Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


05:11 PM

Alleged Gozi Trojan Creator Among Three Charged by Authorities

Three people are facing decades behind bars if convicted of having roles in the malware's spread

Federal authorities unsealed indictments against three individuals tied to the creation of the notorious Gozi Trojan.

According to authorities, the Gozi malware infected more than one million computers around the world, causing tens of millions of dollars in damages. The FBI names Russian national Nikita Kuzmin, 25, as the creator of the malware. Two others – Latvia national Deniss Calovskis, 27, and Romanian national Mihai Ionut Paunescu, 28 – are accused of playing roles in the spread of Gozi as well, with Calovskis said to have written some of the code that made the malware effective.

Kuzmin was arrested in the U.S. in November 2010, and pled guilty the following year to charges of computer intrusion and fraud. Calovskis meanwhile was arrested in Latvia in November 2012, and Paunescu, who is accused of running a bulletproof hosting service for criminals distributing the malware, was arrested in Romania in December.

“This long-term investigation uncovered an alleged international cyber crime ring whose far-reaching schemes infected at least one million computers worldwide and 40,000 in the U.S. and resulted in the theft or loss of tens of millions of dollars," says FBI Assistant Director in Charge George Venizelos, in a statement. "Banking Trojans are to cyber criminals what safe-cracking or acetylene torches are to traditional bank burglars—but far more effective and less detectable."

Attackers have used the Gozi malware in to infect computers around the globe, including computers at NASA, authorities said. Police believe Kuzmin conceived of Gozi in 2005 when he created a list of technical specifications for the malware and hired a computer programmer to write its source code. Once Gozi had been coded, Kuzmin began providing it to co-conspirators in exchange for a weekly fee through a business he ran called "76 Service," authorities alleged. Beginning in 2009, he is accused of beginning to sell the malware to customers outright.

According to the FBI, Calovskis was hired to develop Web injects that altered how the Web pages of particular banks appeared on infected computers. When a victim used an infected computer to browse the bank's Web page, they would be duped into entering personal information into the page supplied by attackers.

Roel Schouwenberg, senior researcher, Kaspersky Lab, calls Gozi one of the "bigger names out there in the criminal underground" when it comes to banking malware kits.

"Unfortunately, a huge supply of these malware kits remains," he says. "Even if we were to see a short dip in total malware attacks in this particular space, it won't last. There's just too much money for the bad guys to be made."

Still, while he acknowledged the battle against such malware to be ongoing, Trusteer Senior Security Strategist George Tubin calls news of the arrests fantastic.

"One of the major ongoing issues and reasons why this entire underground market that uses advanced malware to commit cybercrime exists is that they operate under the assumption of impunity," he says. "They feel this way because the Internet provides a level of anonymity, coupled with the fact that the cybercriminals reside predominantly in locations where the relationship with U.S. and other international authorities are not the most cooperative. So anytime the authorities capture and charge cybercriminals, it sends a clear message to existing and potential criminals that there will be repercussions to their illegal actions."

The trio is facing a bevy of charges. If given the maximum sentence on all counts, Kuzmin faces 95 years in prison, while Calovskis and Paunescu face 67 and 60 years, respectively.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Ninja
2/2/2013 | 5:23:39 PM
re: Alleged Gozi Trojan Creator Among Three Charged by Authorities

My Information Securities
professor always said to use your powers for good and not evil. It appears that
this is what she was referring to. It also sounds like they are trying to make
examples of these guys, That is an awful longtime in prison, George Tubin was
right 60-95 years in prison definitely is a clear message.

Paul Sprague

InformationWeek Contributor


User Rank: Strategist
1/24/2013 | 3:45:17 PM
re: Alleged Gozi Trojan Creator Among Three Charged by Authorities
So true--Gozi is still alive and well.

Kelly Jackson Higgins, Senior Editor
Dark Reading
Larry Seltzer - UBM Tech
Larry Seltzer - UBM Tech,
User Rank: Apprentice
1/24/2013 | 1:02:19 AM
re: Alleged Gozi Trojan Creator Among Three Charged by Authorities
Yeah, it's good news, but unlike most criminal conspiracies, when you bust the perps in a bank trojan ring the victims keep piling up. At least at some level
COVID-19: Latest Security News & Commentary
Dark Reading Staff 5/22/2020
The Problem with Artificial Intelligence in Security
Dr. Leila Powell, Lead Security Data Scientist, Panaseer,  5/26/2020
How an Industry Consortium Can Reinvent Security Solution Testing
Henry Harrison, Co-founder & Chief Technology Officer, Garrison,  5/21/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-05-27
A race condition was found in the mkhomedir tool shipped with the oddjob package in versions before 0.34.5 and 0.34.6 wherein, during the home creation, mkhomedir copies the /etc/skel directory into the newly created home and changes its ownership to the home's user without properly checking the hom...
PUBLISHED: 2020-05-27
JerryScript 2.2.0 allows attackers to cause a denial of service (assertion failure) because a property key query for a Proxy object returns unintended data.
PUBLISHED: 2020-05-27
JerryScript 2.2.0 allows attackers to cause a denial of service (stack consumption) via a proxy operation.
PUBLISHED: 2020-05-26
The boost ASIO wrapper in net/asio.cpp in Pichi before 1.3.0 lacks TLS hostname verification.
PUBLISHED: 2020-05-26
An issue was discovered in ssl.c in Axel before 2.17.8. The TLS implementation lacks hostname verification.