Hackers sentenced to 24 years for preeminent banking virus

Hackers sentenced to 24 years for preeminent banking virus

Two international hackers have been sentenced to a combined 24 years in U.S. prison for developing and distributing a computer virus that drained hundreds of millions of dollars from banks around the world.

ADVERTISEMENT

The malware SpyEye — a so-called Trojan, or virus disguised as legitimate software — was used by a global syndicate of cyber criminals to infect over 50 million computers, costing almost $1 billion around the globe.

It was the preeminent malware banking Trojan from 2010 to 2012, according to the Justice Department.

“Through these arrests and sentencing, the risk the public unknowingly faced from the threat posed by the imminent release of a new highly sophisticated version of SpyEye was effectively reduced to zero,” said J. Britt Johnson, special agent in charge in the FBI’s Atlanta field office.

Russian national Aleksandr Andreevich Panin was sentenced to nine years and six months, followed by three years of supervised release. Hamza Bendelladj of Algeria was sentenced to 15 years followed by three years of supervised release. 

Panin — known as Gribodemon online — was the primary developer and distributor of the virus. He created SpyEye as a successor to the notorious Zeus malware, which infected up to 1 million computers worldwide in 2014 alone and stole banking and other personal information.

Like Zeus, SpyEye allowed the hackers to steal data by tricking users into clicking on links or attachments in fake emails. Once SpyEye had infiltrated a system, it could monitor the computer and steal data.

Panin conspired with others, including co-defendant Bendelladj, to market and sell various components of the virus online. Criminals could customize their purchases to target specific financial institutions or include tailor-made methods of pilfering personal and financial data.

Arrested by U.S. authorities in Atlanta in 2013, Panin pleaded guilty to conspiring to commit wire fraud and bank fraud in January 2014. Bendelladj was apprehended in Bangkok, Thailand, in 2013 and was extradited to the U.S. the same year. He pleaded guilty to a 23-count indictment in June of last year.

The U.S. has been cracking down on Eastern European nationals who profit from spreading malware. Last fall, Russian national Dimitry Belorossov was sentenced to four and a half years in prison for his role in distributing and managing banking malware that infected over 11 million computers worldwide.

Belorossov used spam emails and commercial internet ads linking to malware to distribute and install a bot known as Citadel onto victims’ computers. At one point, he controlled over 7,000 bots, authorities say.

The FBI is still offering the largest reward for a cyber criminal for Evgeniy Bogachev, the elusive Russian hacker allegedly behind the Zeus malware. Panin allegedly received the source code for Zeus from Bogachev, which he used to help build SpyEye.

The agency last year unveiled a $3 million reward for any information leading to the arrest or capture of Bogachev, who remains at large.