Partial unsealing of an indictment revealed the names of a band of the cybercriminals responsible for Racketeer Influenced and Corrupt Organizations (RICO) conspiracy, in addition to wire fraud conspiracy and aggravated identity theft. The perpetrators purchased, on the dark web, server credentials for the computer servers of Certified Public Accounting (CPA) and tax preparation firms across the USA. They used those server credentials to remotely and covertly commit computer intrusions and exfiltrate the tax returns of thousands of taxpayers who were clients of those CPA and tax preparation firms. They then formed an enterprise through which they filed thousands of false tax returns in the names of more than 9,000 identity theft victims.

To hide their activities, the conspirators routinely used pseudonyms, opened business entities and bank accounts in the names of nominees and identity theft victims, and conducted their illicit business using dozens of different email addresses.