How cybercriminals used hacked accounts and fake documents to steal millions in Uzbekistan

Shortly afterward, she received PDF files through a Telegram bot masquerading as a Central Bank service, listing the alleged loans.

The pressure ceased the following day, but her mobile phone began malfunctioning.

Believing that taking out a legitimate online loan might prevent fraudsters from obtaining loans in her name, Otayeva applied for an online loan of UZS 98.2 million through a banking application. Investigators later determined that the cybercriminals had already gained remote control of her phone through the malicious PDF file, allowing them to transfer the funds to a bank card belonging to another individual.

The governor who unknowingly asked for loans

The same group later compromised the Telegram account of Gijduvon District Governor Farkhod Umarov by sending him a malicious file disguised as a program titled "Samaya luchshaya mama" ("The Best Mom"). Opening the link gave the attackers full control of his account.

Using the governor's profile, the fraudsters sent messages to his contacts requesting UZS 7 million as a short-term loan, promising to repay it the following morning.

More than 10 people fell victim to the scam, including the assistant to the governor of Vobkent district, a senior specialist from the Bukhara Regional Treasury Department, the director of the Gijduvon Free Economic Zone, the head of a local company, and officials from the district Youth Affairs Department and the district office of the Cadastral Agency. Together, they transferred more than UZS 80 million.

One victim later told investigators that the first message appeared entirely credible because it came from Umarov's genuine Telegram account. Suspicion arose only after a second request arrived in the Latin script instead of Cyrillic.

The stolen money was transferred to bank cards registered in the names of several individuals, including Elyor Otaboyev, Hamdam Qadamov, Dildora Qurbonova, Maftuna Vohidova and Mirjalol Akhmedov.

The role of "drop" bank cards

Investigators found that the fraudsters relied on so-called "drop" bank cards opened in the names of other people in exchange for payment.

According to the case materials, several individuals opened up to 10 bank cards each and handed them over to the criminal network. Russian citizen Ivan Kornilov allegedly paid each participant $300 for the service.

The cardholders told investigators they believed the accounts would be used to process payments related to online betting platforms and were unaware that the accounts would be used to move proceeds from cyber fraud.

Russian nationals identified as organizers

Court documents identify Russian citizens Ivan Kornilov and Yegor Kuznetsov as the organizers of the scheme.

One defendant, a 26-year-old resident of Samarkand identified only as A.I., testified that he met Kornilov on a flight from Moscow to Samarkand in August 2025. After remaining in Samarkand for about a month, Kornilov later returned with Kuznetsov and offered A.I. a job.

According to his testimony, the pair explained that they operated cryptocurrency exchange activities and needed people to open "drop" bank cards. The scheme involved withdrawing money received on those cards in cash before converting it into cryptocurrency and transferring it to the organizers.

Investigators believe the money obtained through hacked Telegram accounts and fraudulent online loans was funneled through these cards. Kuznetsov allegedly handled the hacking of Telegram accounts and impersonated State Security Service officers through internet-based phone calls.

Court verdict

Law enforcement agencies eventually uncovered the operation and detained the suspects. Several criminal cases were opened against those involved.

The portion of the case concerning A.I. was heard separately, with the verdict delivered on June 15. He was convicted on 17 counts, including episodes involving the Gijduvon district governor and the deputy chairperson of the Bukhara Regional Election Commission.

The court found him guilty of fraud, violations of legislation on personal data, and the creation, use and distribution of malicious software under the Criminal Code. He was sentenced to two years and one month of restricted liberty.

According to the court, all financial losses suffered by the victims have been fully compensated.