A Russian man accused of playing a pivotal role in the development of the Citadel malware has been sentenced to five years in prison.
After pleading guilty in March, Mark Vartanyan, 29, was sentenced by a US district court judge in Atlanta. Vartanyan has already served more than two years in a prison in Norway, which the judge said he would receive credit for.
The malicious software was used to steal personal financial information and caused more than $5 million in losses. Prosecutors said it infected over 11 million computers worldwide.
Although Vartanyan, also known as "Kolypto”, was not the author of the malware, he contributed to its development and design from 2012 to 2014, while living in Norway and the Ukraine.
Federal prosecutor Steven Grimberg said: "He was, for lack of a better term, the 'mechanic' - the person who made it more pernicious”.
However, he also remarked: "I have rarely come across an individual who has been as sorry for his role."
Vartanyan’s swift cooperation with the government and demonstration of remorse enabled prosecutors to request a shorter five-year prison sentence.
He is the second person to be brought to justice over Citadel, following Dimitry Belorossov’s prison sentence in 2015.
The malware was born in 2011 and marketed on Russian-language forums frequented by cybercriminals, as reported by the BBC.
As part of the Citadel network, a group of botnets stole from bank accounts in 90 countries by installing keylogger software on millions of machines.
Microsoft, along with the FBI, successfully broke up part of the network in 2013.
Richard Domingues Boscovich, of Microsoft’s Digital Crimes Unit, said in a blog post at the time: “Like many of our past operations, this investigation once again revealed how criminals are adapting and evolving their attack methods in order to continue to infect people’s computers with malware.”
He went on to add: “Cooperation is the key to winning the fight against cybercrime.”
