Federal jury convicts malware creators of hijacking 400,000 computers

A federal jury has convicted two Romanian men of 21 criminal charges related to a long-running scheme designed to infect computers with malware in an effort to steal credit card data, mine cryptocurrency, and commit online auction fraud, among other crimes.

The United States Department of Justice (DOJ) announced via a press release that Bogdan Nicolescu and Radu Miclaus of Bucharest, Romania, were convicted by a federal jury on Thursday, April 11.

Referred to as a “criminal conspiracy” in the press release, the scheme lasted a little over a decade and involved Nicolescu, Miclaus, and an unnamed third-party who plead guilty.

The scheme started in 2007 with the development and circulation of their malware. According to the DOJ, the malware was spread through emails “purporting to be legitimate from such entities as Western Union, Norton AntiVirus and the IRS.” As expected, the unsuspecting recipients of these emails opened files attached to these malicious emails and consequently and unknowingly downloaded the malware.

Once the computers of the initial recipients of these emails were infected, the malware continued to spread itself via the victim’s contact lists. This went on until the men from Bucharest had control of over 400,000 computers, most of which were located in the United States. Notably, the malware not only disabled the computers’ anti-malware software but it also prevented the victims from accessing law enforcement websites.

As a result of the widespread infection of this malware, the defendants were able to steal personal information such as credit card data and the usernames and passwords of their victims. In addition, the men also engaged in cryptomining, placed over 1,000 fraudulent listings for items on auction sites, and used the stolen credit card data to fund their own cybercrimes.

At the conclusion of their 12-day trial, Nicolescu and Miclaus were convicted of “conspiracy to commit wire fraud, conspiracy to traffic in counterfeit service marks, aggravated identity theft, conspiracy to commit money laundering and 12 counts each of wire fraud.”

While an exact amount has not been specified, it has been estimated that the scheme has resulted in the loss of millions of dollars.

Nicolescu and Miclaus are scheduled to be sentenced on August 14, 2019.