ALGERIAN NATIONAL EXTRADITED TO U.S. FOR ALLEGED PART IN "SPYEYE" CYBERCRIMES

FROM:  U.S. DEPARTMENT OF JUSTICE
Friday, May 3, 2013

International Cybercriminal Extradited from Thailand to the United States

Algerian national Hamza Bendelladj, aka "Bx1," has been extradited from Thailand to the United States to face charges in Atlanta for allegedly playing a critical role in developing, marketing, distributing and controlling "SpyEye," a pernicious computer virus designed to steal unsuspecting victims’ financial and personally identifying information.

The charges were announced today by Acting Assistant Attorney General Mythili Raman of the Justice Department’s Criminal Division, U.S. Attorney Sally Quillian Yates of the Northern District of Georgia and FBI Special Agent in Charge Mark F. Giuliano of the Atlanta Field Office.

Bendelladj, 24, has been charged in a 23-count indictment that was returned on Dec. 20, 2011, and unsealed today. The indictment charges Bendelladj with one count of conspiring to commit wire and bank fraud, 10 counts of wire fraud, one count of conspiracy to commit computer fraud and 11 counts of computer fraud. Bendelladj is scheduled to be arraigned today in U.S. District Court in the Northern District of Georgia before U.S. Magistrate Judge Janet F. King.

On Jan. 5, 2013, Bendelladj was apprehended at Suvarnabhumi Airport in Bangkok, Thailand, while he was in transit from Malaysia to Egypt. He was extradited from Thailand to the United States on May 2, 2013.

"Hamza Bendelladj has been extradited to the United States to face charges of controlling and selling a nefarious computer virus designed to pry into computers and extract personal financial information," said Acting Assistant Attorney General Raman. "The indictment charges Bendelladj and his co-conspirators with operating servers designed to control the personal computers of unsuspecting individuals and aggressively marketing their virus to other international cybercriminals intent on stealing sensitive information. The extradition of Bendelladj to face charges in the United States demonstrates our steadfast determination to bring cybercriminals to justice, no matter where they operate."

"No violence or coercion was used to accomplish this scheme, just a computer and an Internet connection," said U.S. Attorney Yates. "Bendelladj’s alleged criminal reach extended across international borders, directly into victims’ homes. In a cyber-netherworld, he allegedly commercialized the wholesale theft of financial and personal information through this virus which he sold to other cybercriminals. Cybercriminals take note; we will find you. This arrest and extradition demonstrates our determination to bring you to justice."

"The FBI has expanded its international partnerships to allow for such extraditions of criminals who know no borders," said FBI Special Agent in Charge Giuliano. "The federal indictment and extradition of Bendelladj should send a very clear message to those international cyber-criminals who feel safe behind their computers in foreign lands that they are, in fact, within reach."

According to court documents, the SpyEye virus is malicious computer code or "malware," which is designed to automate the theft of confidential personal and financial information, such as online banking credentials, credit card information, usernames, passwords, PINs and other personally identifying information. The SpyEye virus facilitates this theft of information by secretly infecting victims’ computers, enabling cybercriminals to remotely control the computers through command and control (C&C) servers. Once a computer is infected and under the cybercriminals’ control, a victim’s personal and financial information can be surreptitiously collected using techniques such as "web injects," which allow cybercriminals to alter the display of web pages in the victim’s browser in order to trick them into divulging personal information related to their financial accounts. The financial data is then transmitted to the cybercriminals’ C&C servers, where criminals use it to steal money from the victims’ financial accounts.

According to court documents, from 2009 to 2011, Bendelladj and others allegedly developed, marketed and sold various versions of the SpyEye virus and component parts on the Internet and allowed cybercriminals to customize their purchases to include tailor-made methods of obtaining victims’ personal and financial information. Bendelladj allegedly advertised the SpyEye virus on Internet forums devoted to cybercrime and other criminal activities. In addition, Bendelladj allegedly operated C&C servers, including a server located in the Northern District of Georgia, which controlled computers infected with the SpyEye virus. One of the files on Bendelladj’s C&C server in the Northern District of Georgia allegedly contained information from approximately 253 unique financial institutions.

If convicted, Bendelladj faces a maximum sentence of up to 30 years in prison for conspiracy to commit wire and bank fraud; up to 20 years for each wire fraud count; up to five years for conspiracy to commit computer fraud; up to five or 10 years for each count of computer fraud; and fines of up to $14 million dollars.

The public is reminded that the indictment contains only allegations, and the defendant is presumed innocent unless and until proven guilty.

This case is being investigated by the FBI and is being prosecuted by Special Assistant U.S. Attorney Nicholas Oldham and Assistant U.S. Attorney Scott Ferber of the Northern District of Georgia, and Trial Attorney Carol Sipperly of the Criminal Division’s Computer Crime and Intellectual Property Section. Valuable assistance was provided by the Criminal Division’s Office of International Affairs, which worked with its international counterparts to effect the extradition.