Preet Bharara, the United States Attorney for the Southern District
of New York; Lanny A. Breuer, the Assistant Attorney General of the U.S.
Department of Justice’s Criminal Division; and George Venizelos, the
Assistant Director in Charge of the New York Field Office of the Federal
Bureau of Investigation (FBI), announced today the unsealing of
indictments against three individuals who played critical roles in
creating and distributing the Gozi virus, one of the most financially
destructive computer viruses in history. The Gozi virus infected over
one million computers globally and caused tens of millions of dollars in
losses. Nikita Kuzmin, a Russian national who created the Gozi virus,
was arrested in the U.S. in November 2010 and pled guilty before U.S.
District Judge Leonard B. Sand to various computer intrusion and fraud
charges in May 2011. Deniss Calovskis, a/k/a “Miami,” a Latvian national
who allegedly wrote some of the computer code that made the Gozi virus
so effective, was arrested in Latvia in November 2012. Mihai Ionut
Paunescu, a/k/a “Virus,” a Romanian national who allegedly ran a
“bulletproof hosting” service that enabled cyber criminals to distribute
the Gozi virus, the Zeus trojan, and other notorious malware and to
conduct other sophisticated cyber crimes, was arrested in Romania in
December 2012.
Manhattan U.S. Attorney Preet Bharara said, “In an information-age
update on Willie Sutton, these men allegedly ran a modern day bank
robbery ring, and like Sutton, they targeted banks because that’s where
the money still is. But as we have seen with increasing frequency, cyber
criminals’ bank heists require neither a mask nor a gun, just a clever
program and an Internet connection. This case should serve as a wake-up
call to banks and consumers alike, because cyber crime remains one of
the greatest threats we face, and it is not going away any time soon.”
FBI Assistant Director in Charge George Venizelos said, “This
long-term investigation uncovered an alleged international cyber crime
ring whose far-reaching schemes infected at least one million computers
worldwide and 40,000 in the U.S. and resulted in the theft or loss of
tens of millions of dollars. Banking trojans are to cyber criminals what
safe-cracking or acetylene torches are to traditional bank burglars—but
far more effective and less detectable. The investigation put an end to
the Gozi virus.”
According to the allegations in the indictments and the complaint unsealed today in Manhattan federal court:
The Gozi Virus
The Gozi virus is malicious computer code, or “malware,” that steals
personal bank account information, including usernames and passwords,
from the users of affected computers. It was named by private sector
information security experts in the U.S. who, in 2007, discovered that
previously unrecognized malware was stealing personal bank account
information from computers across Europe on a vast scale, while
remaining virtually undetectable in the computers it infected. To date,
the Gozi virus has infected over one million victim computers worldwide,
among them at least 40,000 computers in the U.S., including computers
belonging to the National Aeronautics and Space Administration (NASA),
as well as computers in Germany, Great Britain, Poland, France, Finland,
Italy, Turkey, and elsewhere, and it has caused tens of millions of
dollars in losses to the individuals, businesses, and government
entities whose computers were infected.
The Gozi virus was distributed to victims’ computers in several
different ways. In one method, the virus was disguised as an apparently
benign .pdf document which, when opened, secretly installed the Gozi
virus on the victim’s computer. Once installed, the Gozi virus—which was
intentionally designed to be undetectable by anti-virus
software—collected data from the infected computer in order to capture
personal bank account information including usernames and passwords.
That data was then transmitted to various computer servers controlled by
the cyber criminals who used the Gozi virus. These cyber criminals then
used the personal bank account information to transfer funds out of the
victims’ bank accounts and ultimately into their own personal
possession.
The Creation of the Gozi Virus
Kuzmin conceived of the Gozi virus in 2005 when he created a list of
technical specifications for the virus and hired a sophisticated
computer programmer (CC-1) to write its source code, which is the unique
code that enabled the Gozi virus to operate. Once the Gozi virus had
been coded, Kuzmin began providing it to co-conspirators in exchange for
a weekly fee through a business he ran called “76 Service.” Through 76
Service, Kuzmin made the Gozi virus available to co-conspirators,
allowed them to configure the virus to steal data of their choosing, and
stored the stolen data for them. He advertised 76 Service on one or
more Internet forums devoted to cyber crime and other criminal
activities. Beginning in 2009, Kuzmin began to sell the Gozi virus
outright to his co-conspirators.
The Refinement of the Gozi Virus
Kuzmin and his co-conspirators regularly paid others to refine,
update, and improve the Gozi virus. For example, Calovskis, a
co-conspirator, was hired to develop certain computer code, known as
“web injects,” which altered how the webpages of particular banks
appeared on infected computers. Specifically, Calovskis’s web injects
changed the webpages of banks so that, when a victim used an infected
computer to access the webpage, the victim was tricked into divulging
additional personal information that cyber criminals would need in order
to successfully steal money from the victim’s bank account. One web
inject Calovskis designed altered the customer welcome page of a bank so
that the victim was prompted to disclose additional personal
information—mother’s maiden name, Social Security number, driver’s
license information, and a PIN code—in order to continue accessing the
website.
The Gozi Virus and Bulletproof Hosting Services
”Bulletproof hosting” services helped cyber criminals distribute the
Gozi virus with little fear of detection by law enforcement. Bulletproof
hosts provided cyber criminals using the Gozi virus with the critical
online infrastructure they needed, such as Internet protocol (“IP”)
addresses and computer servers, in a manner designed to enable them to
preserve their anonymity.
Paunescu operated a “bulletproof host” that helped cyber criminals
distribute the Gozi virus and commit other cyber crimes, such as
distributing malware including the “Zeus trojan” and the “SpyEye
trojan,” initiating and executing distributed denial of service (DDoS)
attacks, and transmitting spam. Paunescu rented servers and IP addresses
from legitimate Internet service providers and then in turn rented them
to cyber criminals; provided servers that cyber criminals used as
command-and-control servers to conduct DDoS attacks; monitored the IP
addresses that he controlled to determine if they appeared on a special
list of suspicious or untrustworthy IP addresses; and relocated his
customers’ data to different networks and IP addresses, including
networks and IP addresses in other countries, to avoid being blocked as a
result of private security or law enforcement scrutiny.
* * *
A chart setting forth the names, ages and residences of the
defendants, the charges each defendant faces, and the statutory maximum
penalty associated with these charges is at the conclusion of this
release. Extradition proceedings against Calovskis in Latvia and
Paunescu in Romania are ongoing.
The case against Paunescu is being prosecuted jointly with the
Department of Justice’s Computer Crime and Intellectual Property Section
(CCIPS), which is overseen by Assistant Attorney General Lanny A.
Breuer. Mr. Bharara thanked CCIPS for its important partnership in this
matter, and he also thanked the Department of Justice’s Office of
International Affairs. Mr. Bharara praised the FBI for its outstanding
work in the investigation, which he noted is ongoing. He also specially
thanked the National Aeronautics and Space Administration Office of
Inspector General, the Central Criminal Police Department of the Latvian
State Police, the Romanian Intelligence Service, the Romanian
Directorate for Combating Organized Crime, the Romanian Directorate for
Investigating Organized Crime and Terrorism, and the Romanian Ministry
of Justice.
The cases are being handled by the Complex Frauds Unit of the United
States Attorney’s Office. Assistant United States Attorneys Sarah Lai,
Nicole Friedlander, and Thomas G.A. Brown, along with Trial Attorney
Carol Sipperly of the Computer Crime and Intellectual Property Section
of the Department of Justice on the Paunescu case, are in charge of the
prosecution.
The charges contained in the Indictments are merely accusations, and
the defendants are presumed innocent unless and until proven guilty.
