than 13 million rubles. were abducted within a few months of 2010–2011. using Trojan.Win32.VKhost malware. Then the brothers pleaded guilty, and in September 2012 the court sentenced them to six years of suspended imprisonment with a probationary period of five years.

But already in May 2015, Popelysh was again detained during a joint special operation of the Ministry of Internal Affairs and the FSB, accused of creating and using malware (Article 273 of the Criminal Code), illegal access to computer information (Article 272 of the Criminal Code) and fraud (Article 159 of the Criminal Code). ). According to Group-IB, whose specialists participated in the examination of the case, “from March 2013 to May 2015, the Popelysh group gained access to more than 7,000 customer accounts of various Russian banks and stole more than 12.5 million rubles. “. This time the brothers denied the guilt.

The investigation, which dragged on for several years, was entrusted to the Investigation Department of the Ministry of Internal Affairs of Russia. 15 out of 279 episodes reached the court, says Dmitry Popelysh’s lawyer Irina Dobroselskaya. In June 2018, the Savelovsky District Court of Moscow found the Popelysh guilty and sentenced them to eight years in prison. This is one of the longest sentences for hacker attacks in Russia. But in March 2019, the Judicial Collegium of the Moscow City Court for Criminal Cases unexpectedly agreed with the arguments of the defense and overturned the verdict due to “violations committed during the preliminary investigation.” To eliminate the violations, the case was returned to the Prosecutor General’s Office, and from there to the Ministry of Internal Affairs. The materials of the investigation remained with the police, says lawyer Dobroselskaya. However, despite the annulment of the sentence, the brothers did not go free – they were arrested in a new criminal case with similar charges under the same articles of the Criminal Code, which has now reached the Moscow City Court.

The decision to overturn the previous conviction coincided with the completion of another high-profile trial directly related to cybercrime investigations. In February 2019, employees of the FSB Information Security Center Sergey Mikhailov and Dmitry Dokuchaev, as well as a certain Georgy Fomchenkov and an employee of Kaspersky Lab Ruslan Stoyanov were found guilty of treason. The latter has worked for a cybersecurity company since 2012, and before that he served in the Department of Special Technical Measures (USTM) of the Central Internal Affairs Directorate for Moscow and left it with the rank of police major. The circumstances of the treason case are classified and protected by the law on state secrets. From statements by lawyers of the suspects and publications in the media, it is known that we are talking about treason in favor of the United States, including the transfer of information about “Russian hackers” to foreign intelligence services.

Six months after this resonant verdict, one of the Popelysh brothers, who, despite the cancellation of the verdict, was never released from the pre-trial detention center, said in court that it was Stoyanov who was behind his criminal prosecution.

According to Dmitry, the evidence in the case was fabricated due to the fact that he refused to cooperate with Stoyanov. The latter allegedly demanded that Popelysh engage in hacking. The man presented this version of events, speaking in court at a meeting on the extension of his arrest in September 2019. He said that after the arrest of Stoyanov, he informed law enforcement agencies about this. Stoyanov denied the accusations against him. In a comment for RBC he insisted on the guilt of the brothers arrested with his assistance.

At the same time, the interlocutor RBCwho is not associated with Kaspersky Lab and participated in the investigation of the Popelyshi criminal case, confirmed that Dmitry wrote appeals back in 2015 in which he accused Stoyanov and two other experts that they allegedly persuaded him to attack banks.

In turn, the Investigative Department of the Ministry of Internal Affairs, after the annulment of the verdict of the Savelovsky court, promptly filed a petition for the arrest of the brothers in another criminal case – about 6 episodes of embezzlement from bank accounts of Sberbank clients and VTB in 2013. Until the spring of 2019, these crimes were investigated by the Izhevsk police, and cases on them were suspended. As a result, the brothers remained in the special block of the Matrosskaya Tishina pre-trial detention center for several more months, until in 2020 the court released them under house arrest. By that time, the ECtHR had communicated the Popelysh complaint.

Only when the second case of the Popelyshs arrived at the Gagarinsky Court of Moscow, they were released on bail. After that, the case was considered for almost a year and a half, until December 2022. Finally, on June 15, 2023, the Moscow City Court began to consider the case. According to Dobroselskaya’s lawyer, over eight years of criminal prosecution of her clients and ten years of investigation of the episodes imputed to them, the statute of limitations for bringing those accused of grave crimes to justice has already passed. Moreover, in 2019 Popelyshi were prosecuted “without initiating criminal cases,” the lawyer assures. In the Izhevsk police, crimes were investigated under other articles of the Criminal Code, and there were simply no new decisions to initiate a case or retrain it in the materials. She insists that there is no evidence of their guilt in the Popelyshi case and petitioned the Moscow City Court for their acquittal.