Fedir Hladyr

FIN7 — also known as the Carbanak Group and the Navigator Group — is a sophisticated criminal hacking organization that has been targeting point-of-sale systems at restaurants, hotels, retailers, and other businesses since approximately 2012-2013. In terms of documented damage and operational sophistication, it is one of the most significant cybercrime organizations ever prosecuted in the United States.

The organization compromised more than 100 companies across the United States — including well-known restaurant chains, hotel brands, and retail operations — and stole tens of millions of credit and debit card numbers. Damage attributed to FIN7 was estimated at more than $3 billion by the DOJ at his sentencing. [SOURCE: DOJ, April 16, 2021]

Nobody builds that operation alone. FIN7 had attackers who sent the spear-phishing emails. It had malware developers who built the tools. It had people who handled the card data once it was extracted. And it had people who ran the infrastructure — the servers, the encrypted communications, the technical backbone that kept the operation operational and kept law enforcement out.

Fedir Hladyr was one of those people. A Ukrainian national, he served as a system administrator and network manager for FIN7 — managing the encrypted communications channels, maintaining the server infrastructure, and coordinating the organization's departments. He was described by the DOJ as a high-level manager and systems administrator. [SOURCE: DOJ W.D. Wash. sentencing release, April 16, 2021]

He was arrested in Dresden, Germany, in January 2018. He was extradited to the Western District of Washington. He pleaded guilty in September 2019 to conspiracy to commit wire fraud and conspiracy to commit computer hacking. He was sentenced on April 16, 2021 to 10 years in federal prison and $2.5 million in restitution. [SOURCE: DOJ]

Point-of-sale systems — the machines that process card payments at restaurants, hotels, and retailers — are the attack surface. FIN7's method: send a carefully crafted spear-phishing email to an employee at a target company, often a restaurant manager or HR department, containing a document or attachment with embedded malware.

When the attachment is opened, the malware installs itself and moves laterally through the company's network to reach the POS terminals. Once on the POS terminals, the malware captures payment card data as customers swipe or insert their cards — the same moment-of-transaction harvesting approach that the Drinkman crew (Case 036) used against Heartland and other targets.

The difference: FIN7's operation was vertically integrated and long-running. Multiple departments handled different aspects of the attack — the initial phishing, the network infiltration, the data extraction, the monetization. Hladyr's systems-administration function was what kept the communication and coordination among these departments possible and secure. [SOURCE: DOJ]

FIN7 targeted companies that process large volumes of payment card transactions and are not financial institutions — restaurants and hotels are attractive because their POS security tends to be less robust than bank infrastructure. The card data extracted goes to carding markets where it is sold and used to generate fraudulent transactions.

The DOJ described Hladyr at sentencing as having 'worked to manage and direct all departments' within FIN7. This was not a mid-level technical role; it was organizational management of the group's infrastructure. He controlled encrypted communications platforms, managed server deployment, and coordinated the various functional units. [SOURCE: DOJ sentencing press release, April 16, 2021]

This distinction matters for the series: Hladyr's case, like Drinkman's (Case 036), demonstrates that criminal networks have organizational charts. The person arrested is not always the person who executed the attack. The person who managed the infrastructure that made the attacks possible is also criminally responsible for the outcomes. The 10-year sentence reflects that the organizational function is punishable even when the defendant did not personally write the malware or steal a single card.

FIN7 is still active. The organization did not cease to exist when Hladyr was arrested, or when several other members were arrested and convicted in related proceedings. Criminal organizations — like legitimate ones — continue operating when employees are removed, as long as the organizational function continues. This is the difference between arresting a Madoff (who was the whole scheme) and arresting a network member (who was one node in a structure that persists).