Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Ukrainian national Mark Sokolovsky was sentenced on December 18, 2024, to 60 months in federal prison after pleading guilty to one count of conspiracy to commit computer intrusion tied to Raccoon Infostealer. The sentence was not five additional years beginning on sentencing day: the government’s sentencing recommendation included credit for time he had already spent in Dutch and U.S. custody.
What was Mark Sokolovsky convicted of?
The U.S. Department of Justice said Sokolovsky conspired to operate Raccoon Infostealer as a malware-as-a-service operation: a criminal service that customers could rent and use to steal data. He pleaded guilty on October 7, 2024, to one count of conspiracy to commit computer intrusion, and received a 60-month federal sentence on December 18, 2024.
Sokolovsky had been indicted in 2021 on multiple counts, but the plea and sentence described by DOJ concern one count. An indictment contains allegations; the guilty plea and resulting sentence concern the offense to which he pleaded guilty.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →What was Raccoon Infostealer and how did it work?
According to DOJ, customers paid approximately $200 per month in cryptocurrency to lease access to Raccoon Infostealer. They used lures such as phishing emails to get the malware onto victims’ computers. It could collect login credentials, financial information and other personal records. Stolen information could then be used to commit financial crimes or sold on cybercrime forums.
#1 Best Overall
Sokolovsky’s alleged role in the service
The government’s sentencing memorandum described Sokolovsky as a key administrator who managed supporting servers and worked with co-conspirators to maintain and improve the service. The filing said the version he administered stopped operating after his March 2022 arrest and the disruption of its international infrastructure.
Raccoon case timeline
| Date | Milestone |
|---|---|
| March 2022 | Dutch authorities arrested Sokolovsky. The FBI and law-enforcement partners in Italy and the Netherlands disrupted infrastructure supporting the then-existing version of Raccoon. |
| February 2024 | Sokolovsky was extradited from the Netherlands to the United States. |
| October 7, 2024 | He pleaded guilty to one count of conspiracy to commit computer intrusion. |
| December 18, 2024 | DOJ announced his 60-month sentence. |
How many people and credentials were affected?
Government announcements and court filings use different measures. Victims are people; credentials and identification records are pieces of stolen data. The figures should not be treated as interchangeable, and none establishes a complete count of everyone exposed.
| Measure | Figure and attribution |
|---|---|
| Victims | More than two million victims worldwide, according to the government’s 2024 sentencing memorandum. The filing said investigators could not calculate the full number because of the nature of the malware and underground market. |
| Credentials and identification data collected | More than 50 million unique credentials and forms of identification, according to the FBI figure in the U.S. Attorney’s Office for the Western District of Texas’s 2024 extradition announcement. That announcement cautioned that the government did not believe it possessed all stolen data. |
| User credentials compromised | More than 52 million, according to FBI San Antonio Special Agent in Charge Aaron Tapp in DOJ’s 2024 sentencing announcement. This is a credential figure, not a count of people. |
| Restitution and forfeiture | At least $910,844.61 in restitution and $23,975 in forfeiture, according to the U.S. Attorney’s Office for the Western District of Texas’s 2024 sentencing announcement. |
The amounts and counts reflect what authorities reported from their investigation and collected data; they do not mean the government had a complete record of every stolen item or affected person.
How to check whether your email was exposed to Raccoon
DOJ’s victim-assistance page links to the FBI’s Raccoon resource, which the FBI described as a way to check whether an email address appears in the U.S. government’s repository. The extradition announcement expressly cautioned that the United States did not possess all data stolen by the malware. A match therefore indicates that the address appears in the repository, not that an account is currently compromised; no match cannot prove that the address was never exposed.
If the lookup indicates exposure, treat it as a reason to secure accounts associated with that address. Change reused or exposed passwords, use unique passwords for important accounts, and enable multifactor authentication where available. Review account activity and recovery settings for unexpected changes. If an account shows unauthorized activity, use that service’s official recovery and security process.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What can you do to reduce the risk from stolen credentials?
Multifactor authentication (MFA) adds another check beyond a password. CISA says MFA makes it harder for an attacker to access an account when a password has been compromised, and identifies phishing-resistant authentication as a stronger approach. FIDO/WebAuthn passkeys and physical security keys are examples, but support varies by service and account.
- Use a unique password for each important account, especially email, financial services and cloud storage.
- Enable MFA on accounts that support it. Prefer phishing-resistant methods, such as FIDO/WebAuthn or a security key, when the service offers them and they fit your needs.
- Check recent sign-ins, connected devices, forwarding rules and recovery details on accounts where you suspect misuse.
MFA can reduce the chance that a stolen password alone is enough to access an account. It does not erase data already stolen or establish that a computer is free of malware. The official case materials do not establish that a particular consumer cleanup product detects or removes Raccoon.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsQuick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
