Prison scrubs are the new swimsuit for an accused cyberscammer plucked off the beaches of Thailand to face justice in a Brooklyn court. But her attorney and prosecutors said Wednesday that they’re in talks about a plea deal.

Feds say alluring hotel hostess Olga Komova, 26, was a member of an international criminal network that used malware to siphon more than $1.2 million from the bank accounts of unsuspecting victims, many of them from the U.S. The Uzbek citizen with strong ties to Russia was arrested in Thailand last year. She’s since been housed at a Brooklyn federal jail notorious for its “third world” conditions.

Komova’s social media presence described her as “an island girl” living in “paradise,” at least before an American arrest warrant brought it crashing down. Long before she donned long sleeves under her prison jumpsuit with her hair in a shaggy, at-the-shoulders cut, Komova maintained a carefully curated gallery of online photos showcasing her carefree life of beaches and bar-hopping.

Amateur modeling photos intermingled with shots of Komova and a boyfriend, her hair cycling through varying shades of brown, red, and blond. “May your dreams come true, and be reborn,” she captioned one shot with her paramour. Others showed her partying with friends on Halloween or in Bangkok.

On TripAdvisor, the polyglot guest relations specialist at a beachfront hotel reviewed her way through restaurants in the Seychelles, Florence, and Nice.

Though an application for an arrest warrant redacts the names of Komova’s co-defendants, Thai police perp-walked Dmitry Ukrainsky, a Russian citizen, alongside the beauty. (Komova shielded her eyes from fluorescent lights with shades.) A court records search for his name shows he is listed as a co-defendant on Komova’s case. Yet Russian authorities interceded on his behalf before he could be put on a plane to the United States, The New York Times reported, while the Uzbek government did Komova no such favors.

“The American authorities continue the unacceptable practice of ‘hunting’ for Russians all over the world, ignoring the norms of international laws and twisting other states’ arms,” the Russian Foreign Ministry charged in 2015.

Komova’s father, Mikhail Komov, is also listed as a defendant on the case. The elder Komov was a citizen of Uzbekistan but now holds a Russian passport.

He was arrested in Thailand a decade ago on an unrelated FBI arrest warrant. At the time, American authorities suspected Komov of credit card fraud related to child pornography sites. The Daily Mail reported that Komov “slipped the FBI net after Bangkok released him from detention without extraditing him.”

But U.S. court documents show a plea agreement in Komov’s name in 2012, to a charge of conspiracy to launder monetary instruments. Komov’s crime was accepting payments for a website called “PedoLand” through his PayPal account, court documents state. (His appointed attorney confirmed the guilty plea to The Daily Beast.)

“Actually, the FBI want her father. Like her, he had an Uzbekistan passport, but he’s in Russia. And he’s now got a Russian passport too, so he’s safe,” a friend of Komova’s told the Daily Mail.

Komov, for his part, told the U.K. paper that the entire case is an elaborate setup by the FBI.

“It’s clearly a game of the American secret services, catching people for totally made up stories. Or a special frame-up,” he said. “Most likely, someone either used Olga’s bank account or card. Simply stole it. That’s the whole truth.”

Friends told the paper last year that Komova has a heart of gold and doesn’t live the luxurious lifestyle the alleged cash influx in the charges against her would suggest. But the case may never have its day at trial, if prosecutors and Komova’s attorney work out a plea deal. Her next court date is in May.

Another member of the alleged criminal conspiracy has already pleaded guilty in New York’s Eastern District. Vyacheslav Khaimov, 55, pleaded guilty to operating an unlicensed money transmitting business in February.

In a related case to the one against Komova, her father, and Ukrainsky, Khaimov is named as a co-conspirator who helped launder money through so-called mules and into bank accounts linked to the three individuals abroad. He received $230,000 from the misdeeds, according to the complaint. Khaimov then sent $110,000 overseas to the alleged co-conspirators, including Komova.

Khaimov was the human interface between the mules and his alleged co-conspirators abroad, prosecutors said. After hackers used malware to access victims’ bank accounts, their unwitting mules would be tasked with transferring money to Khaimov, according to the complaint, under the direction of a mysterious figure known only as “Samuel Gold.” Charging documents don’t disclose the identity of Samuel Gold, or whether he was a real person or simply a made up identity.

In one 2015 instance, for example, hackers used malware to compromise the bank account of an individual on Long Island, and withdrew more than $44,000 from their account. Hackers wired that money to a “mule” who had instructions to pass it on to Khaimov, leaving just $1500 for himself.

When the money arrived in Khaimov’s accounts or at his Brighton Beach storefront, he would take a cut before sending it on to bank accounts in Thailand and Russia, the complaint said. In that August 2015 instance, Khaimov kept a hefty chunk of change and sent just $24,580 on to a co-conspirator.

Sometimes mules would wire money directly overseas, or into accounts held by “Reality Management Corp” or “First California Escrow”—companies with accounts at banks which also house accounts held by one of Komova’s alleged co-conspirators, according to the complaint.

“Modern-day bank robbers no longer need a gunman and a getaway driver,” FBI Assistant Director-in-Charge William Sweeney said in a statement announcing Khaimov’s plea in February. “Today, they just need a malware operator and money mules to carry out their crime from anywhere in the world.”