Hamza Bendelladj, SpyEye Virus Creation and Distribution, Georgia 2013

A 24-year-old Algerian national has been extradited to the United States to face federal charges for his role in creating and distributing the malicious computer virus ‘SpyEye.’

Hamza Bendelladj, also known as ‘Bx1,’ was apprehended at Suvarnabhumi Airport in Bangkok, Thailand, on January 5, 2013, while in transit from Malaysia to Egypt. He was extradited to the United States on May 2, 2013, and will be arraigned in United States District Court before United States Magistrate Judge Janet F. King.

The indictment charges Bendelladj with one count of conspiring to commit wire and bank fraud, ten counts of wire fraud, one count of conspiracy to commit computer fraud, and 11 counts of computer fraud.

According to court documents, the SpyEye virus is malicious computer code or ‘malware,’ which is designed to automate the theft of confidential personal and financial information, such as online banking credentials, credit card information, usernames, passwords, PINs, and other personally identifying information.

The virus facilitates this theft of information by secretly infecting victims’ computers, enabling cybercriminals to remotely control the computers through command and control (C&C) servers. Once a computer is infected and under the cybercriminals’ control, a victim’s personal and financial information can be surreptitiously collected using techniques such as ‘web injects,’ which allow cybercriminals to alter the display of web pages in the victim’s browser in order to trick them into divulging personal information related to their financial accounts.

The financial data is then transmitted to the cybercriminals’ C&C servers, where criminals use it to steal money from the victims’ financial accounts.

The indictment alleges that from 2009 to 2011, Bendelladj and others developed, marketed, and sold various versions of the SpyEye virus and component parts on the Internet and allowed cybercriminals to customize their purchases to include tailor-made methods of obtaining victims’ personal and financial information.

United States Attorney Sally Quillian Yates said, ‘No violence or coercion was used to accomplish this scheme, just a computer and an Internet connection.’ She added, ‘Bendelladj’s alleged criminal reach extended across international borders, directly into victims’ homes. In a cyber-netherworld, he allegedly commercialized the wholesale theft of financial and personal information through this virus which he sold to other cybercriminals.’

Related Federal Cases