Loading story…
A U.S. federal jury convicted Russian national Oleg Koshkin for operating malware crypter services that helped the Kelihos botnet evade antivirus detection and spread malicious payloads. Prosecutors said Koshkin ran sites including Crypt4U.com, Crypt4U.net, fud.bz, and fud.re, advertising tools that made malware such as botnets, RATs, keyloggers, stealers, crypto miners, and ransomware fully undetectable. Court evidence showed Kelihos operator Peter Levashov paid roughly $3,000 per month from 2014 to 2017 for custom high-volume re-crypting, while co-defendant Pavel Tsurkan pleaded guilty to aiding malware infections worldwide, including ransomware attacks.
The conviction builds on the broader U.S. campaign against Kelihos, a botnet active since at least 2010 that at various points controlled 60,000 to more than 100,000 compromised Windows computers. Authorities said the botnet was used for spam, credential theft, pump-and-dump stock fraud, denial-of-service activity, and malware distribution before the FBI and partners including CrowdStrike and the Shadowserver Foundation disrupted it through a sinkholing operation and Levashov’s arrest in Spain. Investigators linked Levashov to the infrastructure through IP and account records, with reporting noting operational security mistakes such as reused credentials that helped expose him.
See the reporting duties and controls this puts on the clock.
9 events from the most recent confirmed update back to the earliest known activity.
Oleg Koshkin was arrested in California in September 2019 for operating a crypting service used to conceal malware and support Kelihos-related cybercrime.
In September 2018, Peter Levashov pleaded guilty to causing intentional damage to a protected computer, conspiracy, wire fraud, and aggravated identity theft.
The FBI dismantled Kelihos in April 2017, disrupting a botnet reported to control at least 60,000 compromised computers worldwide.
Spanish authorities arrested Peter Levashov in April 2017 as U.S. authorities launched a global operation to disrupt the Kelihos botnet.
Peter Levashov began paying Oleg Koshkin about $3,000 per month for a custom high-volume crypting service used to repeatedly re-crypt Kelihos malware.
Kelihos had been active since 2010, infecting Windows systems and supporting spam, credential theft, and malware distribution.
Koshkin co-defendant Pavel Tsurkan pleaded guilty to aiding and abetting malware infections worldwide, including ransomware attacks.
A federal jury in Connecticut convicted Koshkin on charges related to operating Crypt4U and related services that helped malware evade antivirus detection.
The Justice Department announced a global disruption effort against Kelihos, using a sinkhole operation with assistance from CrowdStrike and the Shadowserver Foundation to sever botnet communications.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See what this changes for your reporting obligations and which controls it puts on the clock.
4 references tracked. Mallory keeps watching after this page renders.
justice.gov
Open sourcebleepingcomputer.com
Open sourcewired.com
Open sourcecyberscoop.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Department of Justice disrupted the **Kelihos** botnet, a network of more than 100,000 compromised Windows computers allegedly controlled by Russian national **Peter Yuryevich Levashov** (also known as **Peter Severa**). Authorities said Kelihos had operated since 2010 and was used to send spam, steal passwords and credentials, distribute malware, and support pump-and-dump stock fraud. The FBI linked Levashov to the infrastructure through IP addresses and online account records, while working with CrowdStrike and the Shadowserver Foundation to sinkhole the botnet and cut communications between infected machines and their controllers.
Aug 15, 2026
The United States sentenced **Yaroslav Vasinskyi** (`Rabotnik`), a Ukrainian affiliate of the **Sodinokibi/REvil** ransomware operation, to **13 years and 7 months** in prison for his role in more than **2,500 attacks** that collectively sought over **$700 million** in ransom payments. Prosecutors said the scheme encrypted victim networks, threatened to leak stolen data, and used cryptocurrency exchangers and mixing services to launder proceeds; the court also ordered more than **$16 million** in restitution. U.S. authorities said related forfeiture actions recovered assets including **39.89138522 Bitcoin** and **$6.1 million**, and credited cooperation with Polish authorities for Vasinskyi’s extradition and prosecution. In a separate but related enforcement action, **Deniss Zolotarjovs**, a Latvian national tied to the **Karakurt** extortion operation and linked by investigators to the broader **Conti** ecosystem, was sentenced to **102 months** in prison after U.S. prosecutors accused him of helping pressure victims with stolen data, reviving unresolved extortion cases, and laundering cryptocurrency. Authorities said the Russian-linked group targeted more than **54 companies worldwide**, including victims whose stolen records included sensitive medical information, and generated losses exceeding **$56 million** across 13 victims with roughly **$13 million** more paid by 41 additional companies. The cases underscore sustained cross-border law enforcement action against ransomware and data-extortion actors operating through Russia-linked criminal networks.
Jun 29, 2026
Russian national **Vladimir Dunaev** pleaded guilty in U.S. federal court for helping develop and deploy **TrickBot**, a malware platform used to steal credentials, harvest data, evade security tools, and enable ransomware attacks against hospitals, schools, businesses, and other victims. Prosecutors said TrickBot infected millions of computers, caused tens of millions of dollars in losses in the United States, and stole more than **$180 million** worldwide. Dunaev was arrested in South Korea on a U.S. extradition request, transferred to the United States in 2021, and now faces up to **35 years** in prison; his plea follows earlier action against alleged TrickBot developer **Alla Witte** and sanctions targeting other members the U.S. linked to Russian intelligence services. The guilty plea comes amid a broader U.S. crackdown on the **TrickBot-Conti** ecosystem, with federal indictments accusing multiple Russian nationals of developing, operating, and profiting from malware and ransomware campaigns tied to **Conti**, **Ryuk**, **Anchor**, **BazaLoader**, and related tooling. Court filings and security research describe TrickBot as both an initial-access and post-compromise framework: spam campaigns delivered obfuscated loaders, operators used browser manipulation and antivirus-evasion techniques, and intrusions progressed through credential dumping, domain enumeration, lateral movement, and **Cobalt Strike** activity before ransomware deployment. One indictment specifically tied alleged member **Maksim Galochkin** to the 2021 Conti attack on **Scripps Health**, while separate research has examined internal TrickBot roles and disputed attribution of the handle `bentley` among senior operators.
Aug 15, 2026