Microsoft closes Kelihos botnet case after latest settlement

Share this article:

Andrey Sabelnikov, a Russian software programmer named in January as a defendant in the Kelihos botnet case, has reached a confidential settlement with Microsoft -- a development that effectively closes the case.

Richard Boscovich, assistant general counsel for Microsoft's digital crimes unit, announced the news Friday on the company's TechNet blog, where a joint statement with Sabelnikov said the programmer was “not the operator of the botnet or involved in its activities,” although he did write code for the large network of compromised PCs.

Microsoft shut down the now-defunct Kelihos botnet in September 2011, after finding that the network of approximately 41,000 infected computers was capable, at its peak, of spamming out 3.8 billion emails a day. Allegedly, victims' personal information, like emails and passwords, were stolen and sites promoting the sexual exploitation of children were promoted through the botnet, among other scams, according to Microsoft.

The Kelihos botnet was dismantled on more than one occasion by Microsoft, as its perpetrators continued to resurrect the network by tweaking the malware used in the attacks.

Last October, Microsoft dismissed its case against another defendant, Dominique Piatti, and his company, dotFREE Group SRO, after a settlement was reached.

As a part of the terms of that settlement, Piatti agreed to delete or transfer subdomains connected to the Kelihos botnet, which led to Microsoft uncovering additional evidence that led to action against Sabelnikov.

“Today, I am pleased to say we have reached an agreement with Mr. Sabelnikov, and have officially settled and closed the Kelihos botnet case," Boscovich wrote.


Share this article:

Sign up to our newsletters

More in News

Instagram iOS and Android apps vulnerable to session hijacking

Two researchers wrote about the Instagram app for iOS and Android is vulnerable to session hijacking because both send unsecured information through HTTP.

Report: Hackers stole data from Israeli defense firms

A report by Brian Krebs detailed the intrusions, which occurred between Oct. 2011 and Aug. 2012.

Neverquest trojan targets regional banks in Japan

Symantec researchers found a new variant of the banking trojan.