US court sentences Russian hacker to four and a half years for operating a Citadel botnet of 7K computers to steal banking information
Alexander J Martin / The Register :
Context & Ripple Effects
This sentencing is an early entry in a decade-long string of US prosecutions against Russian-speaking operators of large-scale botnets. The 7,000-machine Citadel network described here looks small next to what came out later: the man who helped build the Citadel malware itself was sentenced in 2017 for an infection footprint of roughly 11 million computers and over $500 million in losses.
The pattern also runs through adjacent families — Peter Levashov pleaded guilty in US District Court over his role in the Kelihos botnet after Spanish authorities arrested him — showing that European arrests routinely funnel these cases into American courts.
First-order effects
- The defendant begins a four-and-a-half-year federal prison term, removing one operational figure from the Citadel banking-theft infrastructure.
- US investigators gain a convicted insider whose case file documents how Citadel harvested banking credentials from compromised machines.
Second-order effects
- Each conviction strengthens the prosecutorial template: two years later Citadel's own malware developer drew five years, and by 2026 the same sentencing machinery was applied to ransomware-adjacent figures, including an 8.5-year term for a Karakurt extortion negotiator.
- Botnet takedowns increasingly depend on cross-border arrests — the Levashov route through Spain — making European cooperation a prerequisite for these US convictions rather than an exception.
Third-order effects
- If the escalation holds — from 54 months for operating a 7,000-node network toward multi-year terms for builders and facilitators of larger operations — prison exposure becomes a priced-in business risk shaping how cybercrime groups structure roles, with negotiators and affiliates now facing the same individual liability as operators.
The trend: US courts are moving from prosecuting botnet operators individually to mapping entire criminal ecosystems, with sentence lengths climbing as prosecutors reach further up the chain into malware development, negotiation, and affiliate roles.