Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

1/23/2013
05:11 PM
50%
50%

Alleged Gozi Trojan Creator Among Three Charged by Authorities

Three people are facing decades behind bars if convicted of having roles in the malware's spread

Federal authorities unsealed indictments against three individuals tied to the creation of the notorious Gozi Trojan.

According to authorities, the Gozi malware infected more than one million computers around the world, causing tens of millions of dollars in damages. The FBI names Russian national Nikita Kuzmin, 25, as the creator of the malware. Two others – Latvia national Deniss Calovskis, 27, and Romanian national Mihai Ionut Paunescu, 28 – are accused of playing roles in the spread of Gozi as well, with Calovskis said to have written some of the code that made the malware effective.

Kuzmin was arrested in the U.S. in November 2010, and pled guilty the following year to charges of computer intrusion and fraud. Calovskis meanwhile was arrested in Latvia in November 2012, and Paunescu, who is accused of running a bulletproof hosting service for criminals distributing the malware, was arrested in Romania in December.

“This long-term investigation uncovered an alleged international cyber crime ring whose far-reaching schemes infected at least one million computers worldwide and 40,000 in the U.S. and resulted in the theft or loss of tens of millions of dollars," says FBI Assistant Director in Charge George Venizelos, in a statement. "Banking Trojans are to cyber criminals what safe-cracking or acetylene torches are to traditional bank burglars—but far more effective and less detectable."

Attackers have used the Gozi malware in to infect computers around the globe, including computers at NASA, authorities said. Police believe Kuzmin conceived of Gozi in 2005 when he created a list of technical specifications for the malware and hired a computer programmer to write its source code. Once Gozi had been coded, Kuzmin began providing it to co-conspirators in exchange for a weekly fee through a business he ran called "76 Service," authorities alleged. Beginning in 2009, he is accused of beginning to sell the malware to customers outright.

According to the FBI, Calovskis was hired to develop Web injects that altered how the Web pages of particular banks appeared on infected computers. When a victim used an infected computer to browse the bank's Web page, they would be duped into entering personal information into the page supplied by attackers.

Roel Schouwenberg, senior researcher, Kaspersky Lab, calls Gozi one of the "bigger names out there in the criminal underground" when it comes to banking malware kits.

"Unfortunately, a huge supply of these malware kits remains," he says. "Even if we were to see a short dip in total malware attacks in this particular space, it won't last. There's just too much money for the bad guys to be made."

Still, while he acknowledged the battle against such malware to be ongoing, Trusteer Senior Security Strategist George Tubin calls news of the arrests fantastic.

"One of the major ongoing issues and reasons why this entire underground market that uses advanced malware to commit cybercrime exists is that they operate under the assumption of impunity," he says. "They feel this way because the Internet provides a level of anonymity, coupled with the fact that the cybercriminals reside predominantly in locations where the relationship with U.S. and other international authorities are not the most cooperative. So anytime the authorities capture and charge cybercriminals, it sends a clear message to existing and potential criminals that there will be repercussions to their illegal actions."

The trio is facing a bevy of charges. If given the maximum sentence on all counts, Kuzmin faces 95 years in prison, while Calovskis and Paunescu face 67 and 60 years, respectively.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
PJS880
50%
50%
PJS880,
User Rank: Ninja
2/2/2013 | 5:23:39 PM
re: Alleged Gozi Trojan Creator Among Three Charged by Authorities






My Information Securities
professor always said to use your powers for good and not evil. It appears that
this is what she was referring to. It also sounds like they are trying to make
examples of these guys, That is an awful longtime in prison, George Tubin was
right 60-95 years in prison definitely is a clear message.

Paul Sprague

InformationWeek Contributor

-

kjhiggins
50%
50%
kjhiggins,
User Rank: Strategist
1/24/2013 | 3:45:17 PM
re: Alleged Gozi Trojan Creator Among Three Charged by Authorities
So true--Gozi is still alive and well.

Kelly Jackson Higgins, Senior Editor
Dark Reading
Larry Seltzer - UBM Tech
50%
50%
Larry Seltzer - UBM Tech,
User Rank: Apprentice
1/24/2013 | 1:02:19 AM
re: Alleged Gozi Trojan Creator Among Three Charged by Authorities
Yeah, it's good news, but unlike most criminal conspiracies, when you bust the perps in a bank trojan ring the victims keep piling up. At least at some level
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-23381
PUBLISHED: 2021-04-18
This affects all versions of package killing. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVE-2021-23374
PUBLISHED: 2021-04-18
This affects all versions of package ps-visitor. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVE-2021-23375
PUBLISHED: 2021-04-18
This affects all versions of package psnode. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVE-2021-23376
PUBLISHED: 2021-04-18
This affects all versions of package ffmpegdotjs. If attacker-controlled user input is given to the trimvideo function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVE-2021-23377
PUBLISHED: 2021-04-18
This affects all versions of package onion-oled-js. If attacker-controlled user input is given to the scroll function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.