The Notorious Hacker Behind Global Malware Empire - In US Prison | June 12 2023
Channel: Hacking Space Frontier
Date: 2023-06-13

Mihai Ionut Paunescu, a Romanian hacker, has been sentenced to three years in a U.S. federal prison for his involvement in running a "bulletproof hosting" service called PowerHost.ro. This service facilitated the distribution of various malware strains, including the Gozi Virus, Zeus Trojan, SpyEye Trojan, and BlackEnergy malware. These malware strains were used by cybercriminals to steal financial information and carry out other illicit activities.

Paunescu rented servers and IP addresses from legitimate internet providers and provided them to cybercriminals, enabling them to remain anonymous and launch attacks. He was also accused of enabling other cybercrimes, such as distributed denial-of-service (DDoS) attacks and spam campaigns. He was convicted of conspiracy to commit computer intrusion.

Paunescu, known by the alias "Virus," was initially arrested in December 2012 in Bucharest, Romania, but U.S. officials were unable to extradite him at the time. He was subsequently detained in June 2021 at El Dorado International Airport in Bogotá, Colombia. U.S. prosecutors charged him in January 2013 for his involvement in distributing the Gozi malware, which facilitated the theft of e-banking credentials and funds from victim accounts.

While Paunescu was associated with various cybercriminal operations, he had a close connection to those using the Gozi malware. U.S. officials stated that he was one of three individuals responsible for spreading the malware globally to over one million computers between 2007 and 2013. The Gozi malware infected over 40,000 computers in the U.S., including those at the National Aeronautics and Space Administration (NASA), as well as computers across Europe. It allowed hackers to steal tens of millions of dollars by evading antivirus software.

After being unable to secure his extradition from Romania following his 2012 arrest, U.S. prosecutors monitored Paunescu until his arrest in Colombia. He pleaded guilty to lesser charges on February 24. As part of his sentence, Paunescu must forfeit $3.51 million and pay restitution of $18,945. U.S. District Judge Lorna G. Schofield remarked that Paunescu had facilitated the distribution of some of the most serious malware during that time and had made significant profits from it.

The other two operators involved in the Gozi malware scheme were Nikita Kuzmin, a Russian national arrested in California in 2013 and released in 2016, and Deniss Calovskis, who was arrested in Latvia but not extradited due to a dispute over the potential length of his prison sentence. The source code of the Gozi malware was leaked online in 2013 and is now used as the foundation for several strains employed in bank attacks.