FBI's Operation Bot Roast II nets additional indictments, sentences

Today the FBI announced the completion of Bot Roast II, the second phase of an ongoing investigation into the creation and use of botnets for illegal online activity. Botnets are networks created by remotely controlling several hundred or several thousand compromised computers worldwide. In 2007, botnets have been used by criminals in various ways to make money online. The ongoing investigation, in at least one specific case, is being assisted by the U.S. Secret Service.

Among the results announced today are three new indictments, the guilty pleas from two others, and the sentencing of three others. To date, the FBI says it has uncovered more than $20 million in economic losses. In one case, it has confirmed damages of nearly $20,000 as the result of distributed denial-of-service attacks caused by a botnet.

One of the individuals named today was previously identified at the completion of Bot Roast I in June. He is Jason Michael Downey of Covington, Kentucky, who was sentenced in U.S. District Court, Eastern District of Michigan on October 23, 2007. He will serve 12 months in prison followed by probation, restitution, and community service. One of Downey's victims confirmed to the FBI that financial damages as a result of the DDoS attacks launched by Downey's botnet amounted to losses of $19,500.

New indictments include:

Ryan Brett Goldstein, 21, of Ambler, Pennsylvania. He was indicted on November 1, 2007, by a federal grand jury in the Eastern District of Pennsylvania. Goldstein allegedly used a botnet to create a distributed denial-of service attack on the University of Pennsylvania this past summer.

Gregory King, 21, of Fairfield, California. He was indicted on September 27, 2007, by a federal grand jury in the Central District of California on four counts of transmission of code to cause damage to a protected computer. King allegedly conducted DDoS attacks against various companies.

Robert Matthew Bentley of Panama City, Florida. He was indicted on November 27, 2007, by a federal grand jury in the Northern District of Florida. Bentley allegedly used a botnet for coding and adware schemes. This investigation is being conducted by the U.S. Secret Service.

Additional sentence announced include

Alexander Dmitriyevich Paskalov, 38, with multiple U.S. addresses, was sentenced on October 12, 2007, in U.S. District Court, Northern District of Florida, and received 42 months in prison for his participation in a significant and complex phishing scheme that targeted a major financial institution in the Midwest and resulted in multimillion dollar losses.

Azizbek Takhirovich Mamadjanov, 21, residing in Florida, was sentenced in June 2007 in U.S. District Court, Northern District of Florida, to 24 months in prison for his part in the same Midwest bank phishing scheme as Paskalov. Paskalov established a bogus company and then opened accounts in the names of the bogus company. The phishing scheme in which Paskolov and Mamadjanov participated targeted other businesses and electronically transferred substantial sums of money into their bogus business accounts. Immigrations Customs Enforcement, Florida Department of Law Enforcement, and the Panama City Beach Police Department were active partners in this investigation.

Those awaiting sentencing include:

Adam Sweaney, 27, of Tacoma, Washington. He pled guilty on September 24, 2007, in U.S. District Court, District of Columbia. Sweaney conspired with others to send spam, then gained control of bot-controlled computers to launch additional spam and DDoS attacks.

John Schiefer, 26, of Los Angeles, California. He agreed to plead guilty on November 8, 2007, in U.S. District Court in the Central District of California. Schiefer used malicious software to intercept Internet communications, steal usernames and passwords, and defraud legitimate businesses by fraudulently purchasing goods for himself. Schiefer is the first person to be charged under the federal wiretap statute for conduct related to botnets.

Other arrests announced with Operation Bot Roast I include James C. Brewer of Arlington, Texas, who is alleged to have operated a botnet created from compromised computers at Chicago area hospitals, and Robert Alan Soloway of Seattle, Washington, who is alleged to have used botnets to relay tens of millions of spam e-mails.

The FBI recommends using and updating antivirus software, installing a firewall, not opening unknown e-mail attachments, and using strong passwords as ways to guard against the installation on and use of your personal computer for botnet activity.