Loading story…
Colombian authorities arrested Romanian national Mihai Ionut Paunescu, also known as "Virus," in Bogotá on U.S. charges tied to the Gozi banking trojan. Prosecutors allege Paunescu ran the bulletproof hosting service PowerHost[.]ro and helped protect and scale Gozi infrastructure after joining the operation around the release of Gozi 2.0. U.S. officials said the botnet infected more than one million computers between 2007 and 2013, stole online banking credentials, and enabled the theft of tens of millions of dollars from victims in the United States and Europe; authorities said they would pursue extradition from Colombia after earlier efforts in Romania failed.
The arrest adds to a case that previously saw Gozi creator Nikita Kuzmin sentenced in the United States after admitting to computer intrusion and fraud offenses, while investigators also tied Deniss Calovskis to web injects used against banks. Court filings said Kuzmin marketed Gozi through an early malware-as-a-service scheme known as "76 Service," renting the malware to other criminals. Security researchers have since linked Gozi’s leaked codebase to later malware families, including the advanced RM3 / Gozi-ISFB strain, which targeted more than 130 financial institutions across Oceania and Europe and expanded beyond credential theft into browser interception, hidden VNC, SOCKS proxying, remote shell access, and ransomware-enabling post-compromise activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
16 events from the most recent confirmed update back to the earliest known activity.
A short-lived RM3.at infrastructure appeared around summer 2019 and showed similarities with GoziAT infrastructure. The report cited it as part of RM3's evolving operational footprint.
Fox-IT reported that 2019 was a peak period for RM3 activity, with five operators active at the same time. Researchers also observed at least eight RM3 infrastructures across Europe, Oceania, and worldwide operations.
The actor known as Sagrid was identified as a prolific RM3 distributor, especially in Australia and New Zealand around 2018 and 2019. The campaigns commonly used malspam to spread the malware.
Fox-IT said the RM3 variant of Gozi/ISFB was detected in the wild in 2017 with major modifications from previous variants. Researchers described it as a heavily reworked strain with new modules and communications methods.
On May 2, 2016, Nikita Kuzmin was sentenced in Manhattan federal court to time served of 37 months and ordered to pay $6,934,979 in forfeiture and restitution. The Justice Department said Gozi had infected over one million computers and caused tens of millions of dollars in losses.
Deniss Calovskis was sentenced on January 5, 2016 to time served of 21 months for writing certain web injects used by Gozi to target particular banks. Prosecutors said his code helped tailor the malware to specific financial institutions.
The Fox-IT report states that Gozi ISFB began targeting financial institutions around 2013 to 2015. This marked the expansion of post-leak Gozi-derived malware activity.
Nikita Kuzmin was arrested in California in 2013 in connection with the Gozi case. Prosecutors identified him as the original creator of the banking trojan.
After the Gozi gang was charged in January 2013, the malware's source code leaked online. The leak later enabled multiple banking trojan strains including Gozi ISFB, Neverquest, Rovnix, Vawtrack, and Ursnif.
U.S. authorities officially charged Mihai Ionut Paunescu in January 2013 as one of three suspects accused of creating and operating the Gozi banking trojan. The case also involved Nikita Kuzmin and Deniss Calovskis.
Mihai Ionut Paunescu was arrested in Bucharest, Romania, in December 2012 for allegedly operating a bulletproof hosting service that enabled distribution of Gozi and other malware. He was later described as awaiting extradition to the United States.
Nikita Kuzmin pleaded guilty in May 2011 to computer intrusion and fraud charges pursuant to a cooperation agreement. He was later identified by prosecutors as the creator of the Gozi malware.
U.S. officials said Mihai Ionut Paunescu joined the Gozi operation in 2010 when the Gozi 2.0 variant was first released. Prosecutors alleged he helped protect and scale the malware's infrastructure through his bulletproof hosting service.
Computer network security experts first identified Gozi in approximately 2007 as malware that stole victims' bank account information on a widespread basis. Authorities later said the botnet infected more than one million computers between 2007 and 2013.
Colombian authorities arrested Mihai Ionut Paunescu at El Dorado airport in Bogotá in connection with longstanding U.S. charges tied to Gozi. Colombia's attorney general office announced the arrest on Thursday, and U.S. officials said they would begin new extradition proceedings there.
After the pandemic, RM3 activity shifted away from classic fraud toward bot harvesting and reconnaissance. Researchers observed tasking such as GET_SYSINFO and domain enumeration that they linked to ransomware-style triage.
3 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourceblog.fox-it.com
Open sourcejustice.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point Research reported that **Gozi** has remained a persistent banking malware threat by repeatedly reappearing in new forms and criminal operations. The malware family, also known through variants such as **Ursnif**, has been used to steal banking credentials and other sensitive information, while its leaked source code helped fuel years of adaptation by different threat actors. Researchers said Gozi’s long lifespan was driven by continuous redevelopment, modular capabilities, and reuse across financially motivated campaigns. Its evolution into numerous strains allowed operators to tailor infections, evade detection, and maintain the malware’s relevance as one of the most enduring credential-theft platforms in the cybercrime ecosystem.
Jun 29, 2026
U.S. and European authorities dismantled the **GozNym** cybercrime network, unsealing charges against 10 alleged members and coordinating arrests, extraditions, and prosecutions across the United States, Georgia, Ukraine, Moldova, Germany, and Bulgaria with support from **Europol** and **Eurojust**. Officials said the group operated as a cybercrime-as-a-service enterprise, combining malware development, phishing spam, crypting, bulletproof hosting, account takeover, and cash-out roles to target primarily U.S. businesses and financial institutions, while some suspects remained fugitives. Investigators said GozNym infected more than **41,000 computers** and was used in roughly **$100 million** in attempted fraud against victims in the United States and elsewhere. The malware was distributed through the **Avalanche** criminal infrastructure, a fast-flux botnet platform previously used by more than 20 malware families before its takedown, and Shadowserver said its sinkholing and victim-remediation reporting had helped protect about **2 million victim IP addresses daily** in the years following that operation.
Aug 15, 2026
The **Gozi/Ursnif/ISFB** banking trojan remained an active cybercrime threat across Europe and Japan, spreading mainly through targeted malspam and phishing emails carrying weaponized Word, XLS, ZIP, JavaScript, HTA, and macro-enabled attachments. Multiple campaigns used staged infection chains involving VBA macros, PowerShell, `rundll32`, HTA downloaders, and side-loaded DLLs, with distribution tied in some cases to the **Dark Cloud** botnet and other spam infrastructure. Researchers also observed related delivery through Shiotob downloaders and compromised web servers, with operators rotating domains, IPs, and lure content to reduce detection while targeting both retail and corporate banking users.
Aug 15, 2026