Russian hacker accused of creating NeverQuest malware pleads guilty

Stanislov Lisov created the NeverQuest banking malware that was used against hundreds of financial institutions

Stanislav Lisov, a Russian hacker accused of creating banking malware used to steal $885,000, pleaded guilty to one count of conspiracy to commit computer hacking in the U.S. Southern District Court of New York Friday.

Lisov created the NeverQuest banking malware that was used against hundreds of financial institutions.

Lisov was facing 35 years in prison when he was extradited to the U.S. from Spain after being apprehended in Barcelona in 2017. Lisov faces a maximum of five years in prison under the terms of his plea deal, according to his lawyer.

“My client spent over a year in jail in Barcelona, Spain while in extradition,” lawyer Arkady Bukh said in a statement. “[It] then took over a year here in the United States to negotiate this plea.”

Lisov was one of a number of alleged Russian hackers apprehended by international authorities while outside Russia at the behest of the U.S. law enforcement. He was taken into custody in the Barcelona airport in 2017 during his honeymoon.

NeverQuest first was discovered in 2014 and quickly picked up by organized cybercriminal groups. The malware would infect specific banking and investment banking customers then alert its operator to where it arrived. Attackers then would funnel cash from one hacked account into others, laundering the funds through a number of accounts under their control to disguise their location, according to Kaspersky.

“Neverquest is believed to be a cybercrime-as-a-service platform that supported a number of geo-specific operators who used the malware and botnet to rob bank accounts and share the loot with operators,” IBM researcher Limor Kessem wrote in a 2017 analysis of NeverQuest operations. “Similar to the way the Dridex botnet is divided into numbered campaigns and sub-botnets, Neverquest is also programmed to create this distinction: As soon as it lands on a newly infected endpoint, it calls home with a numeric ID that identifies its campaign.

The full indictment against Lisov is available below.

[documentcloud url=”http://www.documentcloud.org/documents/5747056-Lisov.html” responsive=true]

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure