Mihai Ionut Paunescu, a/k/a “Virus,” 37, of Bucharest, Romania, also stands accused of enabling other cybercrimes, such as distributing malware including the “Zeus Trojan” and the “SpyEye Trojan,” initiating and executing distributed denial of service (“DDoS”) attacks, and transmitting spam.
Paunescu was initially arrested in Romania in December 2012 and released on bail, and he was arrested again in Colombia last year at the request of the United States.
The Gozi Virus is malicious computer code that stole personal bank account information, including usernames and passwords, from the users of affected computers, according to court records. The Gozi Virus infected over one million computers worldwide, among them at least 40,000 computers in the United States, including computers belonging to the National Aeronautics and Space Administration (“NASA”), as well as computers in Germany, Great Britain, Poland, France, Finland, Italy, Turkey and elsewhere, and it caused tens of millions of dollars in losses to the individuals, businesses, and government entities whose computers were infected.
Once installed, the Gozi Virus – which was intentionally designed to be undetectable by anti-virus software – collected data from the infected computer in order to capture personal bank account information, including usernames and passwords, according to court records. That data was then transmitted to various computer servers controlled by the cyber criminals who used the Gozi Virus. These cyber criminals then used the personal bank account information to transfer funds out of the victims’ bank accounts and ultimately into their own personal possession.
“Bulletproof hosting” services helped cyber criminals distribute the Gozi Virus with little fear of detection by law enforcement, according to court records. Bulletproof hosts provided cyber criminals using the Gozi Virus with the critical online infrastructure they needed, such as Internet Protocol addresses and computer servers, in a manner designed to enable them to preserve their anonymity.
Paunescu operated a “bulletproof hosting” service that helped cyber criminals distribute the Gozi Virus and commit other cybercrimes, such as distributing malware including the “Zeus Trojan” and the “SpyEye Trojan,” initiating and executing DDoS attacks, and transmitting spam, according to court records.
Paunescu rented servers and IP addresses from legitimate Internet service providers and then in turn rented them to cyber criminals; provided servers that cyber criminals used as command-and-control servers to conduct DDoS attacks; monitored the IP addresses that he controlled to determine if they appeared on a special list of suspicious or untrustworthy IP addresses; and relocated his customers’ data to different networks and IP addresses, including networks and IP addresses in other countries, to avoid being blocked as a result of private security or law enforcement scrutiny.
Paunescu is charged with one count of conspiracy to commit computer intrusion, which carries a maximum penalty of 10 years in prison; one count of conspiracy to commit bank fraud, which carries a maximum penalty of 30 years in prison; and one count of conspiracy to commit wire fraud, which carries a maximum penalty of 20 years in prison.