PRIMARY SOURCE DB
MITRE ATT&CK v15.1
Page built 2026-09-25
Data as of September 24, 2026 at 17:02 UTC
Search
CASE DOSSIER pleaded

U.S. v. Peter Levashov (Kelihos Botnet)

Docket: 3:17-cr-00083 Court: U.S. District Court for the District of Connecticut Opened: 2017-04-07 Sector: E-Commerce, Consumer Services, Telecommunications

Key Facts

Status
PLEADED
Legal disposition
Loss Amount
$25.0 million
Generated tens of millions in fraudulent spam income and illicit botnet lease fees.
Techniques
1
Verified mappings
Defendants
1
Named in charges
  • Legal Status: PLEADED in U.S. District Court for the District of Connecticut.
  • Primary Target Sector: E-Commerce, Consumer Services, Telecommunications.
  • Documented Financial Loss: $25.0 million.
  • 1 verified MITRE ATT&CK techniques substantiated with verbatim court excerpts.
Export structured case data and MITRE ATT&CK Navigator layer:
Download Navigator Layer (JSON) Case Data (JSON)

Case Summary

Russian operator (Severa) of the notorious Kelihos botnet, controlling over 100,000 infected computers worldwide used to harvest credentials, distribute ransomware, and blast billions of spam and stock pump-and-dump emails daily.

Procedural & Incident Timeline

2017-04-07 arrest

Levashov arrested while vacationing in Barcelona, Spain, by Spanish National Police.

2018-02-02 extradition

Extradited from Spain to the District of Connecticut.

2018-09-12 plea

Pleads guilty to wire fraud, computer fraud, and identity theft charges.

Named Defendants & Operatives

Defendant Nationality Status Prison Term Restitution Notes
Peter Yuryevich Levashov Russian Federation pleaded Pending None Operator of the Kelihos botnet; pleaded guilty in the District of Connecticut.

Substantiated MITRE ATT&CK Techniques

Technique ID Technique Name & Tactic Primary Source Evidence Excerpt Locator Verification
T1584 Compromise Infrastructure
Resource Development
 "Levashov leased out compromised zombie computers as an automated bulletproof proxy network to shield criminal infrastructure." Indictment ¶ 11, Page 5 reviewed

Cite & Embed This Case Record

Public Domain / CC0
Bluebook Legal Citation:
Cyberattack Case Library, U.S. v. Peter Levashov (Kelihos Botnet), No. 3:17-cr-00083 (U.S. District Court for the District of Connecticut 2017), https://cyberattackcaselibrary.pages.dev/cases/us-v-levashov-kelihos-botnet/
Embeddable Incident Card (HTML):
<iframe src="https://cyberattackcaselibrary.pages.dev/embed/case/us-v-levashov-kelihos-botnet" width="100%" height="220" style="border:none; border-radius:6px;" loading="lazy"></iframe>