Here’s an update on the E&G Bulgaria cybercrime case involving Israelis Gal Barak and Gery Shalon. FinTelegram has been instrumental in uncovering and providing crucial whistleblower information, which led to Barak’s arrest in early 2019. While Barak and several of his associates have already been sentenced, further charges are anticipated, potentially implicating Gery Shalon as the true mastermind behind Barak’s operations.
Gery Shalon And The U.S. Charges
Gery Shalon, a/k/a Garri Shalelashvili, a Georgian-born Israeli, was arrested in Israel in 2015 and extradited to the United States for extensive cybercrime activities. In November 2015, U.S. authorities announced Shalon’s indictment for orchestrating a series of massive cyberattacks against U.S. financial institutions, brokerage firms, and a major news publication. These cyberattacks resulted in the largest theft of customer data from a U.S. financial institution, affecting over 100 million people. Shalon and his co-conspirators used the stolen data to manipulate the securities market and promote stocks through fraudulent practices.
Shalon’s criminal enterprises extended beyond these hacks. He actually ran a global cybercrime organization, including illegal online casinos, money laundering schemes, and an illicit Bitcoin exchange called Coin.mx, amassing hundreds of millions of dollars in illicit proceeds. Despite his extensive criminal activities, Shalon spent a brief period in prison and was placed under house arrest in New York in 2016. During his house arrest, evidence in the criminal files shows he continued collaborating with Gal Barak and his wife Marina Barak (then Marina Andreeva), providing instructions and making significant financial decisions for the E&G Bulgaria cybercrime organization.
Read our reports on Gery Shalon here.
Guilty Plea, Forfeiture, And Political Connections
According to Bloomberg, Shalon pled guilty in 2017 in a “sealed courtroom” in return for a significantly more lenient sentence than his co-conspirators. In January 2021, Shalon agreed to forfeit more than $413 million, the proceeds from his criminal activities. However, it is alleged that Shalon earned significantly more from his illegal endeavors.
The criminal files from the case reveal that Shalon and Barak organized the theft of over $200 million through online trading scams like xTraderFX, SafeMarkets, ZoomTrader, and CryptoPoint. Barak was sentenced to four years in prison in Austria in 2020 for investment fraud and money laundering.
The U.S. case against Shalon raises numerous questions. Despite the severity of his crimes, Shalon avoided a lengthy prison sentence, likely due to his cooperation with U.S. authorities and his political connections. Allegedly, he was released from house arrest in 2021 and returned to Israel in 2022 or early 2023. His father, Shota Shalelashvili, a former member of the Georgian parliament, is believed to have intervened on his behalf. Furthermore, Shalon’s valuable insights into the Russian hacker and scammer networks may have provided substantial political leverage for the U.S. amid its cyber conflicts with Russia. in 2019, Bloomberg reported Shalon was working with US authorities, possibly providing insight into “international money laundering.”
Shota Shalelashvili was a member of the Georgian parliament until October 2019. Allegedly, he was the richest member of the parliament back then. Therefore, it is not surprising that one of Shalon’s Russian partners in U.S. cybercrime activities, Andrei Tyurin, was arrested in 2018 while on vacation in Georgia and extradited to the U.S. Tyurin was sentenced in 2021 to 12 years in prison and forfeiture payment of $19.2 million.
In Georgia, Shalelashvilli was under pressure at the time because of his son and massive corruption allegations and resigned in October 2019. In a statement to the Times of Israel, Shalelashvili said: “I think he plans to go back to the US. His skills are too big for Israel.” This strange statement also indicated that Shalon has cooperated with the U.S. authorities.
The Dutch Connection
During his time under house arrest in New York, Shalon pursued his cybercrime activities almost unhindered. He used a Russian cell phone to coordinate his activities internationally via WhatsApp or Telegram. He gave instructions to Marina Barak, the CFO of E&G Bulgaria, on where to transfer the money from the scams.
Shalon also maintained accounts with the now-collapsed Payvision in Amsterdam. This high-risk payment processor, founded by Rudolf Booker, willingly laundered the money for Shalon and his cybercrime activities. In 2021, the Dutch Central Bank DNB, as the competent supervisory authority, filed a criminal complaint against Payvision for money laundering activities.
Payvision facilitated the fraudulent activities of Shalon and his organization with its services. In this fraud context, the European Funds Recovery Initiative (EFRI) has also sent and published an open letter to the European Banking Authority (EBA) requesting its intervention in favor of the scam victims.
The criminal files show that members of the cybercrime organization also met with Shalon in New York during the alleged house arrest.
The German Indictments
With the European Court of Justice (ECJ) rejecting Barak’s appeal against his indictment in Germany, it appears that Shalon may also face charges in this jurisdiction. Law enforcement contacts confirm that Shalon is under investigation, and there is speculation that he and Barak could be jointly tried. This development is crucial for the victims of the many scams operated by the E&G Bulgaria cybercrime organization, as it presents an opportunity for them to see justice served.
As this case unfolds, monitoring the legal proceedings and potential implications for international cybercrime enforcement will be crucial. The indictment of Shalon and Barak in Germany could mark a significant milestone in holding cybercriminals accountable and delivering justice to their numerous victims.
Share Information
If you have any information about the cybercrime principals Gery Shalon and Gal Barak and their activities, please let us know via our whistleblowing system, Whistle42.
