Russian coder puts Microsoft botnet accusation behind him

Accused of creating the Kelihos botnet, Andrey Sabelnikov makes peace with Microsoft

When 32-year-old Russian programmer Andrey N. Sabelnikov visited the U.S. for the first time in January, he had a surprise waiting for him.

The surprise was an amended civil lawsuit soon to be filed against him by Microsoft, which alleged he was the mastermind behind a network of hacked computers called Kelihos, which used the compromised Windows computers to send spam and install fake antivirus software.

After several months of effort, Microsoft announced last week it had reached a settlement with Sabelnikov, who described himself in an interview over email on Wednesday with IDG News Service as a C++ developer of high-performance backend applications.

The secret settlement, which neither Microsoft nor Sabelnikov will divulge, almost never happened.

Microsoft filed the amended civil suit in U.S. District Court for the Eastern District of Virginia on Jan. 23. Writing on his blog four days later, Sabelnikov strongly denied any connection with Kelihos, which infected around 45,000 or so computers but sent nearly 4 billion spam messages a day, promoting pornography and pharmaceutical products.

An avid photographer, Sabelnikov's website that showed his portfolio may have implicated him. Security writer Brian Krebs wrote in January that the source code for Kelihos contained debug code that would download an installer for Kelihos from Sabelnikov's website.

"They found some of my developments," Sabelnikov said. "I used to debug some things, but had never been used to host any malware and had never been related to any kind of criminal activity."

For months, Microsoft attempted to negotiate with Sabelnikov, who ironically had worked for around six years for two Russian companies, Agnitum and Returnil, that sell security software. By August, Microsoft was ready to throw in the towel and ask the federal court for entry of a default judgement.

"Microsoft has diligently attempted to negotiate a resolution with Mr. Sabelnikov in an attempt to efficiently resolve this matter without requiring further intervention by the court," according to an Aug. 8 court filing. "Mr. Sabelnikov has not yet answered."

The filing of lawsuits against people living outside the U.S., let alone Russia, can be fraught with difficulty. In July 2003, Russia suspended judicial cooperation with the U.S. in civil and commercial matters, according to the U.S. State Department. Still, Microsoft served Sabelnikov with the lawsuit in person at his attorney's office in St. Petersburg on Feb. 21, which complied with Russian law.

Later in August, Sabelnikov apparently had a change of heart and entered into negotiations, according to a Microsoft filing on Aug. 23. "If there are any troubles, they have to be solved -- you should not hide from them," Sabelnikov said.

Sabelnikov, who is now developing a music recommendation engine called FireHint, won't say exactly what caused him to change his mind.

Microsoft, on the other hand, appears to have somewhat backed down from its contention that Sabelnikov owned, operated and controlled Kelihos. Instead, the company indicates that it agreed with Sabelnikov's claims of innocence.

Richard Domingues Boscovich, assistant general counsel for Microsoft's Digital Crimes Unit, declined to be interviewed on Tuesday, saying the case was closed. But he did provide a statement.

"In the Kelihos case, we were able to identify the developer of the code as well as find out how the code was written and distributed," Boscovich said. "It's important to note that this investigation also revealed how cybercriminals leverage people in the industry to develop code for their illegitimate purposes and that, in some cases, the developer is unaware of how their code will be used upon completion."

Sabelnikov didn't answer questions over his exact involvement with Kelihos. The case, Boscovich said, "allowed us to collect important intelligence and data on how botnets are built."

There appear to be no hurt feelings on either side. Microsoft was "extremely civil" throughout the process, Sabelnikov said. "I have the impression that they are good professionals and very competent guys."

Send news tips and comments to Follow me on Twitter: @jeremy_kirk

Join the CSO newsletter!

Error: Please check your email address.

Tags MicrosoftsecurityCivil lawsuitslegalcybercrime

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Jeremy Kirk

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts

Market Place