Feds finally shut down botnet that menaced world for 7 years

Federal prosecutors say they've dealt a fatal blow to Kelihos, a network of more than 10,000 infected computers that was used to deliver spam, steal login passwords, and deliver ransomware and other types of malware since 2010.

The US Justice Department announced the takedown on Monday, one day after authorities in Spain reportedly arrested alleged Kelihos operator Pyotr Levashov, according to Reuters. The programmer and alleged botnet kingpin was apprehended after traveling with his family from their home in Russia, which doesn't have an extradition treaty with the US, to Spain, which does have such a treaty. A search warrant application unsealed Monday said prosecutors tied Levashov to Kelihos because he used the same IP address to operate Kelihos and to access his pete777@mail.ru e-mail account. The e-mail address and IP addresses were also associated with multiple online accounts in Levashov's name, including Apple iCloud and Google Gmail accounts.

On Monday, US officials also unsealed a criminal complaint against Levashov that charged him with wire fraud and unauthorized interception of electronic communications. Levashov allegedly operated Kelihos since 2010. According to authorities, he used the botnet to further a spamming operation that distributed hundreds of millions of e-mails per year pushing counterfeit drugs, work-at-home, and pump-and-dump stock scams. Prosecutors also alleged the defendant used Kelihos to install malware on end-user computers and to harvest passwords to online and financial accounts belonging to thousands of Americans.

Levashov, believed to reside in St. Petersburg, has been wanted on criminal charges since before the days of Kelihos. In 2009, he was charged in the District of Columbia with operating the "Storm" botnet. He's long been on a list of the World's Ten Worst Spammers, maintained by antispam volunteer organization Spamhaus.

The feds obtained court permission to redirect Kelihos-infected computers to benign servers operated by authorities instead of the servers the botnet relied on to issue commands and distribute updates. The process is known as "sinkholing." Prosecutors also obtained court permission to block any attempts by Kelihos to regain control of the sinkholed computers. Officials now plan to provide the IP addresses of infected computers connecting to the sinkhole to unspecified groups that will help in getting the machines disinfected.

Federal officials said they worked with security firm CrowdStrike and The Shadowserver Foundation, a volunteer group that gathers information about online crime. Federal prosecutors said they also worked with their law-enforcement counterparts from around the world. The botnet takedown received authorization under Rule 41 of the Federal Rules of Criminal Procedure.