Microsoft: Worm Operator Worked at Antivirus Firm
Summary: Microsoft's amended complaint filed with the U.S. District Court for the Eastern District of Virginia names 31-year-old Andrey N. Sabelnikov of St. Petersburg, Russia as the operator of the Kelihos botnet, which Microsoft dismantled in a coordinated takedown the prior year. A source close to the investigation told Krebs On Security that a researcher found debug code in the Kelihos source that downloaded a malware installer from sabelnikov.net, a photography site registered to Sabelnikov, who worked from 2005 to 2007 at Russian antivirus firm Agnitum.
Why it matters: The alleged operator of a global spam botnet held a senior developer and project manager role at an antivirus and firewall vendor - a reminder that the skills and access behind security products are the same ones that build the threats they are sold to stop.
Read the original at Krebs on Security ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026