Pierluigi Paganini November 22, 2019

The Russian hacker who created and used Neverquest banking malware has finally been sentenced to 4 years in prison by a US District Court.

Stanislav Vitaliyevich Lisov (34), the Russian hacker who created and used Neverquest banking malware has been sentenced to 4 years in prison by the United States District Court for the Southern District of New York.

Lisov was arrested in January 2017 at the Barcelona airport by the Guardia Civil. The Russian hacker was suspected of being the author of the Neverquest malware, aka Vawtrak malware, and the person who administrated the control infrastructure.

The Neverquest was used by cyber criminals to steal login credentials from banking customers, it leverages on injection mechanisms to provide users fake forms into legitimate banking websites. The banking trojan is able to record keystrokes, to steal passwords stored on the PC,  and take screenshots and videos from the victims’ machine.

The Neverquest malware is able to log in to the victim’s online banking account and perform fraudulent transactions.

The arrest is the result of the collaboration between the Spanish law enforcement and the FBI.

Lisov operated the infrastructure behind the NeverQuest malware between June 2012 and January 2015, the managed a network of servers containing lists of millions of stolen login credentials.

In February, the man has pled guilty to one count of conspiracy to commit computer hacking in Manhattan Federal Court, he faces a sentence of up to five years in prison.

“Between June 2012 and January 2015, LISOV was responsible for key aspects of the creation and administration of a network of victim computers known as a “botnet” that was infected with NeverQuest.  Among other things, LISOV maintained infrastructure for this criminal enterprise, including by renting and paying for computer servers used to manage the botnet that had been compromised by NeverQuest.” reads the press release published by the DoJ.  “Those computer servers contained lists with approximately 1.7 million stolen login credentials – including usernames, passwords, and security questions and answers – for victims’ accounts on banking and other financial websites.  LISOV had administrative-level access to those computer servers.”

Lisov and his co-conspirators attempted to steal at least approximately $4.4 million using the NeverQuest malware, according to the authorities they stole at least approximately $855,000 from their victims’ online financial accounts.

The United States Attorney Geoffrey S. Berman sentenced Lisov to 48 months in prison and to 3 years of supervised release. The man was also ordered to pay a forfeiture of $50,000 and restitution of $481,388.04.

Pierluigi Paganini

(SecurityAffairs – malware, NeverQuest)

[adrotate banner=”5″]

[adrotate banner=”13″]