Attacks/Breaches

2/2/2018
04:05 PM
50%
50%

Russian National Arrested for Kelihos Botnet Sent to US

Peter Levashov, among the world's most notorious email spammers, has been extradited to the US.

Peter Levashov, one of the world's most well-known email spammers and operator of the Kelihos botnet, has been extradited to the US from Spain. He awaits federal charges in Connecticut, where prosecutors say he used the botnet to harvest personal data.

Levashov, a Russian citizen, is accused of identity theft, wire fraud, and conspiracy. He was arrested in April 2017 while on holiday in Barcelona as part of a US Department of Justice effort to take down Kelihos. Officials said the operation was distributing hundreds of millions of fraudulent emails per year, intercepting credentials for online accounts belonging to thousands of Americans, and spreading ransomware. Indictment details were released later the same month.

The spammer initially claimed he was collecting data on opposition parties for the United Russia party, which later said he was unknown to them. Russia filed a competing extradition request; the Spanish National Court approved Levashov's extradition to the US in October.

In addition to driving spam and malware-rigged email campaigns, Levashov has been associated with click-fraud and DDoS operations. Many cyberattackers thought of him as a spam service provider. He was indicted, but not extradited, in 2009 for operating the Storm botnet.

Read more details here.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
BrianN060
50%
50%
BrianN060,
User Rank: Ninja
2/4/2018 | 10:46:55 AM
Russian National Arrested for Kelihos Botnet Sent to US
This is a high information-density Quick Hits article -- well worth a thorough exploration. While some aspects of the story are readily apparent, a number of more subtle and sophisticated implications are revealed when you learn more of the backstory. 
New Mexico Man Sentenced on DDoS, Gun Charges
Dark Reading Staff 5/18/2018
Is Threat Intelligence Garbage?
Chris McDaniels, Chief Information Security Officer of Mosaic451,  5/23/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Shhh!  They're watching... And you have a laptop?  
Current Issue
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-3018
PUBLISHED: 2018-05-24
The AXIS webapp in deploy-tomcat/axis in IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.1.2 and 7.2.0 through 7.2.1.4 allows remote attackers to obtain sensitive configuration information via a direct request, as demonstrated by happyaxis.jsp. IBM X-Force ID: 84354.
CVE-2013-3023
PUBLISHED: 2018-05-24
IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.1.2 and 7.2.0 through 7.2.1.4 might allow remote attackers to obtain sensitive information about Tomcat credentials by sniffing the network for a session in which HTTP is used. IBM X-Force ID: 84361.
CVE-2013-3024
PUBLISHED: 2018-05-24
IBM WebSphere Application Server (WAS) 8.5 through 8.5.0.2 on UNIX allows local users to gain privileges by leveraging improper process initialization. IBM X-Force ID: 84362.
CVE-2018-5674
PUBLISHED: 2018-05-24
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader before 9.1 and PhantomPDF before 9.1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw...
CVE-2018-5675
PUBLISHED: 2018-05-24
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader before 9.1 and PhantomPDF before 9.1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw...