A Russian national, who was arrested in South Korea last month and extradited to the United States on October 20, appeared in Ohio state federal court on Thursday to face charges for his role alleged to be a member of the infamous TrickBot group.

Court documents have shown that Vladimir Dounaev, 38, along with other members of the transnational cybercrime organization, stole money and confidential information from unsuspecting victims, including individuals, financial institutions, school districts, service companies public bodies, government entities and private companies.

Beginning its roots as a banking Trojan in 2016, TrickBot has evolved into a modular, multi-step Windows-based anti-crime solution capable of stealing valuable personal and financial information, and even dropping ransomware and post-exploitation toolkits onto compromised devices. The malware is also known for its resilience, having survived at least two teardowns by Microsoft and the US Cyber ​​Command a year ago.

However, on a legal level, the US government earlier this year indicted a 55-year-old Latvian woman named Alla Witte, who prosecutors said worked as a programmer “overseeing the creation of code related to surveillance and monitoring. tracking authorized users. of Trickbot malware. ”Dunaev is the second Trickbot accused to be arrested in 2021.

Dunaev, in particular, is said to have worked as a developer for the group, responsible for the creation, deployment and management of the Trickbot malware from November 2015, while overseeing the execution of the malware, as well as designing Firefox web browser changes and helping to hide malware from detection by security software.

In early September, the South Korean media reported the arrest of Dunaev (then identified only as “Mr. A”) at Incheon International Airport as he attempted to leave for Russia after being stranded in the country for over a year due to COVID-19. The suspect, who arrived in February 2020, also had his passport expired in the meantime, forcing him to stay in a hotel pending his replacement.

But after the passport was reissued, the accused attempted to leave for his birthplace in Russia, which led to his arrest in accordance with an extradition request from the United States. Dunaev has been charged with conspiracy to commit computer fraud and aggravated identity theft, committing electronic and bank fraud, conspiracy to commit money laundering and several counts of electronic fraud, aggravated bank fraud and identity theft.

If found guilty on all counts, the accused faces a total prison sentence of 60 years.

“Trickbot has attacked businesses and victims around the world and infected millions of computers for theft and ransom, including networks of schools, banks, municipal governments and businesses in the healthcare, energy and agriculture. noted Deputy Attorney General Lisa O. Monaco in a press release.