Michael Hogue, who online was known by the moniker "xVisceral," was sentenced by US District Judge Kevin Castel in Manhattan after pleading guilty in 2013 to distributing malware and conspiring to commit computer hacking.
He was also ordered to forfeit $40,000 (roughly Rs. 26 lakhs) and perform 500 hours of community service. The sentence is conditional on Hogue's continued cooperation with prosecutors in related matters.
Hogue, 25, first came to the attention of the US Federal Bureau of Investigation in 2010, when, in an effort to advertise the malware, he contacted an undercover agent running a website established as part of a sting operation targeting the illegal trade in credit card numbers, court papers said.
In 2012, Hogue was arrested in an international takedown stemming from the sting. He subsequently agreed to cooperate with authorities in their investigation of Blackshades.
That investigation culminated in May 2014 with a sweep by US and European authorities that resulted in about 100 people being arrested, including Alex Yucel, a Swedish citizen who ran Blackshades.
Prosecutors said Blackshades' flagship product was the "Blackshades Remote Access Tool," which gave hackers remote control of other people's computers and allowed them to record keystrokes, steal passwords and gain access to personal files.
The software, which Hogue co-created with Yucel, could be bought for $40 and was used to take over computers' cameras to spy on their owners or to freeze people's computers in exchange for a ransom, prosecutors said.
Blackshades had more than 6,000 customer accounts in more than 100 countries and generated at least $350,000 in revenue by selling the software from September 2010 to April 2014, prosecutors said.
Castel had harsh words for Hogue as he handed down the sentence Friday, saying he committed a crime of "historic proportions" that spread misery to people around the world.
"But when he was confronted he did something right," the judge said, "He did what he could to make amends."
Hogue said before being sentenced: "I feel awful for everything I have done."
Yucel, 25, pleaded guilty in 2015 to distributing malicious software, and he was sentenced in June to 4-3/4 years in prison.
The case is U.S. v. Hogue, U.S. District Court, Southern District of New York, No. 13-cr-00012.
© Thomson Reuters 2016
Catch the latest from the Consumer Electronics Show on Gadgets 360, at our CES 2026 hub.