Loading story…
The U.S. Department of Justice disrupted the Kelihos botnet, a network of more than 100,000 compromised Windows computers allegedly controlled by Russian national Peter Yuryevich Levashov (also known as Peter Severa). Authorities said Kelihos had operated since 2010 and was used to send spam, steal passwords and credentials, distribute malware, and support pump-and-dump stock fraud. The FBI linked Levashov to the infrastructure through IP addresses and online account records, while working with CrowdStrike and the Shadowserver Foundation to sinkhole the botnet and cut communications between infected machines and their controllers.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
Peter Yuryevich Levashov pleaded guilty in U.S. District Court in Hartford to causing intentional damage to a protected computer, conspiracy, wire fraud, and aggravated identity theft tied to Kelihos.
A grand jury in the District of Connecticut returned an indictment against Peter Levashov over his alleged operation of the Kelihos botnet.
The U.S. Department of Justice announced a global disruption operation against the Kelihos botnet, working with partners to sinkhole the botnet and sever communications with infected machines.
Spanish authorities arrested alleged Kelihos operator Peter Yuryevich Levashov in Barcelona based on a criminal complaint and arrest warrant from the District of Connecticut.
The Kelihos botnet began operating in 2010, infecting Microsoft Windows systems and supporting spam, password theft, fraud schemes, and malware distribution.
Peter Levashov was extradited from Spain to the United States in February following his arrest in the Kelihos botnet case.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
justice.gov
Open sourcecyberscoop.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A U.S. federal jury convicted Russian national **Oleg Koshkin** for operating malware crypter services that helped the **Kelihos** botnet evade antivirus detection and spread malicious payloads. Prosecutors said Koshkin ran sites including **Crypt4U.com**, **Crypt4U.net**, **fud.bz**, and **fud.re**, advertising tools that made malware such as botnets, RATs, keyloggers, stealers, crypto miners, and ransomware fully undetectable. Court evidence showed Kelihos operator **Peter Levashov** paid roughly **$3,000 per month** from 2014 to 2017 for custom high-volume re-crypting, while co-defendant **Pavel Tsurkan** pleaded guilty to aiding malware infections worldwide, including ransomware attacks. The conviction builds on the broader U.S. campaign against Kelihos, a botnet active since at least 2010 that at various points controlled **60,000 to more than 100,000 compromised Windows computers**. Authorities said the botnet was used for spam, credential theft, pump-and-dump stock fraud, denial-of-service activity, and malware distribution before the FBI and partners including **CrowdStrike** and the **Shadowserver Foundation** disrupted it through a sinkholing operation and Levashov’s arrest in Spain. Investigators linked Levashov to the infrastructure through IP and account records, with reporting noting operational security mistakes such as reused credentials that helped expose him.
Aug 15, 2026
U.S. and international law enforcement dismantled the **Qakbot** botnet by seizing control of key infrastructure, redirecting infected systems to FBI-controlled servers, and remotely pushing an uninstaller to compromised Windows hosts. Court records show the FBI obtained authority to use remote access techniques against U.S.-based computers communicating with Qakbot, a long-running malware platform also known as **Qbot** and **Pinkslipbot**, after identifying roughly **700,000 infected computers worldwide**, including about **200,000 in the United States**. The operation collected limited technical data such as IP and routing information, but did not capture communication content. Researchers said the disruption also neutralized active infections by sending Qakbot’s own shutdown command through its named-pipe mechanism, preventing the malware from relaunching after a reboot. The takedown targeted a botnet widely used as an initial access platform for ransomware groups including **Conti**, **REvil**, **Egregor**, **MegaCortex**, **ProLock**, and **Black Basta**. Investigators linked Qakbot operators to fees associated with about **$58 million** in victim ransom payments between October 2021 and April 2023, underscoring the botnet’s central role in corporate intrusions and downstream ransomware attacks.
Aug 15, 2026
U.S. and European law enforcement agencies disrupted the **QakBot** botnet, seizing infrastructure tied to malware that had infected more than **700,000 computers** worldwide and enabled ransomware, financial fraud, and other criminal activity. Europol and U.S. authorities said the operation cut off command-and-control systems and removed malware from compromised hosts, while CISA published guidance on the botnet’s tactics, indicators, and the broader effort to identify and disrupt the infrastructure behind it. Officials said QakBot operators and affiliates had generated at least **EUR 54 million** in ransom payments over the years. The takedown also produced a large cache of stolen data that the FBI shared for victim notification, allowing affected individuals to check exposed information through **Have I Been Pwned**. Reporting after the operation said the action could serve as a model for future botnet disruptions, with investigators using legal authorities and international coordination to seize servers, redirect traffic, and weaken criminal ecosystems that support follow-on ransomware attacks.
Jul 12, 2026