Russian coder puts Microsoft botnet accusation behind him

Accused of creating the Kelihos botnet, Andrey Sabelnikov makes peace with Microsoft

When 32-year-old Russian programmer Andrey N. Sabelnikov visited the U.S. for the first time in January, he had a surprise waiting for him.

The surprise was an amended civil lawsuit soon to be filed against him by Microsoft, which alleged he was the mastermind behind a network of hacked computers called Kelihos, which used the compromised Windows computers to send spam and install fake antivirus software.

After several months of effort, Microsoft announced last week it had reached a settlement with Sabelnikov, who described himself in an interview over email on Wednesday with IDG News Service as a C++ developer of high-performance backend applications.

The secret settlement, which neither Microsoft nor Sabelnikov will divulge, almost never happened.

Microsoft filed the amended civil suit in U.S. District Court for the Eastern District of Virginia on Jan. 23. Writing on his blog four days later, Sabelnikov strongly denied any connection with Kelihos, which infected around 45,000 or so computers but sent nearly 4 billion spam messages a day, promoting pornography and pharmaceutical products.

An avid photographer, Sabelnikov's website that showed his portfolio may have implicated him. Security writer Brian Krebs wrote in January that the source code for Kelihos contained debug code that would download an installer for Kelihos from Sabelnikov's website.

"They found some of my developments," Sabelnikov said. "I used sabelnikov.net to debug some things, but sabelnikov.net had never been used to host any malware and had never been related to any kind of criminal activity."

For months, Microsoft attempted to negotiate with Sabelnikov, who ironically had worked for around six years for two Russian companies, Agnitum and Returnil, that sell security software. By August, Microsoft was ready to throw in the towel and ask the federal court for entry of a default judgement.

"Microsoft has diligently attempted to negotiate a resolution with Mr. Sabelnikov in an attempt to efficiently resolve this matter without requiring further intervention by the court," according to an Aug. 8 court filing. "Mr. Sabelnikov has not yet answered."

The filing of lawsuits against people living outside the U.S., let alone Russia, can be fraught with difficulty. In July 2003, Russia suspended judicial cooperation with the U.S. in civil and commercial matters, according to the U.S. State Department. Still, Microsoft served Sabelnikov with the lawsuit in person at his attorney's office in St. Petersburg on Feb. 21, which complied with Russian law.

Later in August, Sabelnikov apparently had a change of heart and entered into negotiations, according to a Microsoft filing on Aug. 23. "If there are any troubles, they have to be solved -- you should not hide from them," Sabelnikov said.

Sabelnikov, who is now developing a music recommendation engine called FireHint, won't say exactly what caused him to change his mind.

Microsoft, on the other hand, appears to have somewhat backed down from its contention that Sabelnikov owned, operated and controlled Kelihos. Instead, the company indicates that it agreed with Sabelnikov's claims of innocence.

Richard Domingues Boscovich, assistant general counsel for Microsoft's Digital Crimes Unit, declined to be interviewed on Tuesday, saying the case was closed. But he did provide a statement.

"In the Kelihos case, we were able to identify the developer of the code as well as find out how the code was written and distributed," Boscovich said. "It's important to note that this investigation also revealed how cybercriminals leverage people in the industry to develop code for their illegitimate purposes and that, in some cases, the developer is unaware of how their code will be used upon completion."

Sabelnikov didn't answer questions over his exact involvement with Kelihos. The case, Boscovich said, "allowed us to collect important intelligence and data on how botnets are built."

There appear to be no hurt feelings on either side. Microsoft was "extremely civil" throughout the process, Sabelnikov said. "I have the impression that they are good professionals and very competent guys."

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Join the PC World newsletter!

Error: Please check your email address.

Tags MicrosoftsecurityCivil lawsuitslegalcybercrime

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Essentials

Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >

Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >

Mobile

Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >

Exec

Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?