Google LLC v. Dmitry Starovikov

UNITED STATES DISTRICT COURT

FOR THE SOUTHERN DISTRICT OF NEW YORK

GOOGLE LLC,

Plaintiff,

v. Civil Action No. 1:21-cv-10260-DLC

DMITRY STAROVIKOV;

ALEXANDER FILIPPOV;

Does 1-15,

Defendants.

{PROPOSED} PRELIMINARY INJUNCTION ORDER

Plaintiff Google LLC has filed a complaint for injunctive and other relief to stop

Defendants Dmitry Starovikov and Alexander Filippov, and Does 1 through 15—

through their participation in, and operation of, the Glupteba Enterprise—from

continuing to control and operate a botnet of over a million devices, continuing to

distribute malware to infect new devices, and continuing to carry out their criminal

schemes,

Google filed a complaint alleging claims under: (1) the Racketeer Influenced

and Corrupt Organizations Act, 18 U.S.C. §§ 1962(c)-(d} (Count I); (2) the Computer

Fraud and Abuse Act, 18 U.S.C. § 1030 (Count II); (8) the Electronic Communications

Privacy Act, 18 U.S.C. § 2701 (Count IID; (4) the Lanham Act (Count IV); (5) and

common-law theories of unfair competition and unjust enrichment (Counts V—VI).

ECF No. 5. On December 7, 2021, this Court issued a temporary restraining order

and order for Defendant to show cause why a preliminary injunction should not issue.

ECF No. 8.

THE COURT HEREBY FINDS THAT:

Jurisdiction and Venue

1. This Court has federal-question jurisdiction over Google’s claims under

RICO, the Computer Fraud and Abuse Act, the Electronic Communications Privacy

Act, and the Lanham Act under 28 U.S.C, § 1331. This court also has jurisdiction over

the Lanham Act and related state and common law unfair competition claims under

28 U.S.C. § 1388, and 15 US.C. § 1121. This court has supplemental jurisdiction over

the state-law claims under 28 U.S.C. § 1867.

2, This Court has personal jurisdiction over the Defendants because:

a. The Defendants distribute malware to Google users in this

district and within New York state;

b. The Defendants send commands to infected user computers in

this district and within New York state to carry out their illicit schemes;

C. Google’s complaint and moving papers demonstrate that the

Defendants undertook these activities intentionally with knowledge that their

actions would cause harm to users in New York and cause Google harm in New

York. Google does business in New York and has done business in New York

for many years.

3. Venue is proper in this judicial district under 28 U.S.C. § 1391(c)

because Defendants are not residents of the United States and may be sued in any

judicial district. Venue is also proper in this judicial district under 28 U.S.C.

§ 1391(b) and 18 U.S.C. § 1965 because a substantial part of the events or omissions

giving rise to Google’s claims occurred in this judicial district, because a substantial

part of the property that is the subject of Google’s claims is situated in this judicial

district, because a substantial part of the harm caused by Defendants has occurred

in this judicial district, and because Defendants transact their affairs in this judicial

district. Moreover, Defendants are subject to personal jurisdiction in this district and

no other venue appears to be more appropriate.

4, The complaint pleads facts with the specificity required by the Federal

Rules and states claims against Defendants for violations of the Racketeer Influenced

and Corrupt Organizations Act (RICO), 18 U.S.C. §§ 1962(c)-(d) (Count 1); the

Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030 (Count I), the Electronic

Communications Privacy Act (ECPA), 18 U.S.C. § 2701 (Count IID, Lanham Act

(Count IV), and unfair competition and unjust enrichment (Counts V—-VI).

Preliminary Injunction Order Factors

The Court finds that Google has established each of the factors required for a

preliminary injunction: (1) irreparable harm; (2) a likelihood of success on the merits

or a substantial question as to the merits; (3) the balance of hardships tips in Google’s

favor; and (4) a preliminary injunction serves the public interest. Benihana, Inc. v,

Benihana of Tokyo, LLC, 784 F.3d 887, 895 (2d Cir. 2015); see also Sterling v.

Deutsche Bank Nat'l Tr. Co. as Trustees for Femit Tr. 2006-FF6, 368 F. Supp. 3d 728,

727 (S.D.N.Y. 2019) (“The standard[s] for granting a temporary restraining order and

.

a preliminary injunction pursuant to Rule 65 of the Federal Rules of [Civil] Procedure

are identical.”).

Irreparable Harm

5. Google has established that it will suffer immediate, irreparable harm

if this Court denies its request for a preliminary injunction. In particular, it has

shown that the Defendants—through their participation in, and operation of, the

Glupteba Enterprise—have threatened the security of the internet, including Google

platforms, by transmitting malware through the internet to configure, deploy, and

operate a botnet. The Enterprise has distributed malware on devices of Google users,

compromising the security of those devices and continues to issue commands to those

devices to carry out criminal activities, such as selling access to Google user accounts

and selling fraudulent credit cards to use on those accounts.

6. The Defendants control a botnet that has infected more than one million

devices. At any moment, the botnet’s extraordinary computing power could be

harnessed for other criminal schemes. Defendants could, for example, enable large

ransomware or distributed denial-of-service attacks on legitimate businesses and

other targets. Defendants could themselves perpetrate such a harmful attack, or they

could sell access to the botnet to a third-party for that purpose,

7, In addition, Defendants’ conduct is infringing Google’s trademarks,

injuring Google’s goodwill, and damaging its reputation by creating confusion as to

the source of the Ghipteba malware because the Defendants used a domain that

infringes Google’s YouTube mark to distribute malware, That constitutes irreparable

harm,

Likelihood of Success on the Merits

8. Google has shown at a minimum that its complaint presents a

substantial question as to each of its claims, and indeed that it is likely to succeed on

the merits of its claims.

9. CFAA. Google has shown a likelihood of success on the merits of its

claim that Defendants violated and continue to violate the Computer Fraud and

Abuse Act. The CFAA prohibits, among other things, intentionally accessing a

protected computer, without authorization, and thereby obtaining information from

that computer. See 18 U.S.C. § 1030(a)(2)(C). Defendants intentionally accessed

thousands of users’ computers operating in interstate commerce through the internet,

without authorization, to infect them with malware. They did so to obtain

information such as account credentials and URL history, which they have then sold

to others. This has affected well over ten computers within a one-year span and

resulted in damages significantly in excess of $5,000.

10. ECPA. Google has shown a likelihood of success on the merits of its

claim that Defendants violated and continue to violate the Electronic

Communications Privacy Act. The ECPA prohibits, among other things,

“intentionally access[ing] without authorization a facility through which an electronic

communication service is provided” to “obtainf], alter[], or prevent[] authorized access

to a wire or electronic communication while it is in electronic storage.” 18 U.S.C.

gr

§ 2701(a). The Defendants deliberately break into the accounts of Google users and

thereby obtain unauthorized access to emails and other communications stored on

Google servers. They do so with the intent to acquire user credentials and other

sensitive content.

11. Lanham Act. Google has shown a likelihood of success on the merits of

its claim that Defendants violated the Lanham Act because they used Google’s

YouTube mark—a valid, protectable, registered and incontestable trademark-—in

commerce in a manner likely to cause confusion among consumers by operating a

website that used the YouTube mark in the domain name and on the landing page.

See 15 U.S.C. § 1114(1). In addition, the Lanham Act prohibits “false designations of

origin” that are likely to cause confusion as to the “origin, sponsorship, or approval”

of a product or service. 15 U.S.C. § 1125(a)(1\(A). It also makes unlawful a false or

misleading representation, including a false designation of origin, that “in

commercial advertising or promotion, misrepresents the nature, characteristics,

qualities, or geographic origin of . . . goods, services, or commercial activities.” 15

U.S.C. § 1125(a)(1)(B). The Defendants deceive internet users by falsely marketing

their malware as software for downloading videos from YouTube, for their own profit,

to the detriment of Google and Google’s trademarks. By showing a likelihood of

success on the merits of their Lanham Act claims, Google is also entitled to a

presumption of irreparable harm. 15 U.S.C, § 1116(a).

12. RICO. Google has algo shown a likelihood of success on the merits of its

claims that Defendants have violated and continue to violate the RICO statute.

cc

a. Google has shown that each Defendant is an active

participant in the operation and management of the Glupteba botnet

with direct ties to a C2 server previously associated with proxying

activity on infected machines. Defendant Dmitry Starovikov is an

administrator of Voltonwork.com. Additionally, the secondary email

address for the Google Workspace Voltronwork.com account, is an email

containing Dmitry’s name under the Trafspin domain. Defendant

Alexander Filippov is another co-conspirator who has email accounts

associated with Google Workspace accounts related to Voltronwork.com,

Dont.farm, and Undefined.team.

b. Google has established that Defendants have formed an

enterprise. The Defendants share a common purpose to spread malware

to build a botnet that is deployed for numerous criminal schemes for

profit. Defendants work together to accomplish this purpose, each

playing a role as described above.

C. Google has established that Defendants have engaged in a

pattern of racketeering activity. The predicate acts include three

separate violations of the Computer Fraud and Abuse Act, 18 U.S.C.

§ 1030(a)(5)(A)., Defendants have violated and continue to violate the

Computer Fraud and Abuse Act, 18 U.S.C. § 1030(a)(5)(A), resulting in

damage as defined in § 1030(c)(4)(A)@)(VD, by infecting protected

computers with malware, transmitting to such protected computers

programs designed to carry out their schemes, and transmitting to such

protected computers commands to infected computers. For instance,

Defendants have intentionally caused damage to “protected computers”

by transmitting malware “droppers” to those computers, thereby

impairing the integrity of their systems and information, and allowing

Defendants to access those systems. They have also transmitted

malware modules to protected computers through the internet. And

they have transmitted commands to protected computers through the

internet, thereby causing damage to those computers and enabling

Enterprise to utilize these computers in its criminal schemes. Google is

also likely to succeed on the merits of showing that the Defendants have

committed predicate acts including violations of the federal wire fraud

statute, 18 U.S.C. § 1348, federal identity fraud statute, 18 U.S.C.

§ 1028, and federal access device fraud statute, 18 U.S.C. § 1029.

d. Google has suffered injury to its business or property as a

result of these predicate offenses.

13. Google has also shown a likelihood of success on the merits of its New

York common law claims for tortious interference with business relationships and

unjust enrichment,

Balance of the Hardships

14, The equities also favor a temporary restraining order. The criminal

enterprise is defrauding consumers, and injuring Google. There is no countervailing

oO

factor weighing against a preliminary injunction: there is no legitimate reason why

Defendants should be permitted to continue to disseminate malware and manipulate

infected computers to carry out criminal schemes.

Public Interest

15. Google has shown that the public interest favors granting a preliminary

injunction.

16. Every day that passes, the Defendants infect new computers, steal more

account information, and deceive more unsuspecting victims, Protection from

malicious cyberattacks and other cybercrimes is strongly in the public interest,

17. And the public interest is clearly served by enforcing statutes designed

to protect the public, such as RICO, the CFAA, the ECPA, and the Lanham Act.

PRELIMINARY INJUNCTION ORDER

IT IS HEREBY ORDERED that Defendants, any of their officers, agents,

servants, employees, attorneys, and all others in active concert or participation with

them, who receive actual notice of this Order by personal service or otherwise

including via email (“Restrained Parties”), are restrained and enjoined from,

anywhere in the world:

1. Intentionally accessing and sending malicious code to Google and the

protected computers of Google’s customers, without authorization;

2. Sending malicious code to configure, deploy, and operate a botnet;

3. Attacking and compromising the security of the computers and

networks of Google’s users;

Oo

A, Stealing and exfiltrating information from computers and computer

networks;

5, Creating websites that falsely indicate that they are associated with

Google, YouTube, or any other Google affiliate, through use of Google’s YouTube mark

and/or other false and/or misleading representations;

6. Configuring, deploying, operating, or otherwise participating in or

facilitating the botnet described in the Google’s moving papers, including through any

component or element of the botnet in any location;

7. Delivering malicious code designed to steal credentials and cookies;

8. Monitoring the activities of Google or Google’s customers and stealing

information from them;

9. Selling access to the accounts of Google’s customers,

10, Corrupting applications on victims’ computers and networks, thereby

using them to carry out the foregoing activities;

11. Offering or promoting credit cards to others for use in purchasing

services from Google;

12. Misappropriating that which rightfully belongs to Google, Google’s

customers and users, or in which Google has a proprietary interest; and

18. Using, linking to, transferring, selling, exercising control over, or

otherwise owning or accessing domains connected with the Enterprise, its activities,

or its use of the botnet;

117

14. Using, transferring, exercising control over, or accessing any accounts

used in the transfer of money or electronic currency, including cryptocurrency, or in

the processing of card-based transactions, as a means to further Defendants’ unlawful

schemes;

15. Using and infringing Google’s trademarks, including specifically

Google’s YouTube mark;

16. Using in connection with Defendants’ activities, products or services

with any false or deceptive designation, representations or descriptions of Defendants

or of their activities, whether by symbols, words, designs or statements, which would

damage or injure Google or its customers or users or give Defendants an unfair

competitive advantage or result in deception of consumers;

17, Acting in any other manner which suggests in any way that Defendants’

activities, products or services come from or are somehow sponsored by or affiliated

with Google, or passing off Defendants’ activities, products or services as Google’s;

and

18. Undertaking any similar activity that inflicts harm on Google, Google’s

customers, or the public.

Upon service via mail, email, or text, the Defendants, and other Restrained

Parties shall be deemed to have actual notice of the issuance and terms of the

preliminary injunction order, and any act by any of the Restrained Parties in violation

of any of the terms of the preliminary injunction order may be considered and

prosecuted as contempt of Court.

aq

IT IS FURTHER ORDERED that Google may serve this Order on the

persons and entities providing services, including domain name registrars, name

servers, web hosting services, and other internet service providers, relating to the

domains and JP addresses identified by Google as connected to the Enterprise, its

activities, or its botnet, requesting that those persons and entities take reasonable

best efforts to implement the following actions:

1. Take reasonable steps to identify incoming and/or outgoing Internet

traffic on their respective networks that originates and/or is being sent from and/or

to such identified domains and IP addresses.

2, Take reasonable steps to block incoming and/or outgoing Internet traffic

on their respective networks that originate and/or are being sent from and/or to such

identified domains and IP addresses except as explicitly provided for in this Order;

3. Take other reasonable steps to block such traffic to and/or from any

other IP addresses or domains to which Defendants or Defendants’ representatives

moved the botnet infrastructure, to ensure that Defendants cannot use such

infrastructure to control the botnet;

A, Disable completely the computers, servers, electronic data storage

devices, software, data or media assigned to or otherwise associated with such

identified domains and IP addresses and make them inaccessible from any other

computer on the Internet, any internal network, or in any other manner, to

Defendants, Defendants’ representatives, and all other persons, except as otherwise

ordered herein;

49

5. Completely, and until further order of this Court, suspend all services

to Defendants or Defendants’ representatives or resellers associated with such

identified domains and IP addresses;

6. Refrain from providing any notice or warning to, or communicating in

any way with Defendants or Defendants’ representatives until the steps required by

this Order are executed in full, except as necessary to communicate with hosting

companies, data centers, Google, or other ISPs to execute this Order;

7. Not enable, and take all reasonable steps to prevent, any circumvention

of this Order by Defendants or Defendants’ representatives associated with such

identified domains and IP addresses, inchiding without limitation to enabling,

facilitating, and/or allowing Defendants or Defendants’ representatives or resellers

to rent, lease, purchase, or otherwise obtain other domains and IP addresses

associated with your services;

8. Preserve, retain, and produce to Google all documents and information

sufficient to identify and contact Defendants and Defendants’ representatives

operating or controlling such identified domains and IP addresses, including any and

all individual or entity names, mailing addresses, e-mail addresses, facsimile

numbers, telephone numbers or similar contact information, including but not

limited to such contact information reflected in billing, usage, access and contact

records and all records, documents and logs associated with the use of or access to

such domains and IP addresses;

39

9, Provide reasonable assistance in implementing the terms of this Order

and take no action to frustrate the implementation of this Order;

10. Completely preserve the computers, servers, electronic data storage

devices, software, data or media assigned to or otherwise associated with such

identified domains and IP addresses, and preserve all evidence of any kind related to

the content, data, software or accounts associated with such domains, IP addresses,

and computer hardware; and

11. IT IS FURTHER ORDERED, that in accordance with Rule 64 of the

Federal Rules of Civil Procedure, 15 U.S.C. § 1116(a), Plaintiff's request for an

accounting of profits pursuant to 15 U.S.C. § 1117, and this Court’s inherent equitable

power to issue provisional remedies ancillary to its authority to provide final

equitable relief, Defendants and their agents, representatives, successors or assigns,

and all persons acting in concert or in participation with any of them, and any banks,

savings and loan associations, credit card companies, credit card processing agencies,

merchant acquiring banks, financial institutions, or other companies or agencies that

engage in the processing or transfer of money and/or real or personal property, who

receive actual notice of this order by personal service or otherwise, are, without prior

approval of the Court, preliminarily enjoined from transferring, disposing of, or

secreting any money, stocks, bonds, real or personal property, or other assets of

Defendants or otherwise paying or transferring any money, stocks, bonds, real or

personal property, or other assets to any of the Defendants, or into or out of any

accounts associated with or utilized by any of the Defendants.

TA

12. IT 18 FURTHER ORDERED that, until further order of this Court,

Google may serve this Order upon such persons as Google determines are necessary

to address and enjoin activity associated with domains and IP addresses identified

by Google as being used in connection with the Enterprise, its activities and its

botnet, without seeking further leave of the court.

Security for Preliminary Injunction Order

IT IS FURTHER ORDERED that Google’s submission of the $75,000 bond

to the Clerk satisfies the requirements of this Court’s temporary restraining order.

See ECF 8 at 16. The Clerk is directed to accept the bond. No additional bond is

necessary.

Status Report

IT IS FURTHER ORDERED that Google shall file a status report on

January 31, 2022.

So ordered.

ft (-,Aeal

United States District Judge

AK