Accused Kelihos botnet maker worked for two security firms

Computerworld - A Russian man who was accused Monday by Microsoft of creating the Kelihos botnet worked for a pair of security-related firms from 2005 to 2011, according to evidence on the Web.

In an amended complaint filed yesterday in federal court, Microsoft identified the man as Andrey Sabelnikov of St. Petersburg.

According to his LinkedIn profile, Sabelnikov worked for two Russian companies that specialize in security, including the antivirus firm Agnitum, for the last six years.

Agnitum, which is based in St. Petersburg, develops and sells a Windows antivirus product called OutPost Antivirus Pro as well as a personal firewall for Windows PCs. A company spokesman confirmed today that Sabelnikov worked for the firm from September 2005 until November 2008.

Sabelnikov held a number of tiles, ending his time with Agnitum as a project manager responsible for everything from "designing the product architecture" to "implementing ... critical parts of code."

In an emailed reply to questions, the Agnitum spokesman said that Sabelnikov "resigned by his own will in late 2008."

From November 2008 until December 2011, Sabelnikov worked for another Russian company, Retunil, which also markets security software. Returnil's primary product, Virtual System Pro, clones an existing copy of Windows in a virtual machine as a way to protect users from malware.

Malware researchers often use virtual machines (VM) to test and analyze attack code because if the VM becomes infected, it can simply be wiped clean or restored to a pre-infection state.

Returnil did not reply to a request for comment on Sabelnikov's three-year stint, during which he was a lead research engineer.

The last two months, Sabelnikov worked for Teknavo, a consultancy that, among other things, develops software for financial organizations. Teknavo has an office in St. Petersburg.

While Sabelnikov's LinkedIn page was flush with details on his work history earlier Tuesday, it has been revised since then, and now lists only his time spent at an unnamed technical college and the St. Petersburg State University of Aerospace Instrumentation.

Microsoft first filed its Kelihos lawsuit last September as part of a takedown of the botnet, which controlled an estimated 45,000 compromised computers and had allegedly sent massive amounts of spam -- as many as 4 billion messages daily -- to users worldwide.

At that time, Microsoft identified only Dominique Piatti, the operator of the Czech domain hosting service dotFREE Group SRO, but pegged another 22 "John Doe" defendants.

In October, Microsoft dropped the charges against Piatti and dotFREE after reaching a settlement.

In the amended complaint submitted Monday, Microsoft accused Sabelnikov of creating the malware used to infect PCs and administering the resulting Kelihos botnet.