Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


05:11 PM

Alleged Gozi Trojan Creator Among Three Charged by Authorities

Three people are facing decades behind bars if convicted of having roles in the malware's spread

Federal authorities unsealed indictments against three individuals tied to the creation of the notorious Gozi Trojan.

According to authorities, the Gozi malware infected more than one million computers around the world, causing tens of millions of dollars in damages. The FBI names Russian national Nikita Kuzmin, 25, as the creator of the malware. Two others – Latvia national Deniss Calovskis, 27, and Romanian national Mihai Ionut Paunescu, 28 – are accused of playing roles in the spread of Gozi as well, with Calovskis said to have written some of the code that made the malware effective.

Kuzmin was arrested in the U.S. in November 2010, and pled guilty the following year to charges of computer intrusion and fraud. Calovskis meanwhile was arrested in Latvia in November 2012, and Paunescu, who is accused of running a bulletproof hosting service for criminals distributing the malware, was arrested in Romania in December.

“This long-term investigation uncovered an alleged international cyber crime ring whose far-reaching schemes infected at least one million computers worldwide and 40,000 in the U.S. and resulted in the theft or loss of tens of millions of dollars," says FBI Assistant Director in Charge George Venizelos, in a statement. "Banking Trojans are to cyber criminals what safe-cracking or acetylene torches are to traditional bank burglars—but far more effective and less detectable."

Attackers have used the Gozi malware in to infect computers around the globe, including computers at NASA, authorities said. Police believe Kuzmin conceived of Gozi in 2005 when he created a list of technical specifications for the malware and hired a computer programmer to write its source code. Once Gozi had been coded, Kuzmin began providing it to co-conspirators in exchange for a weekly fee through a business he ran called "76 Service," authorities alleged. Beginning in 2009, he is accused of beginning to sell the malware to customers outright.

According to the FBI, Calovskis was hired to develop Web injects that altered how the Web pages of particular banks appeared on infected computers. When a victim used an infected computer to browse the bank's Web page, they would be duped into entering personal information into the page supplied by attackers.

Roel Schouwenberg, senior researcher, Kaspersky Lab, calls Gozi one of the "bigger names out there in the criminal underground" when it comes to banking malware kits.

"Unfortunately, a huge supply of these malware kits remains," he says. "Even if we were to see a short dip in total malware attacks in this particular space, it won't last. There's just too much money for the bad guys to be made."

Still, while he acknowledged the battle against such malware to be ongoing, Trusteer Senior Security Strategist George Tubin calls news of the arrests fantastic.

"One of the major ongoing issues and reasons why this entire underground market that uses advanced malware to commit cybercrime exists is that they operate under the assumption of impunity," he says. "They feel this way because the Internet provides a level of anonymity, coupled with the fact that the cybercriminals reside predominantly in locations where the relationship with U.S. and other international authorities are not the most cooperative. So anytime the authorities capture and charge cybercriminals, it sends a clear message to existing and potential criminals that there will be repercussions to their illegal actions."

The trio is facing a bevy of charges. If given the maximum sentence on all counts, Kuzmin faces 95 years in prison, while Calovskis and Paunescu face 67 and 60 years, respectively.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Oldest First  |  Newest First  |  Threaded View
Larry Seltzer - UBM Tech
Larry Seltzer - UBM Tech,
User Rank: Apprentice
1/24/2013 | 1:02:19 AM
re: Alleged Gozi Trojan Creator Among Three Charged by Authorities
Yeah, it's good news, but unlike most criminal conspiracies, when you bust the perps in a bank trojan ring the victims keep piling up. At least at some level
User Rank: Strategist
1/24/2013 | 3:45:17 PM
re: Alleged Gozi Trojan Creator Among Three Charged by Authorities
So true--Gozi is still alive and well.

Kelly Jackson Higgins, Senior Editor
Dark Reading
User Rank: Ninja
2/2/2013 | 5:23:39 PM
re: Alleged Gozi Trojan Creator Among Three Charged by Authorities

My Information Securities
professor always said to use your powers for good and not evil. It appears that
this is what she was referring to. It also sounds like they are trying to make
examples of these guys, That is an awful longtime in prison, George Tubin was
right 60-95 years in prison definitely is a clear message.

Paul Sprague

InformationWeek Contributor


Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-04-17
The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivile...
PUBLISHED: 2021-04-17
Shiftfs, an out-of-tree stacking file system included in Ubuntu Linux kernels, did not properly handle faults occurring during copy_from_user() correctly. These could lead to either a double-free situation or memory not being freed at all. An attacker could use this to cause a denial of service (ker...
PUBLISHED: 2021-04-17
A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: QTS Build 20210202 and later Q...
PUBLISHED: 2021-04-17
An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on. If exploited, the vulnerability allows remote attackers to obtain application information. QNAP has already fixed this vulnerability in the following versions of Multimedia C...
PUBLISHED: 2021-04-16
jose-node-esm-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDe...