PITTSBURGH (AP) – The Justice Department can continue to intercept information from 350 000 computers worldwide that are known to be infected with a data-stealing virus being spread by an alleged Russian computer hacker and his conspirators, a federal judge said.
Justice Department attorneys told United States District Judge Arthur Schwab the affected computers will remain linked to a government-provided substitute Internet server until the malicious software can be removed. The substitute server lets the government track the Internet addresses of the infected computers and pass them on to Internet service providers or government agencies in countries, so that computer-owners can be alerted to infections.
The hackers are allegedly led by a 30-year-old Russian man, Evgeniy Bogachev, who is not in custody. The hackers infected computers with a piece of malicious software that captured bank information used to drain more than $100 million from accounts or another that locked computer files until ransom payments were made.
Tuesday’s hearing on the preliminary injunction was held in Pittsburgh, where the Justice Department has charged Bogachev with siphoning more than $370 000 from a western Pennsylvania plastics firm using the virus known as Gameover Zeus.
The injunction issued Tuesday extends a temporary order the judge issued last week when Justice Department attorneys notified the court of the scam in sealed documents.
Since then, the government has moved to seize key computer servers in Canada, Ukraine and Kazakhstan, which were used to spread the ransom-demanding virus known as Cryptolocker. Victims included the Swansea, Massachusetts, police department, which paid a $750 ransom using the virtual currency Bitcoin to unlock its computer files.
Other businesses, including an eastern Pennsylvania assisted living company and a North Carolina pest control firm, paid $70 000 and $80 000, respectively, to have employees or computer experts fix their Cryptolocker-infected computers.
