NeverQuest banking malware administrator sentenced to 4 years

That's one year less than prosecutors had hoped.

A Russian man who helped create a hacking tool capable of extracting funds from victims’ bank accounts will spend four years behind bars, a punishment that fell short of the five years for which federal prosecutors had asked.

A judge in the U.S. Southern District of New York handed down the 48-month prison sentence, including time served, to Stanislav Lisov for his role in deploying the NeverQuest malware. Lisov admitted he profited $885,000 from NeverQuest, while government investigators said the hacking technique had been used to try to steal a total of $4.4 million from international banks.

Five years would have been the maximum allowed under the terms of a plea deal Lisov struck with the Department of Justice early this year.

“He is happy,” Lisov’s attorney, Arkady Bukh, told CyberScoop, calling the sentence a “great victory.”

NeverQuest quickly became a favorite hacking tool for financial scammers after its debut in 2013. Thieves would infect victims via social media, phishing emails or file transfers, wait for them to access a banking site, and then capture the credentials. Hackers also maintained a database of financial websites, allowing them to automatically capture any data a victim entered into their bank’s site.

“Once surreptitiously installed, NeverQuest enables its administrators remotely to control a victim’s computer and log into the victim’s online banking or financial accounts, transfer money to other accounts, change login credentials, write online checks, and purchase goods from online vendors,” the Department of Justice said in a court filing.

Lisov played a central role in creating this malware. Between 2012 and 2015, he controlled the network of victims’ hacked computers, called a botnet, oversaw the computer servers for that botnet and was in possession of approximately 1.7 million stolen usernames and passwords.

Meanwhile he also used the NeverQuest malware himself and verified that co-conspirators were using the tool properly. In one conversation reproduced by prosecutors, Lisov tells an unnamed associate they successfully breached 400 Citi accounts, all with balances of more than $1,000.

He was initially arrested by Spanish authorities in January 2017 and extradited to the U.S. in 2018. He pleaded guilty in February.

The government’s sentencing request is available in full below.

[documentcloud url=”http://www.documentcloud.org/documents/6555752-Lisov.html” responsive=true]

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure