US takes down huge botnet as Spain arrests notorious Russian hacker (Update)

April 11, 2017 by Paul Handley
Investigators said Levashov was believed to have been "carrying out this type of (hacking) activity for more than 10 years, earning huge profits"

US authorities moved Monday to take down a global computer botnet behind the massive theft of personal data and unwanted spam emails, as Spain arrested the notorious Russian hacker who operated it.

US authorities say the Russian, Piotr or Peter Levashov, had operated the Kelihos network of tens of thousands of infected computers, stealing personal data and renting the network out to others to send spam emails by the millions and extort ransom from computer owners.

Levashov, also known in the hacking world as Peter Severa, was arrested at Barcelona airport on Friday at the US request.

A Spanish judge on Monday ordered him to be remanded in custody as Washington is expected to seek his extradition. The US has 40 days to present evidence.

A US indictment unsealed Monday said Levashov, 36 and a native of St. Petersburg, had operated the Kelihos botnet since around 2010.

Two years earlier he was already in the sights of US investigators running another botnet and managing the spam operations of a major US spammer, Alan Ralsky. Ralsky and others were jailed in that case but Levashov was never caught.

100,000 computers infected

The Kelihos network is made up of private computers around the world running on the Microsoft Window operating system. The computers are infected with malware that gives Levashov the ability to control them remotely, with the owners completely unaware.

According to the Justice Department, at times the number of computers in the network has topped 100,000, with between five and 10 percent of them in the United States.

Through underground networks, Kelihos sold the network's services to others, who would use it to send out spam emails advertising counterfeit drugs, work-at-home scams, and other fraud schemes, the indictment said.

They were also used for illegal "pump-and-dump" stock market manipulation schemes, and to spread other malware through which hackers could steal a user's banking account information including passwords, and lock up a computer's information to demand huge ransoms.

Levashov was proud of his work. According to Justice Department filings, earlier this year he posted an ad for his work noting he had been in the spam business "since the distant year 1999."

"During these years there has not been a single day that I keep still, by constantly improving quality of spamming," he said.

His prices rose with the illegality of the operation. For legal ads, he charged $200 per million spam emails. For scams and phishing attacks, it was $500 per million.

To help someone with a stock manipulation, he wanted a deposit of $5,000-$10,000 to share his list of 25 million traders. He also demanded 5 percent of the gains made on the stock.

The Spamhaus Project, which documents spam, botnets, malware and other abuse, listed Levashov as seventh on its "10 Worst Spammers" list and "one of the longest operating criminal spam-lords on the internet."

"The ability of botnets like Kelihos to be weaponized quickly for vast and varied types of harms is a dangerous and deep threat to all Americans, driving at the core of how we communicate, network, earn a living, and live our everyday lives," said Acting US Assistant Attorney General Kenneth Blanco in a statement.

Taking over the network

Levashov's arrest was unrelated to investigations into Russian interference in last year's US presidential election, US officials said.

Earlier, the suspect's wife had earlier told Russia Today that his arrest was connected to the election hacking case.

In parallel with the arrest, US justice authorities announced an extraordinary move to bring down the Kelihos network, obtaining warrants that allows it to take control of the computers in the botnet by changing the malware to intercept its operation.

That will direct the Kelihos traffic to "sinkhole" servers set up by authorities, overtime eliminating traffic through Levashov's server network.

Such a move appeared to be the first ever application of controversial new investigative powers for US authorities which took effect late last year.

While the move will give them access to private computers, investigators pledged to guard the privacy of computer owners.

"This operation will not capture content from the target computers or modify them in any other capacity except limiting the target computers' ability to interact with the Kelihos botnet," the warrant said.

Explore further: Microsoft busts spam network

Related Stories

Microsoft busts spam network

September 27, 2011

Microsoft on Tuesday said it struck another blow in its battle against cyber crooks by busting a spam-sending network of virus-infected computers.

Mumblehard Linux botnet no longer active, takedown declared

April 11, 2016

(Tech Xplore)—The Mumblehard Linux botnet is out of the way. Malware researcher Marc-Etienne M. Léveillé trumpeted the good news on WeLiveSecurity from security company ESET: Mumblehard has been struck down, which means ...

Bank-stealing malware returns after US crackdown

July 11, 2014

Malicious software used to steal millions from bank accounts has re-emerged a month after US authorities broke up a major hacker network using the scheme, security researchers say.

Authorities bust 3 in infection of 13M computers

March 2, 2010

(AP) -- Authorities have smashed one of the world's biggest networks of virus-infected computers. It was a data vacuum that stole credit cards and online banking credentials from as many as 12.7 million poisoned PCs.

Recommended for you

Permanent, wireless self-charging system using NIR band

October 8, 2018

As wearable devices are emerging, there are numerous studies on wireless charging systems. Here, a KAIST research team has developed a permanent, wireless self-charging platform for low-power wearable electronics by converting ...

Facebook launches AI video-calling device 'Portal'

October 8, 2018

Facebook on Monday launched a range of AI-powered video-calling devices, a strategic revolution for the social network giant which is aiming for a slice of the smart speaker market that is currently dominated by Amazon and ...

Artificial enzymes convert solar energy into hydrogen gas

October 4, 2018

In a new scientific article, researchers at Uppsala University describe how, using a completely new method, they have synthesised an artificial enzyme that functions in the metabolism of living cells. These enzymes can utilize ...

0 comments

Please sign in to add a comment. Registration is free, and takes less than a minute. Read more

Click here to reset your password.
Sign in to get notified via email when new comments are made.