Citadel Malware: Russian Man Who Helped Develop Malware Gets 5 Years in Prison

A Russian man who helped develop and distribute malicious software designed to steal personal financial information was sentenced Wednesday in Atlanta to serve five years in prison.

Mark Vartanyan, also known as "Kolypto," had pleaded guilty in March to a computer fraud charge after reaching a deal with prosecutors.

US District Judge Mark Cohen said Vartanyan would receive credit for time served, including more than two years in a prison in Norway following his arrest there in October 2014. He will be turned over to immigration authorities for deportation once he serves his sentence.

Russian Sentenced to 4.5 years in US Prison for 'Citadel' Malware

Starting in 2011, Citadel was marketed on invite-only, Russian-language Internet forums used by cybercriminals, and users targeted the computer networks of major financial and government institutions around the world to steal financial account credentials and personally identifiable information, prosecutors have said. Industry estimates indicate it infected about 11 million computers worldwide and caused more than $500 million in losses.

Vartanyan, a native of Moscow, was involved in the development, improvement, maintenance and distribution of Citadel from August 2012 to January 2013 while living in Ukraine and again from April 2014 to June 2014 while living in Norway, prosecutors have said. His attorney said he was working for a healthcare technology company in Norway.

Vartanyan didn't author the malware, federal prosecutor Steven Grimberg told the judge, but "he was, for lack of a better term, the 'mechanic,' the person who made it more pernicious."

Prosecutors requested a five-year sentence, much lower than possible, because Vartanyan quickly showed remorse and began helping the government, Grimberg said. Details of his cooperation were not revealed.

"I have rarely come across an individual who has been as sorry for his role as Mark Vartanyan," he said.

Nevertheless, Grimberg said, cybercriminals often operate in countries that don't allow for extradition, so it's important to send a message that anyone who is caught and prosecuted will serve significant time.

Addressing the judge in accented English, Vartanyan said he encountered the Bible in prison and felt an enormous weight lifted when he understood through prayer that he could accept what he'd done and help make things right.

"My intention is to see how I can lead this Christian life God showed me outside" of prison, he said.

Court-appointed defense attorney Stephen Johnson said Lars Dahle, CEO of Dignio, a remote patient-monitoring company where Vartanyan worked before his arrest, was so impressed by him that he regularly visited Vartanyan while he was in prison in Norway and offered to fly to Atlanta for the sentencing. Norwegian prison officials also vouched for Vartanyan's character, writing that he'd been helpful to them and other inmates.

Jim Lenahen, pastor of a church in Roswell, told the judge that Dahle, an old friend, is eager to rehire Vartanyan once he's released. He said Dahle asked him to check on Vartanyan in custody, and the pastor was so impressed by his truthfulness and commitment to his newly discovered faith that he took to visiting regularly.

Given the seriousness of the crime but also taking into account his quick acceptance of responsibility and cooperation with the government, the judge said five years is appropriate, and he hopes Vartanyan will do good once he's free.

"Sometimes getting into trouble can open up your eyes to a lot of different stuff, and I think it has done that for Mr. Vartanyan," the judge said, adding: "You made a great start where you are right now in terms of your future life, and I hope that continues outside of prison."