Aleksandr Andreevich Panin, Malware Distribution, Georgia 2010

ATLANTA – Aleksandr Andreevich Panin, a/k/a Gribodemon, of Russia, and Hamza Bendelladj, a/k/a Bx1, of Algeria, have been sentenced to a combined 24 years, six months in prison for their roles in developing and distributing the malware known as SpyEye, which caused hundreds of millions of dollars in losses to the financial industry around the world.

The malware, known as SpyEye, was used by a global syndicate of cybercriminals to infect over 50 million computers, causing close to $1 billion in financial harm to individuals and financial institutions around the globe. SpyEye was designed to automate the theft of confidential personal and financial information, such as online banking credentials, credit card information, usernames, passwords, PINs, and other personally identifying information.

According to U.S. Attorney John Horn, the charges and other information presented in court, Panin was the primary developer and distributor of SpyEye. Panin developed SpyEye as a successor to the notorious Zeus malware that had, since 2009, wreaked havoc on financial institutions around the world. In November 2010, Panin allegedly received the source code and rights to sell Zeus from Evginy Bogachev, a/k/a Slavik, and incorporated many components of Zeus into SpyEye. Bogachev remains at large and is currently the FBI’s most wanted cybercriminal.

Operating from Russia between 2009 and 2011, Panin conspired with others, including co-defendant Hamza Bendelladj, to develop, market, and sell various versions of SpyEye and component parts on the Internet. Panin allowed cybercriminals to customize their purchases to include tailor-made methods of obtaining victims’ personal and financial information, as well as marketed versions that targeted information about specific financial institutions, including banks and credit card companies.

With the assistance of Bendelladj, a/k/a Bx1, the malware was used to steal victims’ personal and financial information through a variety of techniques, including “web injects,” “keystroke loggers,” and “credit card grabbers.” The victims’ stolen personal and financial data was then surreptitiously transmitted to the C2 servers, where it was used to, among other things, steal money from the victims’ financial accounts.

“It is difficult to overstate the significance of this case, not only in terms of bringing two prolific computer hackers to justice, but also in disrupting and preventing immeasurable financial losses to individuals and the financial industry around the world,” said U.S. Attorney John Horn. “The outstanding work by our law enforcement partners, both domestically and internationally, as well as terrific cooperation from the private sector, serves as a blueprint on how to combat complex cyber-crime syndicates around the world.”

J. Britt Johnson, Special Agent in Charge, FBI Atlanta Field Office, added, “Through these arrests and sentencing, the risk the public unknowingly faced from the threat posed by the imminent release of a new highly sophisticated version of SpyEye was effectively reduced to zero. The FBI led investigation that brought one of the world’s most nefarious malware developers to justice and significantly disrupted the prolific SpyEye botnet demonstrates the power of focused investigations that combine the skills and talents of global law enforcement and private industry partners.”

Both Panin and Bendelladj have been sentenced to prison, with Panin receiving a 19-year sentence and Bendelladj receiving a 5-year, 9-month sentence to be served concurrently. Their sentences are expected to be served in a federal prison in the United States.

Related Federal Cases