On April 10, 2017, the U.S. Department of Justice announced that the U.S. government was in the process of taking steps to dismantle a Russian botnet responsible for infecting tens of thousands of computers to facilitate criminal activities. The Kelihos botnet, announced by Acting Assistant Attorney General Kenneth A. Blanco, was responsible for, “distributing hundreds of millions of fraudulent e-mails per year, intercepting the credentials to online and financial accounts belonging to thousands of Americans, and spreading ransomware throughout our networks.” The FBI announced that it had, as of April 8, 2017, begun what FBI Special Agent in Charge Marlin Ritzman described as the “extraordinary task” of blocking malicious domains associated with the Kelihos botnet, preventing those domains from being accessed in the United States, and thus protecting American citizens from further harm.
The Department of Justice announcement comes as, over the preceding weekend, Spanish officials arrested and detained 36-year old Russian national Peter Levashov in response to an FBI request. Levashov is suspected of being the operator of the Kelihos botnet, who works under the alias Peter Severa. Levashov has been indicted in the U.S. twice previously on computer crime-related charges, and is number 6 on the list of the World’s Ten Worst Spammers, a list maintained by the anti-spam organization Spamhaus.
The arrest is the result of years of concerted effort by U.S. agents, who had been monitoring Levashov since at least 2006. When Levashov took a vacation to Barcelona, the FBI saw an opportunity, contacting the Spanish police, who entered Levashov’s hotel on Friday, April 7, and made the arrest.
Levashov, according to the complaint, had gained unauthorized access to a network of over 100,000 computers, and used those computers to engage in the lucrative practice of spam campaigns. According to a New York Times report, the cost of a Kelihos spam campaign “ranged from $200 to $500 per one million email messages, … [and] Mr. Levashov charged more to target American computers, an indication that these were a higher priority.”
Mr. Levashov also used his spam campaigns for political purposes, though he is not accused of having any involvement in the plot to influence the 2016 U.S. Presidential election. In 2012, Levashov’s botnet sent emails intended to discredit the leading challenger to Russian President Vladimir Putin ahead of that year’s Russian federal election. The emails contained links to fake news stories which alleged that the challenger, businessman Mikhail Prokhorov, had come out as gay.
The civil complaint can be found here: https://www.justice.gov/opa/press-release/file/956506/download
The press release announcing the actions against the Kelihos botnet can be found here: https://www.justice.gov/opa/press-release/file/956506/download