A Russian national has been extradited from Spain and will be arraigned later today in Connecticut on charges stemming from his alleged operation of the Kelihos botnet – a global network of tens of thousands of infected computers, which he allegedly used to facilitate malicious activities including harvesting login credentials, distributing bulk spam e-mails, and installing ransomware and other malicious software.

Peter Yuryevich Levashov, 37, also known as Petr Levashov, Peter Severa, Petr Severa and Sergey Astakhov, of St. Petersburg, Russia, has been detained since April 7, 2017, in Spain when he was arrested by Spanish authorities based upon a criminal complaint and arrest warrant issued in the District of Connecticut.

As alleged in an eight count-indictment, a “botnet” is a network of computers infected with a malicious software that allows a third party to control the entire computer network without the knowledge or consent of the computer owners. Levashov allegedly controlled and operated the Kelihos botnet to, among other things, harvest personal information and means of identification (including email addresses, usernames and logins, and passwords) from infected computers. To further the scheme, Levashov allegedly disseminated spam and distributed other malware – such as banking Trojans and ransomware, and advertised the Kelihos botnet spam and malware services to others for purchase in order to enrich himself.

The indictment further alleges that during any 24-hour period, the Kelihos botnet was used to generate and distribute more than 2,500 unsolicited spam e-mails that advertised various criminal schemes, including deceptively promoting stocks in order to fraudulently increase their price (so-called “pump-and-dump” stock fraud schemes).

On April 10, 2017, the Justice Department announced that it had taken action to dismantle the Kelihos botnet.

On April 20, 2017, a grand jury in Bridgeport returned an indictment charging Levashov with one count of causing intentional damage to a protected computer, one count of conspiracy, one count of accessing protected computers in furtherance of fraud, one count of wire fraud, one count of threatening to damage a protected computer, two counts of fraud in connection with email and one count of aggravated identity theft.   back...