Loading story…
U.S. and European authorities dismantled the GozNym cybercrime network, unsealing charges against 10 alleged members and coordinating arrests, extraditions, and prosecutions across the United States, Georgia, Ukraine, Moldova, Germany, and Bulgaria with support from Europol and Eurojust. Officials said the group operated as a cybercrime-as-a-service enterprise, combining malware development, phishing spam, crypting, bulletproof hosting, account takeover, and cash-out roles to target primarily U.S. businesses and financial institutions, while some suspects remained fugitives.
Investigators said GozNym infected more than 41,000 computers and was used in roughly $100 million in attempted fraud against victims in the United States and elsewhere. The malware was distributed through the Avalanche criminal infrastructure, a fast-flux botnet platform previously used by more than 20 malware families before its takedown, and Shadowserver said its sinkholing and victim-remediation reporting had helped protect about 2 million victim IP addresses daily in the years following that operation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Authorities in the United States, Georgia, Ukraine, Moldova, Germany, Bulgaria, Europol, and Eurojust coordinated arrests, prosecutions, and evidence sharing to dismantle the GozNym cybercriminal network. Five suspects were arrested while five Russian nationals remained fugitives at the time of the announcement.
U.S. prosecutors unsealed an indictment charging 10 members of the GozNym network, while European and U.S. partners announced coordinated action against the group. Authorities said the malware infected more than 41,000 computers and was used in about $100 million in attempted fraud.
Krasimir Nikolov pleaded guilty in federal court in Pittsburgh to charges related to the GozNym conspiracy.
While extradition proceedings were still underway, Farkhad Manokhin absconded from Sri Lanka and fled back to Russia.
Farkhad Rauf Ogly Manokhin, an alleged GozNym cash-out operator, was arrested in Sri Lanka at the request of the United States.
Bulgarian authorities arrested alleged GozNym conspirator Krasimir Nikolov and extradited him to the United States in connection with the cybercrime case.
Authorities took down the Avalanche criminal malware delivery platform, which had provided fast-flux command-and-control services for more than 20 malware strains including GozNym.
3 references tracked. Mallory keeps watching after this page renders.
justice.gov
Open sourceshadowserver.org
Open sourceeuropol.europa.eu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Colombian authorities arrested Romanian national **Mihai Ionut Paunescu**, also known as **"Virus,"** in Bogotá on U.S. charges tied to the **Gozi** banking trojan. Prosecutors allege Paunescu ran the bulletproof hosting service `PowerHost[.]ro` and helped protect and scale Gozi infrastructure after joining the operation around the release of **Gozi 2.0**. U.S. officials said the botnet infected more than **one million computers** between 2007 and 2013, stole online banking credentials, and enabled the theft of tens of millions of dollars from victims in the United States and Europe; authorities said they would pursue extradition from Colombia after earlier efforts in Romania failed. The arrest adds to a case that previously saw Gozi creator **Nikita Kuzmin** sentenced in the United States after admitting to computer intrusion and fraud offenses, while investigators also tied **Deniss Calovskis** to web injects used against banks. Court filings said Kuzmin marketed Gozi through an early malware-as-a-service scheme known as **"76 Service,"** renting the malware to other criminals. Security researchers have since linked Gozi’s leaked codebase to later malware families, including the advanced **RM3 / Gozi-ISFB** strain, which targeted more than 130 financial institutions across Oceania and Europe and expanded beyond credential theft into browser interception, hidden VNC, SOCKS proxying, remote shell access, and ransomware-enabling post-compromise activity.
Aug 14, 2026
U.S. and European authorities, working with security companies and researchers, disrupted the **GameOver Zeus** peer-to-peer botnet and seized infrastructure tied to **CryptoLocker** in a multinational action known as **Operation Tovar**. The malware network was estimated to have infected **500,000 to 1 million Windows systems** worldwide and was used to steal banking credentials, personal data, and funds through account takeovers, spam campaigns, and DDoS-assisted fraud. U.S. prosecutors said the operation caused more than **$100 million** in losses, while CryptoLocker had infected more than **234,000 computers** and generated over **$27 million** in ransom payments shortly after its emergence. The U.S. Justice Department charged Russian national **Evgeniy Mikhailovich Bogachev**, also known as `Slavik` and `Pollingsoon`, as the alleged administrator behind the botnet. Authorities said the takedown created a roughly **two-week window** for victims and enterprises to clean infected machines before operators could attempt to regain control, and agencies including **US-CERT** and internet service providers were mobilized to support remediation. Investigators said GameOver Zeus spread largely through phishing emails, malicious spam, and compromised websites exploiting outdated software, prompting officials to urge users to update systems, run security scans, and change passwords.
Aug 14, 2026
An international law enforcement operation dubbed **Operation Endgame** disrupted major malware delivery and botnet infrastructure tied to **IcedID, SmokeLoader, SystemBC, Pikabot, Trickbot**, and remnants of **Bumblebee**, in what Europol and participating agencies described as the largest action of its kind against botnets. Authorities said the networks had been used to spread malware through hundreds of millions of phishing emails and to enable follow-on ransomware attacks and financial fraud, with investigators identifying several million infected computers worldwide over the past year. The coordinated action, supported by **Europol** and **Eurojust**, took down more than **100 servers**, seized over **2,000 domains**, and disinfected more than **10,000** infected systems, while additional operations across multiple countries led to arrests, interrogations, searches, and server seizures. Investigators also identified a key suspect allegedly linked to **69 million euros** in cryptocurrency proceeds, and separate reporting and research highlighted scrutiny of a **SmokeLoader** actor targeted as part of the crackdown.
Jun 29, 2026