As the original indictment stated: "The Gozi Virus has caused, at a minimum, millions of dollars in losses."
According to Reuters, Deniss Calovskis made the admission in federal court in Manhattan on Friday.
"I knew what I was doing was against the law," Calovskis said, according to the news agency.
The 30-year-old was extradited to the United States from his native Latvia in February. It is unclear whether American prosecutors will count the 10 months that he already served in his homeland.
As Ars reported in January 2013, Calovskis was accused of being the person who made Gozi significantly more potent, as it deployed more widely in 2010. (The virus was first discovered in the wild in 2007.)
Notably, the malware had gained the capability to do sophisticated Web injection. When an infected computer was pointed at a banking website, the virus wouldn't simply steal account login information; it could be configured to inject additional data requests right into the bank's webpage. This made it almost impossible to tell the requests were not being made by the bank itself. In this way, the malware could be tweaked to ask for Social Security numbers, driver's license information, a mother's maiden name, PIN codes—anything a client wanted.
But in August 2013, Calovskis wholly denied being part of Gozi.
"I am like a hostage in this situation," he said in an interview with Latvian television, according to Bloomberg. "I don’t know about the Gozi virus. I haven’t helped any schemers to get money and I haven’t received any."
The mastermind of Gozi, a Russian man named Nikita Kuzmin, who was supposed to be sentenced in 2013, is still awaiting his sentencing hearing. The court docket does not indicate why this delay has persisted.
Neither Calovskis' nor Kuzmin's attorneys immediately responded to Ars' request for comment.
Calovskis is set to be sentenced on December 14.
reader comments
35