A federal court has ordered a Russian malware author to pay USD$6.9 million in forfeiture and restitution for his crimes.
On Monday, a U.S. federal court handed down the sentence to Russian national Nikita Kuzmin, who was responsible for creating and selling the Gozi trojan.
First discovered back in 2007, the Gozi trojan is a modularized trojan that commonly spreads via Internet Explorer browser exploits and via malicious email attachments disguised as PDF documents.
The malware is designed to evade detection by antivirus software, which provides it with a cover to steal SSL data using advanced Winsock2 functionality and to compromise the banking data of its targets.
According to a statement released by the FBI, Kuzmin developed Gozi back in 2005. As soon as he had finished coding it, the Russian national began offering the trojan for rent on underground web markets in exchange for a weekly fee through a business he ran called "76 Service."
Kuzmin's business helped renters configure the trojan and store the personal data they stole from their victims. In so doing, the computer criminal helped spawn the now-popular business model of malware-as-a-service.
"In renting the malware to others, Kuzmin made it widely accessible to criminals, in other words, to criminals who do not or need not have sophisticated computer science skills like Kuzmin and his Gozi co-creators," U.S. Attorney Preet Bharara said in a letter to the court, as quoted by Voice of America. "From this perspective, Kuzmin's crime is particularly significant."
In total, Gozi succeeded in infecting more than one million computers, at least 40,000 of which were based in the United States.
U.S. law enforcement ultimately arrested Kuzmin back in 2010 as he travelled to the United States for a conference, writes Business Insider. Approximately one year later, he pleaded guilty to conspiracy, bank fraud, and other charges in exchange for entering into a cooperation agreement with prosecutors.
It is unclear how the computer criminal helped federal authorities.
During Monday's sentencing hearing, Kuzmin was sentenced to 37 months in prison, which he has already served, and was ordered by the court to pay $6.9 million in restitution and forfeiture.