A TrickBot malware developer sentenced to 64 months in prison

The Russian national malware developer Vladimir Dunaev was sentenced to more than 5 years in prison for his role in the TrickBot operation.

The Russian national Vladimir Dunaev (40) has been sentenced in the US to 64 months in prison for his role in the development and distribution of the TrickBot malware.

Vladimir Dunaev was extradited to the U.S. in October 2021.

Dunaev, also known as FFX, was involved in the development of a browser injection module for the Trickbot malware.

The man was arrested at the end of August 2021 at the Seoul International Airport, he has remained stuck in the Asian country since February 2020 due to the COVID-19 lockdown imposed by the local government and the cancelation of international travel.

According to The Record, which first reported the news, after the travel restrictions were lifted, the suspect had an ugly surprise, his passport had expired. Mr. A, this is the pseudonym used to identify the individual, was forced to live in Seoul waiting for the replacement of his passport from the local Russian embassy.

The Seoul High Court Criminal Division 20 (Chief Judge Jeong Seon-jae Baek Suk-jong Lee Jun-hyun) charged Mr. A for being a developer for the TrickBot gang since 2016.

Dunaev pleaded guilty on November 30, 2023, he admitted to conspiring to engage in computer fraud and identity theft, as well as conspiring to commit wire fraud and bank fraud.

“Dunaev developed browser modifications and malicious tools that aided in credential harvesting and datamining from infected computers, facilitated and enhanced the remote access used by Trickbot actors, and created a program code to prevent the Trickbot malware from being detected by legitimate security software.” reads the press release published by DoJ. “During Dunaev’s participation in the scheme, 10 victims in the Northern District of Ohio, including Avon schools and a North Canton real-estate company, were defrauded of more than $3.4 million via ransomware deployed by Trickbot.”

TrickBot is a popular Windows banking Trojan that has been around since October 2016, its authors have continuously upgraded it by implementing new features, including powerful password-stealing capabilities. The malicious code had infected millions of computers worldwide.

TrickBot initially partnered with Ryuk ransomware which used it for initial access in the network compromised by the botnet. Then Ryuk was replaced by Conti Ransomware gang who had been using Trickbot for the same purpose.

In 2021, the Conti gang used in exclusive the TrickBot to achieve initial access to the network of organizations worldwide.

Financial sanctions were imposed on numerous suspected Trickbot members by the Treasury Department’s Office of Foreign Assets Control (OFAC) in both February and September 2023.

“This case and subsequent sentencing sends a strong message to cybercriminals and other bad actors who target individuals and businesses with malicious intent,” said Special Agent in Charge Greg Nelsen of the FBI Cleveland Field Office. “The complexities of this case required careful coordination among our domestic and international partners and their commitment to meticulous investigative work. I am proud of the synchronized effort to see that justice was served.” 

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Trickbot)