Ukrainian Hacker Linked to US Cyber-Security Expert Pleads Guilty

A Ukrainian computer hacker who fought extradition to the United States and has been accused of trying to frame a prominent cyber-security expert pleaded guilty on Wednesday to using more than 13,000 computers to steal log-in and credit card data, federal prosecutors said.

Sergey Vovnenko, 29, whose aliases included "Flycracker," "Centurion" and "Darklife," pleaded guilty to charges of aggravated identity theft and conspiracy to commit wire fraud, according to US Attorney Paul Fishman in New Jersey.

Vovnenko, of Naples, Italy, faces a mandatory minimum two-year prison term for identity theft and may face additional prison time, plus a fine for conspiracy, at his May 2 sentencing.

The defendant entered his plea before US District Judge Esther Salas in Newark, New Jersey. Timothy Anderson, a lawyer for Vovnenko, was not immediately available to comment.

US prosecutors said that from September 2010 to August 2012, Vovnenko was part of an international conspiracy to hack into computers belonging to individuals and companies, steal user names and passwords for bank accounts and other online services and steal debit and credit card numbers.

They said Vovnenko admitted to operating a "botnet" of more than 13,000 computers infected with malware to gain unauthorized access and used "Zeus" malware to steal banking information from and record keystrokes of people using infected computers.

Vovnenko fought extradition after he was detained by Italian authorities following his June 13, 2014 arrest, US prosecutors said. The defendant made his initial US court appearance on October 13, 2015.

At the time of the extradition, Brian Krebs, who runs the cyber-security blog Krebs on Security, wrote that Vovnenko had been behind a 2013 plot to have heroin sent to Krebs' Virginia home, and then tell police when the drugs arrived.

Krebs said he foiled the plot after he tracked Vovnenko's online activities and alerted police.

The case is US v. Vovnenko, US District Court, District of New Jersey, No. 14-cr-00237.

© Thomson Reuters 2016