Kelihos botnet creator sentenced to time served

A US judge has sentenced Russian hacker Peter Levashov to 33 months, time served, and three years of supervised release for creating and operating Kelihos, one of the largest spam botnets that ever existed.

Earlier this month, US prosecutors asked for a prison sentence ranging from 12 to 14.5 years.

However, in a sentencing hearing held today via Zoom, US district judge Robert Chatigny considered that the "default sentencing guideline substantially overstated the seriousness of Levashov's crimes" and that he was "not in a position to offend again."

Judge Chatigny considered that the time Levashov spent in prison in Spain (before being extradited) and in the US was enough to account for his crimes, which included planting malware on millions of computers and using said malware to send out waves of spam emails.

The judge deferred ruling on a fine to a later date, in nine days, lacking records related to Levashov's financial status.

A fine is expected. The judge also ordered that Levashov would have his computer monitored during the supervised release to prevent the former malware coder from engaging in new illegal activities.

Levashov case history:

• Levashev was arrested in April 2017 in Barcelona, Spain, and was extradited to the US a year later, in February 2018.
• He pleaded guilty to operating Kelihos in September 2018 and has been released on bail in January 2020, pending his sentencing.
• Initially scheduled for September 2019, his sentencing was delayed multiple times before taking place earlier today.
• Earlier this month, in a sentencing memorandum, US prosecutors recommended a prison sentence ranging from 12 to 14.5 years.

While the case brought by US prosecutors charged Levashov for his role in managing the Kelihos botnet, the Russian hacker is also known for creating and running Storm and Waledac, two other spam botnets.

Even to this day, both Storm and Kelihos are considered as one of the largest spam botnets that ever existed.

Levashev was known in underground cybercrime circles by the hacker pseudonym of "Severa," which he used since the mid-2000s and until his arrest in 2017.