Accused Kelihos botnet maker worked for two security firms
Spent three years at Russian antivirus firm, another three at company with security-related products
Computerworld - A Russian man who was accused Monday by Microsoft of creating the Kelihos botnet worked for a pair of security-related firms from 2005 to 2011, according to evidence on the Web.
In an amended complaint filed yesterday in federal court, Microsoft identified the man as Andrey Sabelnikov of St. Petersburg.
According to his LinkedIn profile, Sabelnikov worked for two Russian companies that specialize in security, including the antivirus firm Agnitum, for the last six years.
Agnitum, which is based in St. Petersburg, develops and sells a Windows antivirus product called OutPost Antivirus Pro as well as a personal firewall for Windows PCs. A company spokesman confirmed today that Sabelnikov worked for the firm from September 2005 until November 2008.
Sabelnikov held a number of tiles, ending his time with Agnitum as a project manager responsible for everything from "designing the product architecture" to "implementing ... critical parts of code."
In an emailed reply to questions, the Agnitum spokesman said that Sabelnikov "resigned by his own will in late 2008."
From November 2008 until December 2011, Sabelnikov worked for another Russian company, Retunil, which also markets security software. Returnil's primary product, Virtual System Pro, clones an existing copy of Windows in a virtual machine as a way to protect users from malware.
Malware researchers often use virtual machines (VM) to test and analyze attack code because if the VM becomes infected, it can simply be wiped clean or restored to a pre-infection state.
Returnil did not reply to a request for comment on Sabelnikov's three-year stint, during which he was a lead research engineer.
The last two months, Sabelnikov worked for Teknavo, a consultancy that, among other things, develops software for financial organizations. Teknavo has an office in St. Petersburg.
While Sabelnikov's LinkedIn page was flush with details on his work history earlier Tuesday, it has been revised since then, and now lists only his time spent at an unnamed technical college and the St. Petersburg State University of Aerospace Instrumentation.
Microsoft first filed its Kelihos lawsuit last September as part of a takedown of the botnet, which controlled an estimated 45,000 compromised computers and had allegedly sent massive amounts of spam -- as many as 4 billion messages daily -- to users worldwide.
At that time, Microsoft identified only Dominique Piatti, the operator of the Czech domain hosting service dotFREE Group SRO, but pegged another 22 "John Doe" defendants.
In October, Microsoft dropped the charges against Piatti and dotFREE after reaching a settlement.
In the amended complaint submitted Monday, Microsoft accused Sabelnikov of creating the malware used to infect PCs and administering the resulting Kelihos botnet.
- Step Out of the Bull's-Eye Learn about the evolution of targeted attacks, the latest in security intelligence, and strategic steps to keep your business safe.
- Using Cyber Insurance and Cybercrime Data to Limit Your Business Risk This paper examines the challenges of understanding cyber risks, the importance of having the right cyber risk intelligence, and how to use this...
- 5 Tips to Secure Small Business Backdoors in the Enterprise Supply Chain This paper examines the insecurity of the small businesses in the supply chain and offers tips to close those backdoors into the enterprise.
- Comprehensive Advanced Threat Defense The hot topic in the information security industry these days is "Advanced Threat Defense" (ATD). This paper describes a comprehensive, network-based approach to...
- Live Webcast Security Vulnerabilities Associated With Having Local Administrator Privileges Viewfinity will demonstrate how removing admin rights and granularly managing privileges at the application level reduces the attack surface.
- Security Vulnerabilities Associated With Having Local Administrator Privileges Viewfinity will demonstrate how removing admin rights and granularly managing privileges at the application level reduces the attack surface.
- Keep Servers Up and Running and Attackers in the Dark An SSL/TLS handshake requires at least 10 times more processing power on a server than on the client. SSL renegotiation attacks can readily... All Cybercrime and Hacking White Papers | Webcasts