Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


05:11 PM

Alleged Gozi Trojan Creator Among Three Charged by Authorities

Three people are facing decades behind bars if convicted of having roles in the malware's spread

Federal authorities unsealed indictments against three individuals tied to the creation of the notorious Gozi Trojan.

According to authorities, the Gozi malware infected more than one million computers around the world, causing tens of millions of dollars in damages. The FBI names Russian national Nikita Kuzmin, 25, as the creator of the malware. Two others – Latvia national Deniss Calovskis, 27, and Romanian national Mihai Ionut Paunescu, 28 – are accused of playing roles in the spread of Gozi as well, with Calovskis said to have written some of the code that made the malware effective.

Kuzmin was arrested in the U.S. in November 2010, and pled guilty the following year to charges of computer intrusion and fraud. Calovskis meanwhile was arrested in Latvia in November 2012, and Paunescu, who is accused of running a bulletproof hosting service for criminals distributing the malware, was arrested in Romania in December.

“This long-term investigation uncovered an alleged international cyber crime ring whose far-reaching schemes infected at least one million computers worldwide and 40,000 in the U.S. and resulted in the theft or loss of tens of millions of dollars," says FBI Assistant Director in Charge George Venizelos, in a statement. "Banking Trojans are to cyber criminals what safe-cracking or acetylene torches are to traditional bank burglars—but far more effective and less detectable."

Attackers have used the Gozi malware in to infect computers around the globe, including computers at NASA, authorities said. Police believe Kuzmin conceived of Gozi in 2005 when he created a list of technical specifications for the malware and hired a computer programmer to write its source code. Once Gozi had been coded, Kuzmin began providing it to co-conspirators in exchange for a weekly fee through a business he ran called "76 Service," authorities alleged. Beginning in 2009, he is accused of beginning to sell the malware to customers outright.

According to the FBI, Calovskis was hired to develop Web injects that altered how the Web pages of particular banks appeared on infected computers. When a victim used an infected computer to browse the bank's Web page, they would be duped into entering personal information into the page supplied by attackers.

Roel Schouwenberg, senior researcher, Kaspersky Lab, calls Gozi one of the "bigger names out there in the criminal underground" when it comes to banking malware kits.

"Unfortunately, a huge supply of these malware kits remains," he says. "Even if we were to see a short dip in total malware attacks in this particular space, it won't last. There's just too much money for the bad guys to be made."

Still, while he acknowledged the battle against such malware to be ongoing, Trusteer Senior Security Strategist George Tubin calls news of the arrests fantastic.

"One of the major ongoing issues and reasons why this entire underground market that uses advanced malware to commit cybercrime exists is that they operate under the assumption of impunity," he says. "They feel this way because the Internet provides a level of anonymity, coupled with the fact that the cybercriminals reside predominantly in locations where the relationship with U.S. and other international authorities are not the most cooperative. So anytime the authorities capture and charge cybercriminals, it sends a clear message to existing and potential criminals that there will be repercussions to their illegal actions."

The trio is facing a bevy of charges. If given the maximum sentence on all counts, Kuzmin faces 95 years in prison, while Calovskis and Paunescu face 67 and 60 years, respectively.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Ninja
2/2/2013 | 5:23:39 PM
re: Alleged Gozi Trojan Creator Among Three Charged by Authorities

My Information Securities
professor always said to use your powers for good and not evil. It appears that
this is what she was referring to. It also sounds like they are trying to make
examples of these guys, That is an awful longtime in prison, George Tubin was
right 60-95 years in prison definitely is a clear message.

Paul Sprague

InformationWeek Contributor


User Rank: Strategist
1/24/2013 | 3:45:17 PM
re: Alleged Gozi Trojan Creator Among Three Charged by Authorities
So true--Gozi is still alive and well.

Kelly Jackson Higgins, Senior Editor
Dark Reading
Larry Seltzer - UBM Tech
Larry Seltzer - UBM Tech,
User Rank: Apprentice
1/24/2013 | 1:02:19 AM
re: Alleged Gozi Trojan Creator Among Three Charged by Authorities
Yeah, it's good news, but unlike most criminal conspiracies, when you bust the perps in a bank trojan ring the victims keep piling up. At least at some level
US Formally Attributes SolarWinds Attack to Russian Intelligence Agency
Jai Vijayan, Contributing Writer,  4/15/2021
Dependency Problems Increase for Open Source Components
Robert Lemos, Contributing Writer,  4/14/2021
FBI Operation Remotely Removes Web Shells From Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/14/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: "Elon, I think our cover's been blown."
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-04-22
HashiCorp Vault and Vault Enterprise Cassandra integrations (storage backend and database secrets engine plugin) did not validate TLS certificates when connecting to Cassandra clusters. Fixed in 1.6.4 and 1.7.1
PUBLISHED: 2021-04-22
HashiCorp Vault and Vault Enterprise 1.5.1 and newer, under certain circumstances, may exclude revoked but unexpired certificates from the CRL. Fixed in 1.5.8, 1.6.4, and 1.7.1.
PUBLISHED: 2021-04-22
HashiCorp Terraform’s Vault Provider (terraform-provider-vault) did not correctly configure GCE-type bound labels for Vault’s GCP auth method. Fixed in 2.19.1.
PUBLISHED: 2021-04-22
Bad validation logic in the Dart SDK versions prior to 2.12.3 allow an attacker to use an XSS attack via DOM clobbering. The validation logic in dart:html for creating DOM nodes from text did not sanitize properly when it came across template tags.
PUBLISHED: 2021-04-22
FusionAuth fusionauth-samlv2 before 0.5.4 allows XXE attacks via a forged AuthnRequest or LogoutRequest because parseFromBytes uses javax.xml.parsers.DocumentBuilderFactory unsafely.