The opinion
UNITED STATES DISTRICT COURT
FOR THE SOUTHERN DISTRICT OF NEW YORK
GOOGLE LLC,
Plaintiff,
v. Civil Action No. 1:21-cv-10260-DLC
DMITRY STAROVIKOV;
ALEXANDER FILIPPOV;
Does 1-15,
Defendants.
FINAL DEFAULT JUDGMENT AND ORDER
FOR PERMANENT INJUNCTION
This matter came before the Court on Plaintiff’s Google LLC (“Google”) Motion
for Default Judgment and Entry of Permanent Injunction. The Court finds that
Google has established the elements of its claims under: the Racketeer Influenced
and Corrupt Organizations Act (“RICO”), 18 U.S.C. §§ 1962(c)–(d); the Computer
Fraud and Abuse Act (“CFAA”), 18 U.S.C. § 1030; the Electronic Communications
Privacy Act (“ECPA”), 18 U.S.C. § 2701; the Lanham Act, 15 U.S.C. §§ 1114, 1125;
tortious interference with business relations; and unjust enrichment.
Defendants John Does 1–15 (“Doe Defendants”) have been properly served but
failed to answer, plead, or otherwise defend this Action, and the prerequisites for a
permanent injunction have all been met. Google is therefore entitled to default
judgment under Rule 55(b) and a permanent injunction pursuant to Rule 65 of the
Federal Rules of Civil Procedure, 15 U.S.C. § 1116(a), and 28 U.S.C. § 1651(a) (the
All-Writs Act).
THE COURT HEREBY FINDS THAT:
Jurisdiction and Venue
1. This Court has federal-question jurisdiction over Google’s claims under
the Racketeer Influenced and Corrupt Organizations Act, the Computer Fraud and
Abuse Act, the Electronic Communications Privacy Act, and the Lanham Act under
28 U.S.C. § 1331. This Court also has jurisdiction over the Lanham Act and related
state and common law unfair competition claims under 28 U.S.C. § 1338 and 15
U.S.C. § 1121, respectively. This court has supplemental jurisdiction over the state-
law claims under 28 U.S.C. § 1367.
2. This Court has personal jurisdiction over the Doe Defendants because:
a. Doe Defendants distribute malware to Google users in
this district and within the state of New York;
b. Doe Defendants send commands to infected user
computers in this district and within New York to
carry out illicit schemes;
c. Google’s Complaint and supporting papers
demonstrate that the Doe Defendants undertook
these activities intentionally with knowledge that
their actions would cause harm to users in New York,
and cause Google harm in New York; and
d. Google does business in New York and has done
business in New York for many years.
3. Venue is proper in this judicial district under 28 U.S.C. § 1391(c)
because Doe Defendants are not residents of the United States and may be sued in
any judicial district. Venue is also proper in this judicial district under 28 U.S.C. §
1391(6) and 18 U.S.C. § 1965 because: a substantial part of the events or omissions
giving rise to Google’s claims occurred in this judicial district; a substantial part of
the property that is the subject of Google’s claims is situated in this judicial district;
a substantial part of the harm caused by Doe Defendants has occurred in this judicial
district; and Doe Defendants transact their affairs in this judicial district. Moreover,
Doe Defendants are subject to personal jurisdiction in this district and no other venue
appears to be more appropriate.
Default Judgment
4. Doe Defendants were properly served with the summons, complaint,
and the other pleadings in this Action. Doe Defendants received adequate notice of
this Action, in satisfaction of due process requirements and as required by Fed. R.
Civ. P. 4. Specifically, Doe Defendants have been served by email, text message
(including by WhatsApp), and publication on a publicly available website. Doe
Defendants also have actual notice of these proceedings based on (a) widespread
media coverage of this case, including in Russia, that specifically mentions Google’s
claims against Defendants Starovikov and Filippov and several of their unnamed
associates, (b) Google’s disruption of the botnet’s activity and Defendants’ actions in
response thereto, and (c) two prominent co-conspirators’ actual notice of, and active
participation in, this lawsuit.
5. Doe Defendants have failed to appear, plead, or otherwise defend
against this Action. The requisite time of 21 days between service of the summons
and complaint has elapsed. The Clerk properly entered default pursuant to Rule
55(a) on June 10, 2022. ECF No. 85.
6. The evidence indicates that no Doe Defendant is an infant or
incompetent.
7. The factual allegations in the complaint, which are deemed admitted by
Doe Defendants’ default, and the further evidence in Google’s supporting papers
establish that Doe Defendants are liable for violations of the Racketeer Influenced
and Corrupt Organizations Act, 18 U.S.C. §§ 1962(c)–(d) (Count I); the Computer
Fraud and Abuse Act, 18 U.S.C. § 1030 (Count II), the Electronic Communications
Privacy Act, 18 U.S.C. § 2701 (Count III), Lanham Act, 15 U.S.C. §§ 1114, 1125
(Count IV), and for tortious interference with business relations and unjust
enrichment (Counts V–VI).
8. RICO. The Doe Defendants have violated and continue to violate the
RICO statute.
a. The Doe Defendants were, and still are, active participants in
the operation and management of the Glupteba botnet with
direct ties to a C2 server previously associated with proxying
activity on infected machines.
b. Google has established that the Doe Defendants formed an
enterprise. The Doe Defendants shared a common purpose to
spread malware to build a botnet that is deployed for
numerous criminal schemes for profit.
c. Google has established that the Doe Defendants engaged in a
pattern of racketeering activity. The predicate acts include
three separate violations of the CFAA. The Doe Defendants
have violated and continue to violate the CFAA, resulting in
damage as defined in § 1030(c)(4)(A)(i)(VI), by (1) infecting
protected computers with malware, (2) transmitting to such
protected computers programs designed to carry out their
schemes, and (3) transmitting to such protected computers
commands to infected computers. Google has shown that the
Doe Defendants committed other predicate acts, including
violations of the federal wire fraud statute, 18 U.S.C. § 1343,
federal identity fraud statute, 18 U.S.C. § 1028, and federal
access device fraud statute, 18 U.S.C. § 1029.
d. Google has suffered injury to its business or property as a
result of Doe Defendants’ acts that constitute these predicate
offenses.
9. CFAA. The Doe Defendants have violated and continue to violate the
Computer Fraud and Abuse Act. The CFAA prohibits, among other things,
intentionally accessing a protected computer, without authorization, and thereby
obtaining information from that computer. See 18 U.S.C. § 1030(a)(2)(C). The Doe
Defendants intentionally accessed thousands of users’ computers operating in
interstate commerce through the internet, without authorization, to infect them with
malware. They did so to obtain information such as account credentials and URL
history, which they have then sold to others. This has affected well over ten
computers within a one-year span and resulted in damages in excess of $5,000.
10. ECPA. The Doe Defendants have violated and continue to violate the
Electronic Communications Privacy Act. The ECPA prohibits, among other things,
“intentionally access[ing] without authorization a facility through which an electronic
communication service is provided” to “obtain[], alter[], or prevent[] authorized access
to a wire or electronic communication while it is in electronic storage.” 18 U.S.C. §
2701(a). The Doe Defendants have deliberately broken into the accounts of Google
users and thereby obtained unauthorized access to emails and other communications
stored on Google servers.
11. Lanham Act. The Doe Defendants violated the Lanham Act by using
Google’s YouTube mark—a valid, protectable, registered and incontestable
trademark—in commerce in a manner likely to have caused confusion among
consumers by operating a website that used the YouTube mark in the domain name
and on the landing page. See 15 U.S.C. § 1114(1). In addition, the Lanham Act makes
unlawful a false or misleading representation, including a false designation of origin,
that “in commercial advertising or promotion, misrepresents the nature,
characteristics, qualities, or geographic origin of . . . goods, services, or commercial
activities.” 15 U.S.C. § 1125(a)(l)(B). The Doe Defendants deceived internet users by
falsely marketing their malware as software for downloading videos from YouTube,
for their own profit, to the detriment of Google and Google’s trademarks. By
establishing the Doe Defendants’ liability under the Lanham Act, Google is also
entitled to a presumption of irreparable harm. 15 U.S.C. § 1116(a).
12. Google has shown that the Doe Defendants are liable for New York
common law claims of tortious interference with business relationships and unjust
enrichment.
A Permanent Injunction is Warranted
13. “It is well-established that a court may grant a permanent injunction as
part of a default judgment.” Ideavillage Prod. Corp. v. OhMyGod 1, 2020 WL
6747033, at *4 (S.D.N.Y. Nov. 17, 2020). “Whether to issue a permanent injunction
in such a case depends on (1) the likelihood that plaintiff will suffer irreparable harm
if an injunction is not granted; (2) whether remedies at law such as monetary
damages are inadequate to compensate plaintiff for that harm; (3) the balance of
hardships; and (4) whether the public interest would not be disserved by a permanent
injunction.” Id. (citing Salinger v. Colting, 607 F.3d 68, 77–78 (2d Cir. 2010)). The
Court finds that Google has established each of these factors and that a permanent
injunction is warranted.
14. Irreparable Harm and Inadequate Remedies at Law. Google has
established that it was irreparably injured and that legal remedies are inadequate to
compensate for that harm. In particular, it has shown that the Doe Defendants—
through their participation in, and operation of, the Glupteba Enterprise—have
threatened the security of the internet, including Google platforms, by transmitting
malware through the internet to configure, deploy, and operate a botnet. The
Enterprise has distributed malware on devices of Google users, compromising the
security of those devices and continues to issue commands to those devices to carry
out criminal activities, such as selling access to Google user accounts and selling
fraudulent credit cards to use on those accounts.
15. The Doe Defendants control a botnet that has infected more than one
million devices. At any moment, the botnet’s extraordinary computing power could
be harnessed as part of additional criminal schemes. Doe Defendants could, for
example, enable large ransomware or distributed denial-of-service attacks on
legitimate businesses and other targets. Doe Defendants could themselves
perpetrate such a harmful attack, or they could sell access to the botnet to a third-
party for that purpose.
16. In addition, the Doe Defendants’ conduct continues to infringe Google’s
trademarks, injure Google’s goodwill, and damage its reputation by creating
confusion as to the source of the Glupteba malware. This constitutes irreparable
harm.
17. Balance of the Hardships. The equities also favor a permanent
injunction. The criminal enterprise defrauded, and continues to defraud, consumers
and injures Google. There is no countervailing factor weighing against a permanent
injunction as there is no legitimate reason why Doe Defendants should be permitted
to continue to disseminate malware and manipulate infected computers to carry out
criminal schemes.
18. Public Interest. Google has shown that the public interest favors
granting a permanent injunction. Every day that passes, there is substantial risk
that Doe Defendants may infect new computers, steal more account information, and
deceive more unsuspecting victims. After receiving notice of the Temporary
Restraining Order and Preliminary Injunction, Doe Defendants have continued to
engage in conduct enjoined by this Court’s Orders. Doe Defendants have attempted
to establish new C2 servers in response to Google’s ongoing disruption efforts and
have continued to establish new websites in order to reconstitute Glupteba
Enterprise storefronts and provide Glupteba Enterprise customers continued access
to their accounts. Protection from malicious cyberattacks and other cybercrimes is
strongly in the public interest, and the public interest is clearly served by enforcing
statutes designed to protect the public, such as RICO, the CFAA, the ECPA, and the
Lanham Act.
FINAL JUDGMENT AND PERMANENT INJUNCTION
IT IS HEREBY ORDERED that Google’s Motion for Default Judgment and
Entry of a Permanent Injunction is granted.
IT IS FURTHER ORDERED that Doe Defendants are in default, and that
judgment is awarded in favor of Google and against Doe Defendants.
IT IS FURTHER ORDERED that Doe Defendants, any of their officers,
agents, servants, employees, attorneys, and all others in active concert or
participation with them, who receive actual notice of this Order by personal service
or otherwise including via email (“Restrained Parties”), are permanently restrained
and enjoined from, anywhere in the world:
1. Intentionally accessing and sending malicious code to Google or the
protected computers of Google’s customers without authorization;
2. Sending malicious code to configure, deploy, and/or operate a botnet;
3. Attacking and compromising the security of the computers or networks
of Google’s users;
4. Stealing and exfiltrating information from computers or computer
networks;
5. Creating websites that falsely indicate that such websites are or were
associated with Google, YouTube, or any other Google affiliate, including through use
of Google’s YouTube mark or other false or misleading representations;
6. Configuring, deploying, operating, or otherwise participating in or
facilitating the botnet described in Google’s pleadings, including but not limited to
the C2 servers hosted at, and operating through, the IP Addresses listed in Appendix
A to Google’s Complaint and through any other component or element of the botnet
in any location;
7. Delivering malicious code designed to steal credentials and cookies;
8. Monitoring the activities of Google or Google’s customers;
9. Stealing information from Google or Google’s customers;
10. Selling access to the accounts of Google’s customers;
11. Corrupting applications on victims’ computers and networks, thereby
using such computers or networks to carry out the foregoing activities;
12. Offering or promoting credit cards to others for use in purchasing
services from Google;
13. Misappropriating that which rightfully belongs to Google, Google’s
customers and users, or that in which Google has a proprietary interest;
14. Using, linking to, transferring, selling, exercising control over, or
otherwise owning or accessing domains connected with the Enterprise, its activities,
or its use of the botnet;
15. Using, transferring, exercising control over, or accessing any accounts
used in the transfer of money or electronic currency, including cryptocurrency, or in
the processing of card-based transactions, as a means to further Doe Defendants’
unlawful schemes;
16. Using and infringing Google’s trademarks, including Google’s YouTube
mark;
17. Using, in connection with Doe Defendants’ activities, any products or
services with any false or deceptive designation, representations or descriptions of
Doe Defendants or of their activities, whether by symbols, words, designs, or
statements, which would damage or injure Google or its customers or users or give
Doe Defendants an unfair competitive advantage or result in deception of consumers;
18. Acting in any other manner which suggests in any way that Doe
Defendants’ activities, products or services come from or are somehow sponsored by
or affiliated with Google, or otherwise passing off Doe Defendants’ activities, products
or services as Google’s; and
19. Undertaking any similar activity that inflicts harm on Google, Google’s
customers, or the public.
Upon service by email, text message, or internet publication, the Doe
Defendants and other Restrained Parties shall be deemed to have actual notice of the
issuance and terms of the Default Judgment and Permanent Injunction Order, and
any act by any of the Doe Defendants or the Restrained Parties in violation of any of
the terms of the Default Judgment and Permanent Injunction Order may be
considered and prosecuted as contempt of Court.
IT IS FURTHER ORDERED that Google may serve this Order on the
persons and entities providing services, including domain name registrars, name
servers, web hosting services, and other internet service providers, relating to the
domains and IP addresses identified by Google as connected to the Enterprise, its
activities, or its botnet, requesting that those persons and entities take reasonable
best efforts to implement the following actions:
1. Take reasonable steps to identify incoming and/or outgoing internet
traffic on their respective networks that originates and/or is being sent from and/or
to such identified domains and IP addresses;
2. Take reasonable steps to block incoming and/or outgoing internet traffic
on their respective networks that originate and/or are being sent from and/or to such
identified domains and IP addresses except as explicitly provided for in this Order;
3. Take other reasonable steps to block such traffic to and/or from any
other IP addresses or domains to which Doe Defendants or Doe Defendants’
representatives moved the botnet infrastructure, to ensure that Doe Defendants
cannot use such infrastructure to control the botnet;
4. Disable completely the computers, servers, electronic data storage
devices, software, data or media assigned to or otherwise associated with such
identified domains and IP addresses and make them inaccessible from any other
computer on the internet, any internal network, or in any other manner, to Doe
Defendants, Doe Defendants’ representatives, and all other persons, except as
otherwise ordered herein;
5. Completely, and until further order of this Court, suspend all services
to Doe Defendants or Doe Defendants’ representatives or resellers associated with
such identified domains and IP addresses;
6. Refrain from providing any notice or warning to, or communicating in
any way with Doe Defendants or Doe Defendants’ representatives until the steps
required by this Order are executed in full, except as necessary to communicate with
hosting companies, data centers, Google, or other ISPs to execute this Order;
7. Not enable, and take all reasonable steps to prevent, any circumvention
of this Order by Doe Defendants or Doe Defendants’ representatives associated with
such identified domains and IP addresses, including, without limitation, not
enabling, facilitating, and/or allowing Doe Defendants or Doe Defendants’
representatives or resellers to rent, lease, purchase, or otherwise obtain other
domains and IP addresses;
8. Preserve, retain, and produce to Google all documents and information
sufficient to identify and contact Doe Defendants and Doe Defendants’
representatives operating or controlling such identified domains and IP addresses,
including any and all individual or entity names, mailing addresses, e-mail
addresses, facsimile numbers, telephone numbers or similar contact information,
including but not limited to such contact information reflected in billing, usage, access
and contact records and all records, documents and logs associated with the use of or
access to such domains and IP addresses;
9. Provide reasonable assistance in implementing the terms of this Order
and take no action to frustrate the implementation of this Order; and
10. Completely preserve the computers, servers, electronic data storage
devices, software, data, or media assigned to or otherwise associated with such
identified domains and IP addresses, and preserve all evidence of any kind related to
the content, data, software, or accounts associated with such domains, IP addresses,
and computer hardware.
IT IS FURTHER ORDERED that Google may serve this Order upon such
persons as Google determines are necessary to address and enjoin activity associated
with domains and IP addresses identified by Google as being used in connection with
the Enterprise, its activities and its botnet, without seeking further leave of the court.
\ j
So ordered. to. /h
S “4 biesuce i
tpl Be, DENISE COTE
United States District Judge
14