Three charged in Gozi Trojan bank raids

12 years ago

United States prosecutors accused three people of creating and distributing a virulent malware which has infected more than a million computers around the world including those operated by the U.S. National Aeronautic Space Administration.

Nikita Kuzmin, 25, or Russia, Deniss Colovski, 27, of Latvia and Mihaj Ionut Paunescu, 28 of Romania, were behind a long-running scam which involved the creation and distribution of the so-called Gozi Trojan that helped cyber criminals siphon millions of dollars from bank accounts from the U.S., Europe and other countries, according to an indictment unsealed on Wednesday.

Alleged mastermind Kuzmin, was arrested in the U.S. back in November 2010 and pled guilty to a number of computer hacking and fraud charges in 2011. Calovski is alleged to have helped in programing Gozi. He was arrested in Latvia in November 2012. Paunescu, is alleged to have provided the hosting service that enabled Kuzmin and other cyber criminals to distribute Gozi and other malware. He was arrested in Romania in December 2012.

U.S. prosecutors are seeking the extradition of Paunescu and Calovski.

The Gozi Trojan first appeared in 2007 and since then had infected Microsoft Windows computers in the United Kingdom, France, Italy, Finland, Poland, Turkey and the U.S. Gozi often avoids detection by being disguised as a harmless PDF document. Since 2009, Kuzmin had been selling the source code for the Trojan to other cyber criminals, some of whom actually took the time to refine it.

One of Gozi’s variants is capable of changing a bank’s online welcome page on a compromised machine. The Trojan tricks the user in to disclosing personal information such as mother’s maiden name, social security number, driver’s licence and PIN number.

Read the whole story here