Microsoft Names Reputed Head of Kelihos Botnet

wiredmikey writes with an update on Microsoft's takedown of the Kelihos botnet. From the article: "Microsoft is not just taking down botnets; it is taking them down and naming names. In an amended complaint [PDF] filed Monday in U.S. District Court for the Eastern District of Virginia, Microsoft named a man from St. Petersburg, Russia, as the alleged head of the notorious Kelihos botnet. Naming names can be a risky business. Previously, Microsoft alleged Dominique Alexander Piatti, dotFREE Group SRO and several unnamed 'John Does' owned a domain cz.cc and used cz.cc to register other subdomains used to operate and control the Kelihos botnet. However, the company later absolved Piatti of responsibility when investigators found neither he nor his business was controlling the subdomains used to host Kelihos. Whether naming Sabelnikov – who, according to Krebs on Security, once worked as a senior system developer and project manager for Russian antivirus vendor Agnitum, will have the same effect as naming the Koobface gang remains to be seen. Though Kelihos has remained defunct since the takedown last year, the malware is still on thousands of computers."

Re:So, wait.

[DeathFromSomewhere]

Nope. There is no indication that this guy wrote the botnet as part of his job. A more likely explanation is that he used his employment to gather information about how to avoid antivirus software killing his botnet.

Re:So, wait.

[gstoddart]

Does this lend credence to the conspiracy theory that antivirus vendors are, in some way, behind the very viruses they're supposed to remove?

Or merely suggest that it's more lucrative to go to the dark side? One guy does not a conspiracy make.

And, likewise, this can't disprove any such conspiracy either.

Re:So, wait.

[willaien]

Nope. There is no indication that this guy wrote the botnet as part of his job. A more likely explanation is that he used his employment to gather information about how to avoid antivirus software killing his botnet.

Senior Systems Developer is a pretty high up position. It's not CTO level, but... I'd say that joining just to get access to info at that level is a bit of a stretch. gstoddart's suggestion that he became the very monster he was fighting would have a bit more credence.