Defendants Work Together To Operate The Zeus Botnets
69. Plaintiffs are informed and believe and thereupon allege that the common code and characteristics of the Zeus, Ice-IX, and SpyEye botnets, and evidence regarding specific activities of the Defendants, demonstrate that the Zeus Botnets are controlled by a number of Defendants acting in concert. Upon information and belief, John Does 1-3, the creators of the botnet code, work together with the purchasers, developers and other sellers of the Zeus Botnet code in a continuous and coordinated manner to control, operate, distribute, and maintain the Zeus Botnets. Upon information and belief, the malicious software that Defendants install on end-user machines all share common code and characteristics, and have evolved over time to more closely resemble one another. The three botnets are all available for sale on the same "underground" internet forums, and are all provided with similar tools and utilities.
70. John Does 4-39 have purchased the Zeus Botnet code and, in concert with the creators of the code, are operating the Zeus Botnets. Some of the defendants have specialized roles, including: (1) customizing the code, (2) creating "web inject" code, a delivery mechanism to introduce the botnet code onto victim computers, (3) recruiting "money mules" as intermediaries to create fraudulent bank accounts to which stolen funds are directed and withdrawn, and (4) acquiring domain names and IP addresses to host the command and control servers. The common characteristics of botnet code used by these Defendants indicate that they are controlled by the same group of Defendants, who are acting in concert. Plaintiffs' investigation reveals that the Defendant creators of the botnet code work together with these Defendant operators of the botnets in a continuous and coordinated manner to control, operate, distribute, and maintain the Zeus Botnets.
The Zeus Racketeering Enterprise
71. Upon information and belief, John Does 1-39 constitute a group of persons associated together for a common purpose of engaging in a course of conduct, as part of an ongoing organization, with the various associates functioning as a continuing unit. The Defendants' enterprise has a purpose, with relationships among those associated with the enterprise, and longevity sufficient to permit those associates to pursue the enterprise's purpose.
72. The Zeus Racketeering Enterprise has existed since at least October of 2010, when John Doe 1 and John Doe 3 merged their respective botnet operations into a single, consolidated global credential stealing botnet. John Doe 2 joined and began participating in the Zeus Enterprise at an unknown date prior to fall of 2011. Other Defendants identified as John Does 4-39 joined and began participating in the Zeus Enterprise at various times thereafter.
73. The Zeus Racketeering Enterprise has continuously and effectively carried out its purpose of developing and operating a global credential stealing botnet operation since that time, and will continue to do so absent the judicial relief that Plaintiffs request.
74. Both the purpose of the Zeus Racketeering Enterprise and the relationship between the Defendants is proven by: (1) the consolidation of the original Zeus botnet and the SpyEye botnet; (2) the subsequent development and operation of the enhanced Ice-IX botnet; and (3) Defendants' respective and interrelated roles in the sale, operation of, and profiting from the Zeus Botnets in furtherance of Defendants' common financial interests.
75. Upon information and belief, Defendants have conspired to, and have, conducted and participated in the operations of the Zeus Racketeering Enterprise through a continuous pattern of racketeering activity as set forth herein. Each predicate act is related to and in furtherance of the common unlawful purpose shared by the members of the Zeus Racketeering Enterprise. These acts are continuing and will continue unless and until this Court grants Plaintiffs' request for a temporary restraining order.
76. Upon information and belief, Defendants have conspired to, and have, knowingly and with intent to defraud trafficked in thousands of unauthorized access devices in the form of stolen passwords, bank account numbers and other account login credentials through the Zeus Botnets created and operated by Defendants. 17
77. As set forth in detail herein, Defendants have used the Zeus Botnets to steal, intercept and obtain this access device information from tens of thousands of individuals using falsified web pages, and have then used these fraudulently obtained unauthorized access devices to steal millions of dollars from individuals' accounts.
78. Upon information and belief, Defendants have also conspired to, and have, knowingly and with intent to defraud, possessed, and do possess, thousands of such unauthorized access devices fraudulently obtained as described herein.
79. Upon information and belief, Defendants have conspired to, and have, knowingly and with intent to defraud, effected transactions with the stolen unauthorized access devices to receive millions of dollars in payment from individuals' bank accounts.
80. Upon information and belief, Defendants have conspired to, and have, executed a scheme to defraud scores of financial institutions by enabling members of the Zeus Racketeering Enterprise to fraudulently represent themselves as specific bank customers, thereby enabling them to access and steal funds from those customer accounts.
81. Upon information and belief, Defendants have further conspired to, and have, orchestrated the dispatch of "money mules" to the United States for the purpose of opening bank accounts using fraudulent identification documents, and then using these fraudulently obtained bank accounts, to receive and withdraw the funds stolen from legitimate bank customers.
82. Each of the foregoing illegal acts were conducted using interstate ACH and/or interstate and/or foreign wires as described herein, and therefore affected interstate and/or foreign commerce.