Cryptojacking Malware Devs Sentenced to 20 Years in Prison

Two members of the prolific Romanian hacker gang Bayrob Group were sentenced to two decades in U.S. prison apiece after their malware mined crypto on 400,000 infected computers.

Group leader Bogdan Nicolescu and co-conspirator Radu Miclaus were sentenced to 20 and 18 years respectively after being found guilty on 21 different counts of wire fraud, money laundering aggravated identity theft and other crimes, a press release announced Friday. The gang was also accused of developing malware which mined bitcoin and monero using their host computers’ processing power.

Tiberiu Danet, a third Bayrob Group member, pleaded guilty in Nov. 2018 to eight charges. His sentencing is scheduled for Jan. 8.

From its founding in 2007 to its members’ apprehension and eventual extradition in late 2016, the Bayrob Group, which operated out of Bucharest, Romania, ran a sprawling hacking and malware operation. They deployed trojan malware in seemingly mundane emails from well-known companies and groups, but when victims attempted to download attachments apparently from Norton, the IRS and Western Union, their computers instead became infected with the Bayrob botnet, according to an indictment.

The botnet allowed its Romanian handlers to steal $4 million total, prosecutors claimed.

The botnet also installed crypto mining software, according to the July 2016 indictment. And it was not discreet; the Bitcoin and Monero mining operation hogged hosts’ processing power. 

“Once a bot was instructed to mine for cryptocurrency, much of its processing speed and power would be unavailable to its legitimate owner.”

Bayrob also scanned for and transferred ownership of victims’ crypto wallets, if they had one.