Web Desk
HARRIS COUNTY, Texas – A sophisticated cybercrime gang with ties to Russia stole nearly $236,000 from ATMs across Texas in just four days.
Investigators believe this is the first large-scale “jackpotting” attack in Harris County, a method that allows criminals to force ATMs to dispense cash without affecting any bank accounts.
Houston Police Detective Roger Collins, a member of the U.S. Secret Service Cyber Fraud Task Force, has been investigating the case for months.
“We’ve seen ATM theft before, but nothing like this,” he said. “This is the first time criminals could do it remotely.”
Authorities say the gang hit more than 70 ATMs across Texas, including in Houston, Dallas, Austin, and San Antonio.
The first attack was reported last September in Houston, where 51 ATMs were compromised in a few hours, leading to a $150,000 loss.
A New Kind of ATM Heist
The criminals targeted privately owned ATMs often placed in gas stations and hotels.
Since no customer accounts were affected, business owners are left to bear the financial losses.
Surveillance footage shows the suspects using rental cars and focusing on their cell phones while at the machines.
Detective Collins explained how the scheme works: The hackers find a discarded ATM receipt, take a picture, and send it to an overseas contact who triggers the attack.
“This trick makes the ATM think a transaction was canceled, but the cash is dispensed,” Collins said. “They repeat the process until the machine runs out of money.”
Seven Arrested, More Suspects at Large
Over four days, the group stole $236,000 before investigators caught up with them. Seven people have been charged in the case:
Vitalii Moravel, 32 – A Ukrainian refugee on a humanitarian visa, suspected U.S. leader of the gang. Arrested in Miami on similar charges.
Roman Leskiv, 28 – Wanted in Harris County, also jailed in Miami.
Andriy Ivano, 32 – A truck driver from Illinois. Arrested in Las Vegas and extradited to Texas. Pleaded guilty to a money services violation, sentenced to two years of community supervision.
Alexey Kharitonov, 50 – A Russian national, arrested in Georgia, out on bond. His attorney claims he is innocent.
Mirsaftar Asgarov, 34 – A Houston locksmith. Charges dismissed due to lack of evidence.
Aibek Karabalayev, 38 – Wanted in Harris County, last known address in Illinois.
Alexey Zubov, 38 – Also wanted in Harris County, last known address in Illinois.
Detective Collins believes at least five other suspects remain unidentified. Investigators have found flight records linking them to similar cases in New York, Boston, and Ohio.
International Cybercrime Operation
Collins said Moravel was receiving instructions from a Russian-based leader, referred to as the “Big Boss.”
The gang members kept 30% of the stolen cash, while Moravel took 70%, which was converted into cryptocurrency to evade law enforcement.
“Some reports suggest the money is sent back to Russia via courier,” Collins said. “We’ve also heard that the ‘Big Boss’ has flown into the U.S. to collect cash personally.”
A Growing Threat
The exact method used to hack the ATMs remains unclear. Investigators warn that this type of cybercrime is evolving, making it harder to prevent future attacks.
Collins emphasized that ATM owners should enhance security, monitor suspicious activity, and report unusual transactions. “They’re getting smarter,” he said. “This won’t be the last time this happens.”
Anyone with information about the suspects should contact the Houston Police Department.
