WMP F. UNITED STATES DISTRICT COURT EASTERN DISTRICT OF NEW YORK . UNITED. STATES OF AMERICA IN I against Cr. No. (T. 15, U.S.C., 78j(b) and 78ff; T. 18, VITALY U.S.C., 371, 982(a)(l), VLADISLAV KHALUPSKY, . 1349, 1956(h), 2 and 3551 gt T.-21, LEONID MOMOTOK and U.S.C., 853(p); T. 28, U.S.C., ALEXANDER GARKUSHA, Defendants. . I REYES, MJ. THE GRAND JURY CHARGES: INTRODUCTION At all times relevant to this Indictment, unless otherwise indicated: I. The Defendants and Relevant Co~consnirators 1. i The defendant VITALY KORCHEVSKY was a resident of Glen Mills, and controlled brokerage accounts at, inter alia, E*Trade, efferies, JP Morgan, Scottrade, Fidelity and TD Ameritrade. KORCHEVSKY was formerly a hedge fund manager and investment adviser who was registered with the Securities and Exchange Commission from 2005 through 2009. The defendant VLADISLAV KHALUPSKY was a resident of Brooklyn, New York and Odessa, Ukraine, and controlled brokerage accounts at, inter glig, Merrill KHALUPSKY was formerly a broker-dealer registered with the SEC from 2000 through 2008. 3. The defendant LEONID MOMOTOK was a resident of Suwanee, Georgia, and centrolled brokerage accounts at, inter TD Ameritrade. 4. The defendant ALEXANDER GARKUSHA was a resident of Alpharetta and Cumming, Georgia. GARKUSHA was the Executive Vice President of APD Developers, Inc., a company based in Alpharetta, Georgia, that designed and built residential communities and condominiums. 5. . Co-Conspirator 1, an individual whose identity is known to the Grand Jury, was a resident of Alpharetta, Georgia, and controlled brokerage accounts at, inter Charles Schwab, E*Trade, Fidelity, Merrill and TD Ameritrade. Co-Conspirator was the owner of APD Developers, Inc. 6. Co-Conspirator 2, an individual whose identity is known to the Grand Jury, was a resident of Alpharetta, Georgia, and controlled brokerage accounts. at, i_r_1jte_r_ aha, Charles Schwab, E*Trade, Fidelity, Merrill and TD Ameritrade. Co?Conspirator 2 was the son of Co?Conspirator l. i 7. Co?Conspirator 3, an individual Whose identity is known to the Grand Jury, was a resident of Alpharetta, Georgia and Kiev, Ukraine. Co-Conspirator 3 was related to Co~Conspirator and Co?Conspirator 2. 8. Co-Conspirator 4, an individual whose identity is known to the Grand Jury, was a resident of Kiev, Ukraine. 9. Co-Conspirator 5, an individual whose identity is known to the Grand Jury, was a resident of Kiev, Ukraine. 11. The Targeted Entities 10. PR Newswire Association LLC Newswire?), a Wholly?owned subsidiary of UBM plc, was a global company with its headquarters in New York, New York. PR Newswire was in the business of, ir?r publishing and disseminating press releases for corporate clients. 11. I Marketwired L.P. (?Marketwired?) was a privately?held company with its global headquarters in Toronto, Canada and its US. headquarters in El Segundo, California. Marketwired was in the business of, inter publishing and disseminating press releases for corporate clients. 12. Business Wire, a wholly-owned subsidiary of Berkshire Hathaway, was a globalcornpany with its headquarters in San Francisco, California. Business Wire was in the business of, inter glia, publishing and disseminating press releases for corporate clients. 13. PR Newswire, Marketwired and Business Wire (collectively, the ?Victim Newswires?) were authorized'by the SEC to issue press releases for, alia, the following. publicly?traded companies: Acme Packet, Inc. A?ropostale, Inc. Align Technology, Inc. ANN INC. AutoNation, Inc. Avon Products, Inc. The Boeing Company CA, Inc. Caterpillar Inc. Cepheid Clorox Co. Darden Restaurants, Inc. DealerTrack Technologies, Inc. Deere Company Dendreon Corp. Dick?s Sporting-Goods, Inc. E. I. Du Pont De Nemours and Company Dycom Industries, Inc. Edwards Lifesciences Corporation Foot Locker, Inc. GeoEye, Inc. GNC Holdings, Inc. Guess?, Inc. The Hain Celestial Group, Inc. Hertz Global Holdings, Inc. Hewlett-Packard Company The Home Depot, Inc. LDK Solar Co., Ltd. Legg Mason, Inc. MasTec, Inc. Lincoln Electric Holdings, Inc. Marriott International MICROS Systems, Inc. NetApp, Inc. OmniVision Technologies, Inc. Oracle CorpOration Overstock.com, Inc.. Owens Corning Panera Bread Company PAREXEL International Corporation Parker-Hanni?n Corporation Payless ShoeSource The PNC Financial Services Group, Inc. Radio Shack Corporation Silicon Graphics International Corp. Synopsys, Inc. Tesla Motors, Inc. Texas Instruments Incorporated TreeHouse Foods, Inc. VAS CO Data Security International, Inc. VMware, Inc. and Weight Watchers International, Inc. (collectively, the ?Target Companies?). Ill. Relevant Terms and De?nitions ?14. An ?Internet Protocol? address address?) was a numerical label assigned to each device computer, printer) participating in a computer network that used the Internet Protocol for communication. An IP address served two principal functions: host or network interface identi?cation and location addressing. Because every device that connected to the internet used an IP address, IP address information could identify computers and other devices that were used to access the internet. 15 . A ?Uniform Resource Locator? was a computerized reference to a resource that speci?ed the location of the resource on a computer network and a mechanism for retrieving it. URLs most commonly referenced web pages. 16. ?Malware? referred to malicious computer software programmed to, in? Lia, gain and maintain unauthorized access to computers and to identify, store and export information from hacked computers. 17. script? was a server?side scripting language designed for web development but also used as a general-purpose pro grammng language. An unauthorized PHP script was an unauthorized program that could run undetected a hacked server. 18. ?Structured Query Language? was a computer programming language designed to retrieve and manage data stored in computer databases. 19. Injection Attacks? were methods of hacking into and gaining unauthorized access to computers connected to the internet. 20. ?Password hashes? were data strings generated when a passWord was passed through an algorithm. Passwords for network accounts were often stored on the network as a password hash as a security measure. 21. ?Brute force attacks? or ?bruting?. referred to one method for data. This method could be used to a password hash, revealing the password. 22. ?Phishing? referred to an attempt to gain unauthorized access to a'computer or computers by sending an email that appeared to be a legitimate communication ?om a trustworthy source, but contained malware or a link to download malware. 23. ?Short-selling? or ?selling short? was the selling of a stock that the seller . did not own. When a trader engaged in short-selling he or she was anticipating a decline in the share price. 24. A ?put option? gave the holder of the option the right, but not the obligation, to sell a specified amount of the underlying security at a speci?ed price within a speci?c time period. Generally, the holder of a put option anticipated that the price of the underlying security would decrease during a speci?ed amount of time. 25. A ?call option? gave the holder of the option the right, but not the obligation, to purchase a speci?ed amount of the underlying security at a Speci?ed price within a speci?c time period. Generally, the holder of a call option anticipated that the price of the underlying securityiwould increase during a speci?ed amount of time. 26. A ?Form was a form that the SEC required publicly-traded companies to use to notify investors of any material event that was important to the company?s shareholders. IV. The Fraudulent Hacking and Trading Scheme A. Overview 27. In or about and between February 2010 and August 2015, the defendants VITALY KORCHEVSKY, VLADISLAV KHALUPSKY, LEONID MOMOTOK and ALEXANDER GARKUSHA, together-with Co-Conspirator 1, CouConspirator 2, Co-Conspirator 3, Co-Conspirator 4, Co-Conspirator 5 and others, engaged in a scheme whereby they executed - and caused others to execute securities transactions in the Target Companies based in whole or in part on material, nonpublic information that was fraudulently obtained through unauthorized attacks on the computer networks of the Victim Newswires. The defendants, together with others, stole MNPI about the Target Companies, _which was in the form of con?dential press releases, by using sophisticated intrusion techniques, such as SQL injection and brute force attacks, and then traded in the Target Companies based on the stolen MNPI for substantial ?nancial gain. 28. The defendants and their co-conspirators were generally organized into three groups: the individuals, including Co?Conspirator 4 and Co?Conspirator 5, who used sophisticated intrusion techniques and stole MNPI from the Victim Newswires? computer networks from overseas lo cations such as Ukraine and Russia (collectively, the ?Hackers?); (ii) the individuals, including the defendants VITALY KORCHEVSKY, VLADISLAV KHALUPSKY, LEONID MOMOTOK, ALEXANDER GARKUSHA, Co?Conspirator and Co?Conspirator 2, who executed securities transactions based on the stolen MNPI (collectively, the ?Traders?); and the individuals, including Co-Conspirator 3, who communicated and coordinated between the Hackers and Traders (collectively, the ?Middlemen?). I 29. The MNPI stolen by the Hackers contained information relating to the Target Companies? camings, gross margins, revenues and other con?dential and material ?nancial information. Thus, the confidential press releases contained economically valuable information and the Victim Newswnes and Target Companies had a right to control the use of that information. The Target Companies provided the Victim Newswires with this MNPI, typically in press releases, which was then uploaded on the Victim Newswires? computer networks and disseminated to the public at the direction of the Target Companies. Until the designated distribution time, the Victim Newswires were contractually bound to keep the content of the press releases con?dential and non?public. I 30. The Target Companies? press releases were maintained on the Victim Newswires? computer networks for a limited period of time. Consequently, the Hackers stole the MNPI shortly after it was uploaded onto the Victim Newswires? computer networks and quickly made the MNPI available to the Traders, initially through the Middlemen, so that the Traders could engage in illegal securities transactions before the MNPI was released to the public (hereinafter referred to as ?inside the window trades?). In sum, in or about and between January 2011 and February 2014 alone, the defendants and their co?conspirators stole more than 100,000 press releases and executed approximately 1,000 inside the window trades in the Target Companies based on MNPI stolen from the Victim Newswires resulting in approximately $30 million in illegal pro?ts. The Hacking of the Victim Newswires 31. The Hackers, including Co-Conspirator 4 and Co?Conspirator 5, attempted to gain access to the Victim Newswires? computer networks to steal the Target Companies? MNPI using various methods, such as phishing attempts and the surreptitious in?ltration of servers the Victim Newswires leased from data storage providers. 32. In or about July 2010, the Hackers gained access to PR Newswire through the use of malware. The Hackers sent unauthorized PHP commands to the PR Newswire servers. Through these and other techniques, the Hackers could access press releases maintained on Newswire? 3 network from any internet?connected computer in the world. Once the Hackers accessed the PHP script, they were able to maneuver freely on PR Newswire?s computer network, including accessing the con?dential press releases of the Target Companies that used .PR Newswire. Web server logs recovered from the hacked PR Newswire servers show repeated and regular improper accesses to the PR Newswire servers. On or about October 10, 2012, ?Co?Conspirator 5 sent a message, in Russian, to an unidentified individual, which stated, ?I?m hacking prnewswirecom.? When PR Newswire identi?ed and removed malware that the Hackers had installed on its servers, an IP address associated with CoeConspirator 4 made several unauthorized attempts to regain access to the PR Newswire servers. 33. The Hackers also gained unauthorized access to Business Wire?s servers. Co-Conspirator 5 3 computer contained a ?le listing user IDS and associated hashed passwords for more than 200 emplOyees of Business Wire. On or about March 25 2012, in an internet chat between Co-Conspirator 4 and Co-Conspirator 5, Co?Conspirator 5 stated that he had successfully ?bruted? a number of hashed passwords. The next day, Co?Conspirator 5 sent Co-Conspirator 4 an electronic communication containing a link to malware that had been placed on Business Wire?s computer network. 34. Beginning in at least February 2010, the Hackers gained unauthorized access to press releases on Marketwired?s networks using a series of SQL injection attacks. For example, on or about and between April 24, 2012 and July 20, 2012, Co-Conspirator 4 sent SQL injection attack commands more than 390 times into Marketwired?s computer network and was able to steal more than 900 press releases, including press releases from some of the Target Companies. C. Sharing the Stolen MNPI 35. To execute the fraudulent scheme, the Hackers, Middlemen and Traders worked in concert and shared the fraudulently obtained MNPI from the Victim Newswires through, 1m interstate and international emails, telephone calls and internet chats. For example, a Gmail email account registered to and used by Co-Conspirator 2 exchanged numerous emails with a Gmail email account registered to and used by the defendant VITALY KORCHEVSKY. On or about April 26,? 2013, Co-Conspirator 2 sent an email to A KORCHEVSKY instructing him to sell their stock, per Co-Conspirator 1?s orders. In response, KORCHEVSKY stated that they ?got the numbers righ but that the marke ?s ?reaction [was] mixed.? ?In fact, around the time of this email exchange, the Traders began trading 12 stocks, specifically, ECHO, EHTH, CAMP, CENX, MCRI, PFPT, IKAN, GDI, ACO, CALX, MCRL and VRSN, with mixed results. I 36. On or about December 18, 2013, the defendant VLADISLAV KHALUPSKY sent an email from his Gmail email account to his Yahoo! email account attaching screenshots of an unreleaSecl native-file version of an Oracle Corporation (?Oracle?) Form 8K containing earnings and other ?nancial information for Oracle. 37. On or about January 3, 2014, Co?Conspirator 3 sent an email to Co-Conspirator 1 attaching ?ve images displaying information about upcoming unreleased press releases for U.S. publicly traded companies. On or about January 6, 2014, Co?Conspirator forwarded this email to the defendant ALEXANDER GARKUSHA. These images collectively contained information about the timing of press releases for more than 100 companies and the newswire service that would be issuing the press release. 38. In an effort to expand their fraudulent hacking and trading network, the defendants and their co?conspirators shared information on additional fraudulent schemes and attempted to recruit new traders and hackers through, inter ali_a, internet chats and emails. For example, between January 15, 2013 and January 20, 2013, the defendants VITALY KORCHEVSKY and VLADISLAV KHALUP SKY exchanged emails with Co?Conspirator and Co-Conspirator 3 in which they discussed a ?proprietary trading business? that involved a ?special daytrading strategy? that ?never los[t] money in the twelve months of 2012? and where the ?typical trader? is alleged to make ?a profit between $40,000 to $50,000? per month. D. Trading on Stolen MNPI 39. The defendants VITALY KORCHEVSKY, VLADISLAV KHALUP SKY and LEONID MOMOTOK, together with Co?Conspirato'r 1 and Co?Conspirator 2, coordinated their fraudulent inside the window trades. On or about October 8, 2013, Cb?Conspirator 3 Sent an email to Co-Conspirator with a blank subj eet line and attached a photograph of a printout of a spreadsheet that contained information about 18 US. publicly traded companies that were scheduled to issue press releases concerning earnings and other economically valuable 1, 10 information in October 2013 (the ?Wish List?). On. or about October 9, 2013, Co?Conspirator 1 forwarded this email to GARKUSHA. In October 2013, KORCHEVSKY, MOMOTOK and Co?Conspirator 1 executed inside the window trades on six of the 18 companies listed in spreadsheet, specifically, ALGN, AMD, PNRA, IN PR, VMW and GNTX. 40. . For example, the Wish List indicated that Marketwired would issue the ALGN press'relea'se on October 17, 2013. The press release was uploaded on Marketwired on I October 17, 2013 at approximately 1:28 AM and issued to the public later that day at approximately 4:00 PM. . Within this window, Co-COnspirator 1 bought approximately 91,000 shares of ALGN on October 17, 2013, beginning at approximately 12:34 PM. A little over two hours later, beginning at approximately 2:36 PM, the defendant VITALY KORCHEVSKY bought approximately 95,500 shares of ALGN. As a result of thisinside the window trading in ALGN based on, stolen-MNPI, KORCHEVSKY and Co~Conspirator 1 made approximately $1.4 million. 41. As another example, the Wish List indicated that Marketwired would issue the PNRA press release ?after market,? or after the stock market closed at 4:00 PM on October 22, 2013. The press release was uploaded on MarketWired on October 22, 2013 at approximately 9:04 AM and issued to the public later that day at approximately 4:05 Within this window, Co-Conspirator 1 sold short at least 29,000 shares of PNRA on October 22, 2013, beginning at approximately 2:04 PM. A little over an hour later, but still within the window, the defendant . LEONID MOMOTOK bought approximately 1,000 shares, 26,000 call options and 2,000 put options of PNRA, beginning at approximately 3 :18 PM. MOMOTOK was followed by the defendant VITALY KORCHEVSKY who sold short approximately 50,000 shares and purchased 100 put options of PNRA, beginning at approximately 3 :21 PM. As a result of this inside the 11 window trading in PNRA based on stolen MNPI, KORCHEVSKY, MOMOTOK and I Co-Conspirator 1 made approximately $950,000. 42. The timely coordination between the defendants and their co-conspirators was critical to the success of this fraudulent hacking and trading scheme that yielded more than $30 million in illegal proceeds. For example, on August 3, 2011, the DNDN press release was uploaded on PR Newswire at approximately 3:34 PM and issued to the public less than thirty minutes later at approximately 4:01 PM. Within this twenty-Even minute window, beginning at approximately 3:56 PM, the defendant VITALY KORCHEVSKY bonght 1,100 put options of DNDN. The next day, KORCHEVSKY sold all 1,100 put options for a pro?t of more than $2.3 million. Telephone records revealed that KORCHEV-SKY called Co-Conspirator 1?s business on August 2, 201 1, and again on August 3, 2011, before the DNDN press release was uploaded on PR . Newswire. On August 4, 2011, after KORCHEVSKY sold the put options, KORCHEVSKY placed a call to and received a call from Co~Conspirator 1?s business on two occasions. A few months later, in or about October 2011, through a series of intermediary transactions, KORCHEVSKY used $400,000 from the same brokerage account he used to execute the DNDN trade to purchase real estate in Glen Mills, Later that year, in or about December 2011, KORCHEVSKY used the balance of assets in this same brokerage account to purchase additional real estate. 7 43. As another example, on November 7, 2011, the TRAK press release was uploaded to PR Newswire at approximately 11:56 AM and issued to the public later that day at approximately 4:05 PM. Within the window, beginning at approximately 1:37 PM, the defendant VITALY KORCHEVSKY began buying 66,552 shares of TRAK. One minute later, beginning at approximately 1:3 8 PM, Co-Conspirator 1 began buying 94,420 shares of TRAK. A little over an 12 hour later, beginning at approximately 3 :49 PM, the defendant LEONID MOMOTOK began I buying 5,424 shares of TRAK. Telephone records revealed that MOMOTOK placed two . telephone calls to CofConspirator 1?s business atlle PM and 1:13 PM, approximately twenty-five minutes before Co-Conspirator began trading in TRAK, and received a telephone call from Co-Conspirator l?s business at 3 :34 PM, approximately ?fteen minutes before MOMOTOK began trading in TRAK. As a result of this inside the window trading in based on stolen MNPI, KORCHEVSKY, MOMOTOK and Co-Conspirator 1 made approximately $540,000. I i 44. In exchange for the stolen MNPI, the Traders paid the Hackers, 1m a percentage of the Traders? pro?ts from their inside the Window trades. To conceal their ties in this fraudulent scheme, the Traders wired their fraudulent trading proceeds to, 11g accounts in Estonia in the names of shell companies controlled by the Hackers and the Traders. The Traders and Hackers also shared access to the same brokerage accounts. For example, the IP address associated With Co-Conspirator 4freq?uently accessed brokerage accounts controlled by Co~Conspirator and Co?Conspirat'or 2 that were used to execute hundreds of inside the window trades. Additionally, Co?Conspirator and Co?Conspirator 2 shared login and password information for brokerage accounts that'they controlled with the defendant. VLADISLAV KHALUPSKY and an IP address associated with KHALUPSKY accessed these brokerage accounts on numerous occasions over the course of the conspiracy. 7 COUNT ONE (Conspiracy to Commit Wire Fraud) 45. The allegations contained in paragraphs one through forty-four are realleged and incorporated as if fully set forth in this paragraph. 13 46. In or about and between February 2010 and August 2015, both dates being approximate and inclusive, within the Eastern District of New York and elsewhere, the defendants VITALY KORCHEVSKY, VLADISLAV KHALUP SKY, LEONID MOMOTOK and ALEXANDER GARKUSHA, together with Co-Conspirator 1, Co-Conspirator 2, Co-Conspirator 3, Co?Conspirator 4, Co?Conspirator 5 and others, did knowingly and intentionally conspire to execute a scheme and arti?ce to defraud the Victim Newswires and the Target Companies, and to obtain money and property from the Victim Newswires and the Target Companies by means of materially false and fraudulent pretenses, representations and promises, and for the purpose of executing such scheme and arti?ce, to transmit and cause to be transmitted by means of wire communication in interstate and-foreign commerce, writings, signs, signals, pictures and sounds, contrary to Title 18, United States Code, Section 1343. A (Title 18, United States Code, Sections 1349 and 3551 et seq.) COUNT TWO (Conspiracy to Commit Securities Fraud) 47. The allegations contained in paragraphs one through forty-four are hereby realleged and incorporated by reference as if fully set forth in this paragraph. 48. In or about andbetween February 2010 and August 2015, both dates being approximate and inclusive, within the Eastern District of New York and elsewhere, the defendants VITALY KORCHEVSKY, VLADISLAV KHALUPSKY, LEONID MOMOTOK and ALEXANDER GARKUSHA, together with Co-Conspirator 1, Co-Conspirator 2, Co-Conspirator v3, Co?Conspirator 4, Co-Conspirator 5 and others, did knowingly and willfully conspire to use and employ manipulative and deceptive devices and contrivances, contrary to Rule 10b-5 of the-Rules and Regulations of the United States Securities and Exchange Commission, Title 17, Code of 14 Federal Regulations, Section 240.10b~5, by: employing devices, schemes and arti?ces to defraud; making untrue statements of material fact and omitting to state material facts. necessary in order to make'the statements made, in light of the circumstances under which they were made, not misleading; and engaging in acts, practices and courses of buSiness which would and did operate as a fraud and deceit upon investors and potential investors'in the Target Companies, in connection with the purchase and sale of investments in the Target Companies, directly and indirectly, by use of means and instrumentalities of interstate commerce and the mails, contrary to Title 15, United States Code, Sections 78j and 78ff. 49. In furtherance of the conspiracy and to effect its objects, within the Eastern District of New York and elsewhere, the defendants VITALY KORCHEVSKY, VLADISLAV KHALUP SKY, LEONID MOMOTOK and ALEXANDER GARKUSHA, together with Co?Conspirator l, Co-Conspirator 2, Co?Conspirator 3, Co-Conspirator 4, Co?Conspirator 5 and others, committed and caused to be committed, among others, the following: I OVERT ACTS a. On or about November 26, 2010, Co?Conspirator 3 sent an email to GARKUSHA that contained instructions on how to download the hacked press releases. b. On or about December 9, 2010, an email to a co?conspirator, an individual. whose identity is known to the Grand Jury, containing instructions on how to download the hacked press releases and advising how to conceal one?s IP address while viewing the hacked press releases. c. On or about May 23, 2012, MOMOTOK bought approximately 3,000 put options of HPQ stock at approximately 35 4 PM, which was between the time that the 15 press release was uploaded onto PR Newswire?s servers and the time that the press release was disclosed to the public. d. On or about January 15, 2013, Co-Conspirator 3 sent an email to KHALUP SKY discussing trading strategies designed to manipulate the price of stocks and stating that traders make ?a profit between $40,000 [and] $50,000? amonth.? i e. On or about April 26, 2013, KORCHEVSKY sent an email to Co-Conspirator 2 stating that they ?got the numbers righ but that the marke ?3 ?reaction [was] mixed? in response to instructions to sell the stock. I f. On or about December 18, 2013, KHALUPSKY sent an email from his Gmail email account to his Yahoo email account, which was registered in Brooklyn, New York, attaching an unreleased native file version of an Oracle press release. (Title 18, United States Code, Sections 371 and 3551 et seq.) COUNT THREE (Securities Fraud PR Newswire Hack) 50. The allegations contained in paragraphs one through forty-four are hereby realleged and incorporated by reference as if fully set forth in this paragraph. 51. In or about and between February 2010 and August 2015, both dates being approximate and inclusive, within the Eastern District of New York and elsewhere, the defendants VITALY KORCHEVSKY, VLADISLAV KHALUPSKY, LEONID MOMOTOK and ALEXANDER GARKUSHA, together with Co-Conspirator 1, Co-Conspirator 2, Co?Conspirator 3, Co?Conspirator 4, Co?Conspirator 5 and others, did knowingly and willfully use and employ I one or more manipulative and deceptive devices and contrivances, contrary to Rule_10b?5 of the Rules and Regulations of the United States Securities and Exchange Commission, Title 17, Code 16 of Federal Regulations, Section 240.10b?5, by: employing one or more devices, schemes and arti?ces to defraud; making one or more untrue statements of material fact and omitting to state - I one or more material facts necessary in order to make the statements made, in the light of the circumstances in which they were made, not misleading; and engaging in one or more acts, practices and courses of business which would and did operate as a fraud and deceit upon one or more investors or potential investors in the Target Companies that used PR Newswire, in connection with the purchases and sales of investments in the Target Companies that used PR Newswire, directly and indirectly, by use of means and instrumentalities of interstate commerce and the mails. (Title 15 ,United States Code, Sections 783' and 78ff; Title 18, United States Code, Sections 2 and 3551 _e_t COUNT FOUR (Securities Fraud Marketwired Hack) 52. . The allegations Contained in paragraphs one through forty?four are hereby realleged and incorporated by reference as if fully set forth in this paragraph. 53. . In or about and between February 2010 and August 2015, both dates being approximate and inclusive, within the Eastern District of New York and elsewhere, the defendants VITALY KORCHEVSKY, VLADISLAV KHALUPSKY, LEONID MOMOTOK and ALEXANDER GARKUSHA, together with Co?Conspirator l, Co?Conspirator 2, Co-Conspirator 3, Co?Conspirator 4, Co-Conspirator 5 and others, did knowingly and willfully use and employ one or more manipulative and deceptive devices and contrivances, contrary to Rule lOb?S of the Rules and Regulations of the United States Securities and Exchange Commission, Title 17, Code of Federal Regulations, Section by: employing one or more devices, schemes and 17 artifices to defraud; making one or more untrue statements of material fact and omitting to state one or more material facts necessary in order to make the statements made, in the light of the circumstances in which they were made, not misleading; and engaging in one or more acts, practices and courses of business which would and did Operate as a fraud and deceit upon one or more investors or potential investors in the Target Companies that used Marketwired, in connection with the purchases and sales of investments in the Target Companies that used Marketwired, directly and indirectly, by use of means and instrumentalities of interstate commerce and the mails. (Title 15, United States Code, Sections 78j and 78ff; Title 18, United States Code, SectiOns 2 and 3551 e: E1.) COUNT FIVE (Money Laundering Conspiracy) 54, The allegations-contained in paragraphs one through forty-four?are hereby A realleged and incorporated by reference as if fully set forth in this paragraph. 55. In or about and between February 2010 and August 2015, both dates being approximate and inclusive, within the Eastern District of New York and elsewhere, the defendants VITALY KORCHEVSKY, VLADISLAV KHALUPSKY, LEONID MOMOTOK and ALEXANDER GARKUSHA, together with Co-Conspirator l, Co-Conspirator 2, Co-Conspirator 3, Co?Conspirator 4, Co-Conspirator 5 and others, did knowingly and intentionally conspire to transport, transmit and transfer monetary instruments and funds from one or more places in the United States to one or more places outside the United States, with the intent to promote the carrying on of specified unlawful activity, to Wit: wire fraud, in violation of Title 18, United States Code, Section 1343, and fraud in the sale of securities, in violation of Title 15, United States Code, 18 Sections 783' and 78ff, contrary to Title 18, United States Code, Section 1956(a)(2)(A), and (ii) to conceal and disguise the nature, location, source, ownership and control of the proceeds of the speci?ed unlawful activities, contrary to Title 18, United States Code, Section (Title 18, United States Code, Sections 1956(h) and 3551 gt seq.) CRIMINAL FORFEITURE ALLEGATION AS TO COUNTS ONE THROUGH FOUR 56. The United States hereby gives notice to the defendants that, upon their conviction of any of the offenses charged in Counts One through Four, the United States will seek forfeiture in accordance with Title 18, United States Code, Section 981(a)(1)(C) and Title 28, United States Code, Section 2461(0), which require any person convicted of such offenses to forfeit any property, real or personal, constituting or derived from proceeds traceable to such offenses, including but not limited to all right, title and interest in: the real property and premises located at 1591 Meadow Lane, Glen Mills, 19342; the real property and premises located at 3 Skyline Drive, Glen Mills, 19342; the real property and premises located at 7 Skyline Drive, Glen Mills, 19342; the real property and premises located at 9 Blackhorse Lane, Media, 19063; the real property and premises located at 316 Willowbrook Road, Upper Chichester, 19061; the real property and premises located at 674 Cheyney Road, West Chester, 193 82 the real property and premises located at 1290 Samuel Road, West Chester, 19380; the real property and premises located at 1737 Graham Road, Macon, Georgia 31211; the real i property and premises located at 122-134 Lancaster'Avenue, Malvern, 19355; and the real property and premises located at 1801 East Kings Highway, Coatesville, 19320. 19 .5 7. If any of the above?described forfeitable property, as a result of any act or omission of the defendants: cannot be located upon the exercise of due diligence; has been transferred or sold to, or deposited with, a third party; (0) has been placed beyond the jurisdiction of the court; has been substantially diminished in value; or has been commingled with other property which cannot be divided without dif?culty; - it is the intent of the United States, pursriant to Title 21, United States Code, Section 853(p), to seek forfeiture of any other property of the defendants up to the 'value of the forfeitable property described in this forfeiture allegation. (Title 18, United States Code, Section Title 21, United States Code, Section 853(p); Title 28, United States Code, Section 2461(0)) CRIMINAL FORFEITURE ALLEGATION AS TO COUNT FIVE 58.. The United States hereby gives notice to the defendants that, upon their conviction of theoffense charged in Count Five, the government Will seek forfeiture in accordance with Title 18, United States Code, Section 982(a)(1), which requires any person convicted of such offense to forfeit all property, real or personal, involved in such offense, or any preperty traceable to such property, including but not limited to all right, title and interest in: the real property and premises located at 1591 Meadow Lane, Glen Mills, 19342; the real property and premises located at 3 Skyline Drive, Glen Mills, 19342; the real property and premises located at 7 Skyline Drive, Glen Mills, 19342; the real property and 20 premises located at 9 Blackhorse Lane, Media, 19063; the real property and premises located at 316 Willowbrook Road, Upper Chichester, 19061; the real property and premises located at 674 Cheyney Road, West Chester, 193 82; the real propertyand premises located at 1290 Samuel Road, West Chester, 19380; the real property and premises located at 1737 Graham Road, Macon, Georgia 31211; the real property and premises located at 122?134 Lancaster Avenue, Malvern, 19355; and the real property and premises located at 1801 East Kings ghway, Coatesvillethe above-described forfeitable property, as a result of any act or omission of the defendants: cannot be located upon the exercise of due diligence; has been transferred or sold to, or deposited with, a third party; (0) has been placed beyond the jurisdiction of the court; has been substantially diminished in value; or has been commingled With other cannot be divided without dif?culty; it is the intent of the United States, pursuant to Title 21, United. States Code, Section 853(p), to 21 seek forfeiture of any other property of the defendants up to the value of the forfeitable property described in this forfeiture allegation. (Title 18, United States Code, Section 982(a)(l); Title 21, United States Code, Section 853 A TRUE BILL ?f 9? FOREPERSON KEEN-1T. CURRIE ACTING UNITED STATES ATTORNEY EASTERN DISTRICT or NEW YORK 22 F. FORM DBD-34 No. JUN. 85 UNITED STATES DISTRICT COURT EASTERN District of YORK CRIMINAL DIVISION THE UNITED STATES OF AMERICA vs. VITALYKORCHEVSKY, et al., Defendants. INDICTMENT (T. 15, U.S.C., 78j(b) and 78ff; T. 18, U.S.C., 1349, 1956(h), 2 and 3551 e_t T. 21, U.S.C., 853(p); T. 28, 2461(0)) A true bill. A oreperson Filed inropen coi?t this day, of "0761],: Bail, Christopher A. Ott, Assistant US. Attorney (718) 254-6154 23