Alleged Gozi Trojan Creator Among Three Charged by Authorities

Federal authorities unsealed indictments against three individuals tied to the creation of the notorious Gozi Trojan.

According to authorities, the Gozi malware infected more than one million computers around the world, causing tens of millions of dollars in damages. The FBI names Russian national Nikita Kuzmin, 25, as the creator of the malware. Two others – Latvia national Deniss Calovskis, 27, and Romanian national Mihai Ionut Paunescu, 28 – are accused of playing roles in the spread of Gozi as well, with Calovskis said to have written some of the code that made the malware effective.

Kuzmin was arrested in the U.S. in November 2010, and pled guilty the following year to charges of computer intrusion and fraud. Calovskis meanwhile was arrested in Latvia in November 2012, and Paunescu, who is accused of running a bulletproof hosting service for criminals distributing the malware, was arrested in Romania in December.

“This long-term investigation uncovered an alleged international cyber crime ring whose far-reaching schemes infected at least one million computers worldwide and 40,000 in the U.S. and resulted in the theft or loss of tens of millions of dollars," says FBI Assistant Director in Charge George Venizelos, in a statement. "Banking Trojans are to cyber criminals what safe-cracking or acetylene torches are to traditional bank burglars—but far more effective and less detectable."

Attackers have used the Gozi malware in to infect computers around the globe, including computers at NASA, authorities said. Police believe Kuzmin conceived of Gozi in 2005 when he created a list of technical specifications for the malware and hired a computer programmer to write its source code. Once Gozi had been coded, Kuzmin began providing it to co-conspirators in exchange for a weekly fee through a business he ran called "76 Service," authorities alleged. Beginning in 2009, he is accused of beginning to sell the malware to customers outright.

According to the FBI, Calovskis was hired to develop Web injects that altered how the Web pages of particular banks appeared on infected computers. When a victim used an infected computer to browse the bank's Web page, they would be duped into entering personal information into the page supplied by attackers.

Roel Schouwenberg, senior researcher, Kaspersky Lab, calls Gozi one of the "bigger names out there in the criminal underground" when it comes to banking malware kits.

"Unfortunately, a huge supply of these malware kits remains," he says. "Even if we were to see a short dip in total malware attacks in this particular space, it won't last. There's just too much money for the bad guys to be made."

Still, while he acknowledged the battle against such malware to be ongoing, Trusteer Senior Security Strategist George Tubin calls news of the arrests fantastic.

"One of the major ongoing issues and reasons why this entire underground market that uses advanced malware to commit cybercrime exists is that they operate under the assumption of impunity," he says. "They feel this way because the Internet provides a level of anonymity, coupled with the fact that the cybercriminals reside predominantly in locations where the relationship with U.S. and other international authorities are not the most cooperative. So anytime the authorities capture and charge cybercriminals, it sends a clear message to existing and potential criminals that there will be repercussions to their illegal actions."

The trio is facing a bevy of charges. If given the maximum sentence on all counts, Kuzmin faces 95 years in prison, while Calovskis and Paunescu face 67 and 60 years, respectively.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.