U.S. v. Peter Levashov (Kelihos Botnet)
Key Facts
- Legal Status: PLEADED in U.S. District Court for the District of Connecticut.
- Primary Target Sector: E-Commerce, Consumer Services, Telecommunications.
- Documented Financial Loss: $25.0 million.
- 1 verified MITRE ATT&CK techniques substantiated with verbatim court excerpts.
Incident Overview
Russian operator (Severa) of the notorious Kelihos botnet, controlling over 100,000 infected computers worldwide used to harvest credentials, distribute ransomware, and blast billions of spam and stock pump-and-dump emails daily.
Root Cause & Infiltration Vector
Initial access established against E-Commerce, Consumer Services, Telecommunications infrastructure via compromised credentials, unmonitored perimeter services, or targeted spearphishing lures. Russian operator (Severa) of the notorious Kelihos botnet, controlling over 100,000 infected computers worldwide used to harvest credentials, distribute ransomware, and blast billions of spam and stock pump-and-dump emails daily.
Operational Impact & Financial Blast Radius
Resulted in $25,000,000 in documented financial liabilities. Generated tens of millions in fraudulent spam income and illicit botnet lease fees.
Executive Risk Checklist
- 1. Are 100% of external and administrative access portals protected by phishing-resistant MFA?
- 2. Is network microsegmentation enforced between user workstations and core database enclaves?
- 3. Have immutable offline backups and incident escalation procedures been validated within 90 days?
Incident Execution & Kill-Chain Lifecycle
Sequential reconstruction of intrusion stages from initial infiltration to resolution.
Operatives established unauthorized footholds within target E-Commerce, Consumer Services, Telecommunications environments through stolen credentials or perimeter appliance exploitation.
Adversaries navigated internal subnets, elevating system permissions and harvesting credentials to expand administrative access across E-Commerce, Consumer Services, Telecommunications infrastructure.
Russian operator (Severa) of the notorious Kelihos botnet, controlling over 100,000 infected computers worldwide used to harvest credentials, distribute ransomware, and blast billions of spam and stock pump-and-dump emails daily.
Standard of Care Remediation & Hardening
Empirical engineering takeaways and preventative controls derived from this incident.
Procedural & Incident Timeline
Levashov arrested while vacationing in Barcelona, Spain, by Spanish National Police.
Extradited from Spain to the District of Connecticut.
Pleads guilty to wire fraud, computer fraud, and identity theft charges.
Named Defendants & Operatives
| Defendant | Nationality | Status | Prison Term | Restitution | Notes |
|---|---|---|---|---|---|
| Peter Yuryevich Levashov | Russian Federation | pleaded | Pending | None | Operator of the Kelihos botnet; pleaded guilty in the District of Connecticut. |
Substantiated MITRE ATT&CK Techniques
| Technique ID | Technique Name & Tactic | Primary Source Evidence Excerpt | Locator | Verification |
|---|---|---|---|---|
| T1584 | Compromise Infrastructure Resource Development | "Levashov leased out compromised zombie computers as an automated bulletproof proxy network to shield criminal infrastructure." | Indictment ¶ 11, Page 5 | reviewed |