AO

l0)

106 (Rev.04i

Application fora Search Warrant

UNITED STATES I)ISTRICT COuRT
for the
District of Alaska
ln the Matter of the Search of
(BrieJllt describe the propern- b be searclrcd
or iilentifi'the persoh by na-nte and address)

Case

No. 3:17-mj-00 135-

Lt"\S

ln RE Application for a Warrant Under Rule 41 of the
Federal Rules of Criminal Procedure to Disrupt the
Kelihos Botnet

penaltyれ
′″
9′

`′

ケわ be

鵠盤羅
鰤普F郡譜沸方耀鷲飢灘
器 l品 機■嶽帆::L::T』 蹴ぎ
丸淵
猥

S`α κル″α
″
′gム ,`7rsわ

:∝

ε
α′
ブ
οァ
リr

See Attachment A,incorporated here by reference.

located in the

District

of

Alaska

there is now concealed lidentifi

the

person or describe the propert.v to be sei:ed)'.

See Attachment B, incorporated here by reference.
The basis for the search under Fed. R. crim. P,

a

1

(c) is

@heck one or more)i

devidence of a crime;
D contraband, fruits of crime, or other items illegally possessed;
D property designed for use, intended for use, or used in committing

E

a person to be arrested or a person who is

a crime;

unlawfully restrained.

The search is related to a violation of:
Cο ″θSθ crノ θ″

18 USC§ §1030,1343,and

2511.

Fraud and rerated activity ,^
wiretapping.

wire fraud, and iilesat

"3#!iri"?',i,i['IJfir*ers,

The application is based on these facts:

See attached Affidavit in Support of Search Warrant.

d
d

Continued on the attached sheet.

of T

oelayed notice
days (give exact end.ing date if more than 30 days:
under 18 U.S.C.§ 3103a,the basis ofwhich is sct fOrth Oη
tha attac鐵,d shect.

) is requested

Signature Redacted
Appilcailt's signature
Elllot Peterson,Specia:Agent,FB「
Printed name and title

Swom to before me and signed in my presence.

嘘

′
S′

DEBORAH M.SMITH

柵 躙 馘 スニ
ν雪
.
Лこgε

City and state: Anchorage, Alaska

t S,P,α

ルた

Hon.Deborah M Smlth,United States Magistra授
P7,″

′ ′
,α
`′

777C‐

4′ ,′

lrJθ
′

三豊些旦_

 IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF ALASKA
IN RE APPLICATION FOR A
IVARRANT UNDER RULE 41 0F THE
FEDERAL RULES OF CRIⅣ IINAL

PROCEDURE TO DISRUPT THE
KELIHOS BOTNET

Case No. 3: 17-mj-00135-DMS

AFFIDAVIT IN SUPPORT OF AN
APPLICATION UNDER RtrLE 41 FOR A SEARCH
WARRANT
I,ElliOtt PetersOn,being flrst duly sworn,hereby depose and state as
follows:

INTRODUCTION AND AGENT BACKGROUND
l.

I am a Special Agent with the Federal Bureau oflnvestigation in

AnchOrage,Alaska. I currently investigate crilninal and natiOnal security computer
intrusiOns in the AnchOrage Field Offlce as a lnember ofthe Counter lntelligence/
Cyber Squad. I have investigated cyber and cOmputer intrusion llnatters for Over
flve years and l specialize in the investigation of cOmplex bOtnets,including Peer tO

Peer botnets,as well as bOtnets facilitating account takeover iaud and distributed
denia1 0f service attacks(DDOS).

2.

I make this affidavit in support of an application for a warrant under

Federai Rule of Criminal Procedure 4L to authorize an online operation to disrupt

the Kelihos botnet currently under the control of Peter Yuryevich LEVASHOV, a

criminal hacker. The operation, which is particularly described in Attachmont A
and Attachment B, involves the distribution of updated peer lists,JrO

*"."E$

filter lists, further described in Attachment B, to the TARGETApR _
b Z0ll
COMPUTERS currently infected with the Kelihos botnet malware in violation of
and./or IP

 Title

18, United States Code, Sections 1030, L343, and 2511, as described

Attachment

A. This

operation

will

in

also obtain the Internet Protocol addresses and

associated routing information of those infected computers, and those addresses are
evidence of crimes committed by LEVASHOV. A PRTT order has been requested for

the purpose ofattaining those IP addresses and associated routing

information. This operation will not capture content from the TARGET
COMPUTERS or modiSz them in any other capacity except limiting the TARGET
COMPUTERS' ability to interact with the Kelihos botnet. This limitation is
achieved through the distribution of peer iists and job messages, described below.

3.

Unless otherwise noted, the following information was obtained by

your affiant, other speciai agents and officers of the Federal Bureau of Investigation
(FBI), third-party witness interviews, and/or from other law enforcement officers
who conducted additional investigation into the subject matter of this criminal

enterprise, aII of whom I believe to be truthful and reliable.

TECHNICAL DEFINITIONS

4.

As used herein, the following terms have the following meanings:

a. "Malware"

is malicious software, usually loaded onto a computer
without the knowledge of the computer's owner or user. For example,
computer viruses are malware.

b. A "botnet" is a network

of computers that cybercriminals have infected
with malware that gives a cyber criminal access to each computer and
ailows a cyber criminal to control each computer remotely.

c. An Internet

Protocol (IP) address is the globally unique address of a
computer or other device connected to a network, and is used to route
communications to and from the computer or other t*U

3:17-mj-00rrr:::et
2

APR -52o17

 d.

"Peer to peer" refers to a means of networking computers such that
they communicate directly with each other, rather than through a
centralized management point.

PROBABLE CAUSE

5.

There is probable cause to believe that the TARGET COMPUTERS

identified in Attachment A are infected by malicious sofbware that causes them to
collectively receive and obey commands from a common command and control

infrastructure controlled by LEVASHEV, forming a botnet that has been named
"Kelihos."

6.

I have determined that Kelihos is a Peer to Peer botnet, whose

principal functions are to (1) distribute high volumes of spam email to further
criminal schemes; (2) install malicious payloads, such as ransomware; and (3)
harvest user credentials fuom infected computers. Each of these schemes are
conducted for the financial benefit of LEVASHOV and other cybercriminals.

7.

Based upon the investigation described below, I believe that Kelihos is

operated and controlled by an individual identified as Peter Yuryevich LEVASHOV,
a.k.a. "Petr LEVASHOV," "Peter Severa," "Petr Severa," and "sergey Astakhov.,,

3: 17-mj-00135-DMS

APR
3

- 5 ?017

 .t t have
also determined that the botnet is used for the financial benefit of LEVASHOV and

other cybercriminals.

8.

I have also determined that in addition to distributing spam email, the

Kelihos botnet functions to harvest user credentials, and distribute malicious
payloads, including ransomware, as well as facilitating other schemes meant to

enrich LEVASHOV. These activities will be described more fully in subsequent
paragraphs.

I am also aware that an indictment was filed in 2007 in the Eastern District of
Michigan for conspiracy to commit electronic mail fraud, mail fraud, and wire fraud in
violation of 18 U.S.C. $$ 371, 1037(aX2)-(aXB), 1037(bX2XC), 1341, and 1343 and several
substantive counts of violating 18 U.S.C. $$ 1037(a)(2), 1037(bX2XC), and Section 2. That
indictment remains pending. I am also aware that a criminal complaint fi1ed in the U.S.
District Court for the District of Columbia, which in 2009 charged LEVASHOV in his true
name with two substantive counts of violating 18 U.S.C. $$ 1030(aX5)(AXi), 1030(a)(5XBXi),
1030(aX5)(AXi) and 1030(a)(5XBXV), as well as one count of conspiracy to commit these
offenses in violation of 18 U.S.C. $ 371. These charges resulted from LEVASHOV's
operating the Storm Botnet from January 2007 until September 22,2008. That botnet, like
that which is the subject of this prosecution, sent spam to facilitate pump and dump
1

schemes and the purchase of grey market pharmaceuticals. Because the government was
unable to apprehend and detain LEVASHOV, it dismissed the complaint in20t4.

3:17-mj-00135-DMS

APR -521117
4

 9.

Based on my investigation to date, I have observed that the number of

computers infected with Kelihos at any one time can vary. At times, over 100,000
computers have been simultaneously infected worldwide with Kelihos. Presently,

the number sits between 25,000 and 100,000, approximately 5-l0Vo of which are
computers located in the United States. Based on my review of computers which are
infected with the Kelihos malware and conversations with other FBI agents and
computer security researchers who have investigated the code used to create the
Kelihos botnet, I know that

it

can be

difficult for computer users to detect Kelihos

infections. Kelihos is designed to persist on a victim's computer despite any overt
actions by the victim to remove

it.

For example, the first time that Kelihos runs,

sets its property setting to "invisible" so that

it

it

cannot be seen or manipulated by

the victim. Based on my investigation and the investigation of others, I have found
evidence of computers infected with Kelihos throughout the United States,

including the District of Alaska, District of Connecticut, Western District of
Washington, Central District of California and the Southern District of New York.

A.

OPERATION OF THE KELIHOS BOTNET

10.

As described above, Kelihos utilizes Peer to Peer (P2P) connectivity.

Instead of utilizing a traditional Command and Control (C2) server to control ail of
the bots, control is distributed across the entire infection base. The P2P design
prevents law enforcement from merely taking over the C2 server and gaining

immediate control of the entire botnet.

APR-52o17

3:17-mj-00135-DMS
5

 11.

Keiihos infects computers and divides them into two groups: "router

nodes" and "worker nodes." Router nodes are so named based upon their ability to

route communications directly to both backend servers as well as other infected
peers. Router nodes are Kelihos infections that have publicly accessible IP
addresses. Router nodes are important to Kelihos as they permit direct
communication to the infected computer. Router nodes comprise approximately
LjVo of t]ne Kelihos botnet.

12.

In contrast, worker nodes comprise 90Vo of the Keiihos botnet, and

utilize private IP addresses. Most internet enabied devices utilize private IP
addresses, as they are separated from the Internet by one or more networking

devices. For example, in many U.S. households, a Wi-Fi router is connected directly
to a cable or DSL modem. This Wi-Fi router would then be assigned the
household's public IP address. Each device then connected to the Wi-Fi router

would be assigned a private IP address. Worker nodes are harder to maintain for
the botnet operator, as they are not directly accessible like a router node with

a

public IP address would be.

13.

To counteract the difficulty of contacting worker nodes with private IP

addresses, Kelihos commands its worker nodes to check in regularly with the router

nodes. That "check in" takes the form of exchanging peer lists and job messages.
Peer lists maintain the IP addresses of other Kelihos infections, that is, an infected

computer's peers. This information informs each peer who else

it

with. Then, when a set amount of time has passed, the worker

node

3:17-mj-oo13s-DMs

can communicate

will contact

Je
APR -52017

 another router node to exchange data, including each other's peer lists. In response,
the worker node then compares its own peer list with the received peer list, and
updates its own peer list with new IP addresses until

it

reaches a maximum

number of 3,000.

1. Overview Of Kelihos's Spam Distribution

14.

Based upon my training and experience, I know that spam email

messages distributed by botnets such as Kelihos are intended to facilitate various

activities, including the sale of grey market pharmaceuticals; the manipulation of

thinly-traded securities; the solicitation of fraudulent affiliate and "work from
home" schemes; and the distribution of malicious payloads, such as ransomware.
Spam emails directing the recipients to participate in all of these schemes have
been directed to Alaskan recipients.

15.

For example, Kelihos generates massive volumes of spam emails

directing recipients to web sites advertising the sale of branded pharmaceuticals.
Based upon my training and experience, I know that many of these branded

pharmaceuticals normally require prescriptions. Additionally, I know that the
pharmaceuticals are offered at or below market rates, indicating that they are likely
counterfeit.

16.

Kelihos also distributes high volumes of emails intended to manipulate

the value of thinly-traded securities, including so-called "penny stocks." In these
messages, the recipient is led to believe

that a specific stock will soon trade at a

much higher value. For example, one email I reviewed stated that

3:17-mj-00135-DMS

it *"r

u"\

#

1

APR-52o17
7

 "Advanced Trading Alert Notice," with a "hot pick that

will

garn L00Vo..." The email

urges recipients to "[a]quire [a specific thinly-traded secutity] ot March 1 and

receive

lO1Vo

profit." . Another email stated "Don't you crave to purchase a deal at

$0.07 and cash at $.21?!

ask is 0.2L, i1's
and

it

2OOVo

2OOVo

gains simple. Get the stock: t. . . 1. See, [. . .] current

than the todays bid. On Monday they will announce big news

sure spike to .2L. Start buying [. . . ] quick." Because these emails target

stocks which generally experience very low trade volume, they are vulnerable to

price manipulation associated with small increases in trade volume.

17.

Spam distributed by Kelihos is also a primary vector for affiliate

recruitment scams commonly called "work from home." In these messages, the

unwitting recipient is directed to an email address or website from which they can

I

receive more information about performing escrow or "private buyer" services.

have previously investigated these types of schemes and know them to principally
be vehicles to further money laundering. For example,

in an escrow scheme,

individuals are instructed to receive and transfer funds in short time periods, often
1-3 days. The incoming funds are usually proceeds of other criminal schemes which

are then laundered through the unwitting recipient's bank account. Due to the

short time period from which money is received and then resent, the victim often is

left responsible for the full amount laundered through their accounts after the
financial institution detects the fraud and ceases further payment. These emaii
schemes are also evidence of larger wire fraud schemes, as they make fraudulent

claims of profit and opportunity or sell fraudulent goods and
3:17-m」 -00135-DMS

drugs

\

#

I

APR… 52017

 1g.

As d.escribed in greater detail below, I know that Kelihos distributes

Kelihos distribute
spam in at least two distinct ways. FBI personnel have observed
computers to
spam from infected computers directly. Kelihos can command infected

function, in essence, as mail selvers and distribute spam to recipient email
uses
addresses passed to the computer from the botnet. In these cases, Kelihos

not
email address.ls and randomly generated first and last name combinations

Known
obviously associated with the true account from which the spam was sent.
as "spoofing," the result is that the spam

will be made to appear to come from

computer with no
lusername]@gmail.com when in reality it was sent by an infected
association to the referenced email account. Kelihos accomplishes this by manually

editing the header information. The spoofing makes the spam much more difficult
to detect and block, while also concealing the true origins of the email messages'
Kelihos can also send spam directly from mail servers, such as those owned by

Earthlink or 1&1 Mail & Media, by gaining unauthortzed

access to them through

the use of authentic email addresses and passwords harvested by Kelihos' In those
instances, the spam is, in essence, sent from the victim's email address through the

mail server, but without the victim's knowledge or authorization'

2.
19.

Kelihos Distributes Malicious Payloads

In addition to sending spam emails with URL hyperlinks that cause

the downloading of malware, the Kelihos botnet can also command infected
computers to download and execute malware directly. By commanding Kelihos

victims to download and execute malware, Kelihos can retain near total

.orrt.o\f
}\A !

#

APR-52017

3:17-mJ-00135-DⅣ IS
9

 the victim's computer system by infecting them with payloads that can include

banking trojans (malware designed to steal financial credentials), and ransom\Mare
(malware that encrypts the contents of a computer and then seeks a ransom
payment in exchange for decryption). Based on ongoing FBI investigations and
experience,

I am aware that LEVASHOV will

receive payment from other

cybercriminals in exchange for distributing malicious payloads to infected
computers within his botnet. This allows LEVASHOV to monetize his botnet
beyond the distribution of spam.

3.
20.

Kelihos Harvests Credentials

In addition to distributing spam email and malicious payloads,

Kelihos malware also harvests user credentials from victim computers through

a

number of methods. First, Keiihos searches text-based files stored on victim
computers for email addresses. Second, Kelihos searches locations on victim
computers for files known to contain usernames and passwords, including files
associated with Internet browsers Chrome, Firefox, and Internet Explorer. Any

email addresses and passwords located in these searches are harvested by Kelihos
and subsequently transmitted back to LEVASHOV.

21.

To capture additional user credentials, Kelihos installs a software

program called WinPCAP on infected machines. WinPCAP is a powerful packet
capture

utility that intercepts, in real time, electronic communications traversing

the victim computer's network card. IJsernames and passwords found within this

network traffic are transmitted back to

LEVASHOV.

3:17-mj-00135-DMS

#
\

t

APR… 52017
10

 B.

KELIHOS RESEARCH, TESTING ANID EVTDENCE OF CRIMES

22.

Many techniques were utilized to analyze and study the Kelihos

malware. One of the first steps was to gather appropriate samples of the malware.
One feature of the Kelihos botnet circa 2015 is that the Kelihos malware could be
d,ownloaded directly from backend servers. A specific type of backend servers were
described by Kelihos administrators as "Golden Parachute Domains." I believe that

the naming convention relates to the role these servers play as redundant
mechanisms of command and control. When a computer infected with Kelihos can
no longer communicate

with any other peer infections, it is programmed to reach

out to domains (websites) that are hardcoded into its configuration. These domains,
the "Golden Parachutes," provide a peer list to the infected computer so that

it

can

regain communication with other infected peers. For the purposes of this affidavit,
there are at least three such domains presently relevant to the functioning of the
Kelihos botnet, gorodkoff(.)com, goloduha(.)info and combach(.)com.2 In addition to
providing peer lists, research has shown that these Golden Parachute Domains
were at times confrgured to distribute Kelihos malware.

23.

Kelihos, Iike many malware families, uses an affiliate/client system.

At any given time there appears to be ten to twenty separate Kelihos "affiIiates."
These affrliates are paid by LEVASHOV to infect computers with his Kelihos

While the actual web addresses do not include "(.)," I have added them here to
avoid accidental hyperlinking to these sites.
2

Je
3:17-mj-00135-DMS

APR-52017

 malware. The affiliates are paid according to the number of victims they infect and
where those victims are located.

I am aware of the affiliate

model, because

I

previously downloaded LEVASHOV's pricing structure from a website known

as

"Smoney" that LEVASHOV maintained. A webpage labeled "1oads01-rules.html"

Iisted instructions for affiliates, as well as the payment rate per L000 infections.

24.

Based on my investigation to date, I have determined that Kelihos, like

many botnet families, prioritizes the infection of U.S. victims. This can be seen in
the higher rates paid for U.S. victims. Based on my training and experience,

I

believe U.S. infections are prized by LEVASHOV because many of his schemes are
directed against an English speaking audience, and U.S. IP addresses tend to be

trusted by many firewalls and spam detection systems.

25.

In September 2015, I downloaded Kelihos malware directly from

gorodkoff(.)com. I downloaded the malware by querying the server according to the
following format: gorodkoff(.)com/affiliatelD.exe. I was able to determine the

affiliate IDs because the Smoney website maintained a full listing of active

affiliates. For example, one such affiliate was boxi002. By issuing a query for
gorodkoff(.)com/boxi002.exe,

I downloaded a Windows

executable named

boxi0O2.exe. Subsequent analysis of this executable determined that it was in fact

the Kelihos malware. This analysis was based upon comparing characteristics of
the downloaded malware to known characteristics of the Kelihos malware. In this
case, the downloaded boxi002.exe fiIe interacted
manner identiCal tO]KelihoS・

I「 hat

with the Windows Registry in

a

iS,key regiStry ValueS Were modifled sO t慾

3:17-珂 -00135-DMS

APR-52017
12

 executable would be loaded each time the system started

up. This

occurs without

the consent of the legitimate user and is a persistence mechanism designed to
by
ensure that Kelihos remains on the victim's computer despite any overt actions

the victim to remove the malware.

26.

My conclusions were similar to those of agents with the FBI's New

The
Haven, Connecticut Field office who have also examined the Kelihos malware'

New Haven Field Office conducted ad.ditional testing and activated a sample of the
Kelihos malware and observed the infected computer attempting to send high
volumes of spam emails. Many of those emails supported a "pump and dump"
scheme for a penny stock related to a known company

27.

(KCl).

Through coordination with international law enforcement partners,

I

have monitored live traffic related. to backend servers maintained by LEVASHOV in

furtherance of the Kelihos scheme. In doing so, I observed commands issued from
job
those servers to Kelihos infected computers. Many of those commands, or
messages, included commands to distribute emails relating to

KC1. The emails

suggested to the recipients that the stock would signifrcantly increase in value, in

the short term.

28.

The investigation by FBI's New Haven Division also revealed the

extent to which Kelihos harvests credentials from infected computers. Kelihos
searches specific locations on computers for fiIes known to contain usernames and
passwords, including locations which store such data for several common internet
bro、 vsers,including

Chrome,Firefox and lnternet Explorer.Ne、 v Haven Division

3:17-mj-00135-DMS
13

F 4nl-l
lnn - '1 "l

 stored a flctitiOus email address and passwOrd in lnternet Explorer on an infected

FBI computer.ShOrtly after Kelihos was installed,this username and passwOrd
was observed Within Kelihos's process memory,indicating that it had been
identifled and harvested.

29.

Kelihos also searches for usernames and passwOrds for WindowS

programs that use File Transfer Protocol(“ FTP").As its nanle suggests,FTP is a
standard network protocol used fbr the transfer Of COmputer flles between
cOmputers. For example,pictures located on a computer COuld be backed up tO a
server in another location using FTP functionality.New Haven I)ivision stored a

FTP username and password combination on an infected FBI computer,and the
username and password were observed in Kelihos process lnemory.
30.

Finally,the New Haven Division observed that Kelihos installed on an

FBI computer a sOftware prOgram called WinPCAP,which is able to intercept and
examine electronic colnlnunications traversing the computer's network card in a

Windows computer.They observed Kelihos colnIInanding WinPCAP to intercept the
contents of allincorning and outgoing network trafflc on an infected computer.
Ⅳlore speciflcally,Kelihos used this WinPCAP functionality to search fOr email

usernames and passwords in the self― infections'network trafflc.

C.
31.

EⅥDENCE ESTABLISHING LEVASHOVS CONTROL OF
KELIHOS
In cooperation with private sector partners,I previously identifled two

servers assoCiated with the Kelihos botnet. 1

3:17-m」 -00135-DMS

APR-52017
14

 States. In cooperatiOn with internatiOnallaw enforcement partners,I receiVed real¨
tilne data frOm those servers whiCh revealed lnultiple assoCiations betWeen the

Kelihos malware,serverS COnnected to Kelihos,and LEVASHOV.
32.

One ofthe serverS,bea五 ng the IP address 94.242.250.88,functioned as

a portiOn ofthe Kelihos backendo Additionally,it was utilized by LEVASHOV aS a
prOxy,Ineaning that some portiOn of hiS Internet actiVitieS are directed through the

server.As a result Of this conflguration,I have been able t0 0bserve backend
panels,or Ⅵrebsites,that provide status updates on the Kelihos botnet.Panels such
as this are very colnlnonly encountered in the investigation ofbotnets,as they
facilitate the operator'S administration and troubleshooting ofthe botnet.
33.

In this Case,the Kelihos panel iS COnstructed as a website and includes

information such as the status ofits servers and the status ofthe Golden Parachute

Domains.GorodkoffC.)com,g010duha(。 )infO,COmbach(。 )COm and Others,are
speciflcally referenced,With c01or codes used tO indiCate their readiness status.

Another portion ofthe webpage ShOWS various backend servers,the spam meSSages
they are being used tO distrlbute,and data such as the speed at which the messages

are being distributed. For example,as shown below,the email“
are“ pharmattb+pharma+trade."

liSts''being utiliZed

This is the same liSt,described below in the

3:17-珂 -00135-DMS
くυ

 for
Jurisdiction section of this af{idavit, which contained thousands of entries
Alaskan email addresses.

Ip: 176.103.48.27

Ip: 193.28.179.38
Sat, 20 Feb 16 18:25:29 +0400

List:
.

.Aists/pharma-b +Pharma+trade
Body: Perfect method to ha ...

ldrugmarket.ru/
Subject: Do You wan ... his

night?
Counter: 7L2970562
(t424874532)
Speed: 79677 mlh

84.

Sat, 20 Feb 16 t8:47:54 +0400

List:
pharma-b+pharma+trade
Body: Giveto Your babe nig
ng.hxilgusk.n-r/
Subject: Evoke Your ...

"'

admiration
Counter: 608715981
(1424874532)
Speed: 10323 m/h

Other portions of the Kelihos panel include antivirus and blacklisting

reports. This indicates that the operator actively monitor whether or not their
various servers have been identified by antivirus or other blacklisting services.
This is important for the operator, as blacklisting could reduce the reliability

of

.

their botnet. For example, the panel ind"icated that both of the servers referenced
above appear to be tracked by at least one antivirus vendor.

g5.

Additionally, the server appeared to contain copies of many of the

spam email messages distributed by Kelihos. Subject lines of emails that appear to
have been sent to email accounts (including many hosted by Alaskan ISP General

Communication, Inc (GCI.net)) include,'Very good way to reveal your intimate life,"
"NO amorouS failure risk," "Attack your woman harder," and "Are yOu ready tO

please your female partner tonight?" These emails contained links to websites that
appear to facilitate the purchase of gray market pharmaceuticals'

3:17-mj-00135-DMS
16

 36.

Also appearing to have been sent to GCI.net email accounts were

this
emails with the subject lines, "This Company looks ready for a major run
week!,,, "Big Gainers Since My Alert!",

"It is about to wake up and ROAR!" and "Its

trading levels could change in no time (MUST READ)." The content of all of these
a
emails were similar as they are intended to persuade the recipient to purchase

specific

u.s. listed stock. For example,

one email's content listed:

This Stock is our New WILD Sub-Penny PickiCei neaay ior Multi-Bagger
Gains!
Top 10 Reasons Why We Love This Pick!
Company Name: KC1
Traded as: KC1
Long Term Target: $1.70
Trade Date: February, 29th
Closed at: 0.30

37.

These spam emails facilitate "pump and dump" stock schemes, as

previously described. in this affidavit. I have examined historical prices for several
stocks for which Kelihos has conducted spam email campaigns and noted that such

campaigns usuaily result in a temporary increase of the stock price of anywhere

from 30 to 80 Percent.

88.

In addition to the explicit Kelihos activity

on the server,

I

observed

that this server was utilized thousands of times to log into the mail.ru website tied
to the email account pete777@mail.ru. Based on my training and experience, this
indicates that the user of the Kelihos server was also utilizing the email
pete777@rnail.ru. The website 3038.orgAistn.html associates this email address

with Pete LEVASHOV,

3:

a websmith and programmer located

in Russia, with a date

l7-mj-00135-DMS
17

APR

- 5 2017

 ofbirth Of 8/13/1980.The website 3038.org appearS tO be the webSite fOr a high
school in St Petersburg,Russia,that foCuseS On mathematiCS and phySiCS・

39.

The email address pete777mail.ru is alsO asSOCiated with an Apple

iCloud accountin the nalne ofPetr LEVASHOV.According to Apple's recordS,
LEVASHOV iS a resident ofthe Russian FederatiOn.A second email addresS iS alsO
spb.ru.Apple subSCriber
assoCiated with thiS iCloud account,levashOVOknyaZev―
information indicates that thiS acCOunt Was regiStered With Apple using the IP

Signaling
records list the Apple Digital
address 83.243.67.25. Moreover, Apple's

Id'entifrer(DSID)tg72828o24wfihpete7?7@rnail.ru,saccount.AnAppleDSIDisa
registering with Apple,s iCloud service.
unique ID assigned to a user when

40.Ss.24S.6T.25isthesamelPaddressutilizedtoregistertheGoogle
The accounts peteknyazev77T@gmail'com
account, peteknyaz ev777@gmai1.com.
overlap of IP addresses utilized to
and Apple DSID 1972828024 shareextensive
gL.t22'62'16' Additionally' access logs from Apple
access these accounts, including
addresses
share temporal overlap with IP
accounts
these
that
indicate
Google
and

are utilized during similar time
addresses
IP
same
the
that
meaning
as well,

periods.Baseduponmytrainingandexperience,commonlPaddresses,
is
suggest that the same individual
particularly during the same time period,
accessing both accounts'

4l,TheIPadd.ressg],'t22.62.l6wasalsousedbyLEVASHoVtonegotiate
the purchase of a digital CertiiCate from the company GeoTrust.An email was sent

frOIn renew@geotrust.COm to pet]KDhOttaby4.ru on November 23,2016. Thi躾
3117-mJ-00135-Dヽ lS

?R″
ゝ
18

6 1St7

 referenced an order for a“ Rapid Wildcard"Certiflcate. These recordS Were

subsequently attained by agentS Within FBI's New Haven Division,and indicate
that a Custolner nallned Peter LEVASHOV,Of Saint Petersburg,Russia,initiated an
Order for the CertiflCates utiliZing the IP address 91.122.62.16. MOreover,the
certiflcate Order was then completed,■

linutes later,utilizing the IP address

94.242.250.88, 94.242.250.88 is the same IP addreSS utilized thOusands oftilnes to

log intO the aforementioned pete777@mailiru email atcOunt.ThiS e宙

denё e of other

use Ofthe salne IP by LEVASHOV iS further evidence that LEVASHOV iS utilizing
bOth the Kelihos server and Google and Apple accounts which point tO him.

42.

FurtheHnore,Foursquare,a sOCial media appliCation that proVides

recolnlnendationS On reStaurants and shopping establiShments tO users,poSSessed

recordS fOr an accOuntin the name Petr LEVASHOV,registered with email address
pete777@"nail.ru. ThiS accOunt also displayed the same pattern of temporal overlap
within the IP acceSS 10gs,when compared to the previously lnentioned Apple and

Google accountS.Again,this indiCates the accountis likely used by LEVASHOV.

43. One IP addreSS appea五 ng within LEVASHOV'S Foursquare aCCOunt is
85.17.31.90.ThiS IP address also appears within LEVASHOV's Apple DSID iCloud
account 1972828024,and the Google account pphottaby4.ru.Google recordS from
2016 indicate that prOhottaby4.ru had been aCCesSed by only two Other IPs,one of
which is the Kelihos server IP address 94.242.250。

44.

88.

The server COrresponding to IP address 94.242.250.88 also contained

many references to LEVASH()V.For example,an email Sent On February 26,2016
3:17-輌 -00135-DMS

APR -52017
19

 from no-repiy@email.appie.com to petr@hottaby4'ru with the subject line' 'Your
a
app(ios) status is In Review" is addressed to "Petr LEVASHOV' and contains

this
status update on an iOS apptication. There are many such emails sent from
Apple email account to pet@hottaby4.ru.

45.
about June

Furthermore, analysis on data provided by Google revealed that on or

4,z1l3,the following

search terms, "kelihos" and "kelihos.f'were

attributed to the account peteknyaz ev777@gmail.com. Further analysis of the data
provided by Goog1e showed that the cellphone number associated to this Google
account is LEVASHOVs mobile number ending in 0594 as indicated in Apple
record.s. Based upon my training and experience I know that

it

is common for

individuals operating botnets to conduct searches for their malware.

46. It is also common for criminals engaged in cybercrime to utilize
nicknames, especially on the criminal forums on which they exchange data on

criminal techniques and offer products and services for sale. The use of nicknames
allows them to protect their true identity, while still allowing for the benefits of
name and product recognition. While there are a large number of Internet forums
devoted to the exchange of criminal services and techniques, many criminals

will

use the same nickname on different forums. This is likely due to perceptions of

anonymity, as well as the reliance upon reputations tied to nicknames. In these
communities, actors are known principally by either their given nickname, or an
email, jabber, or ICQ handle. Jabber and ICQ are "chat" applications. These
reputations become important both in the exchange of data,and access to

3:17-mJ-00135-DⅣ IS

20

濱
APR-52017

 marketplaces in whiCh prOducts and services are SOld.LEVASHOV utiliZed
multiple nicknameS,but the lnost COInmon Was``Severa''or``Peter Severa.''

47.

Upon eXalrnination ofmany crilninal forunl accounts in the name

Severa,"I have nOted that in the mttority,the ICQ number 104967 has been
“
utilized since at least 2010.ICQ is a pOpular lnternet instant rneSSage servlce ln

which users are identifled by unique nulne五

Cal values,known asICQ numbers.

Based upon my training and experience,l know that 6五

linё ln6nikё is,SuCh

aSICQ

numbers,are rarely changed or transferred by online crilninals. TherefOre,I

cOnclude that the combination of an identical ICQ number and nickname are
indicative ofthe same individual acCessing and utilizing these acCOuntS.

48.

Severa has used this ICQ number tO adVertise his bOtnetS.For

instance,in L/1ay 2015,the FBI receiVed the folloヽ

Ving information pertaining to a

vendor on the Russian crilninal site Korovkaocc. The vendOr、

vas advertising
rs:

veblnaller email Spanl''Capability and the information he proVided read aS f01lo恥
、
“

Username: "Severa"
Registrat ion l2l 21 20ll.
Jabber contact: j abber@honese' com
ICQ: 104967
Service: Email spam

Details:Theservicewasofferedsincelggganddelivered
used several
spam to a recipients inbox' Every spam iaunched
iilor.urd clean IP addresses and accounts. Unique algorithms
andtechnologieswereconstantlyimproved.SellerhasUSand
received
Bo.op" email databases for spam, and fresh databases
legal
daily. prices per million spam delivered were $200 usD
advertisement, adult, mortgage, leads, pilIs, replics' etc"' $SO9
USD
USD job spam (drops, *rrlut, employment)' and $500
scam/phishing attacks.

3:17-mJ-00135-]D卜 IS

APR-52017
つ４

 49.

This information conveyed that Severa's spamming was superior to

that of his competition and would be less likely to be detected ("clean IP addresses
and accounts" and "unique algorithms") and that he had been doing this for a long

time ("since 1999").

50.

The nickname Severa, and communication accounts such as

jabbe@honese.com, appeared frequently on the servers wiretapped by international

law enforcement partners. Jabbe@honese.com is an XMPP account. XMPP is a
type of instant messaging service widely utilized on the internet. Because XMPP
servers can be individualiy hosted and managed, rather than hosted and managed

by a company such as Google, they are often trusted by criminal actors.

51.

Similarly, on or about January L4,2077, Severa posted the following

advertisements an online forum called "Club2CRD":
Hello.

spamming service via electronic mail to
everybody who is interested. I have been serving you since the distant
year 1999, and during these years there has not been a single day that
I keep still, by constantly improving quality of spamming. Now at your
service there is the only one in the world unique technology of spamming
via electronic mail, which provides maximum possible probability of
delivering your message to the final recipient.

I am offering my

Today I conduct all spamming via webmail. Each spamming is
being done from dozens ofthousands ofciean IP addresses and accounts.
To generate a message there are used unique algorithms and
technologies which I have been constantly developing and improving.
3

The advertisement, which was written in Russian, was later translated into English
by a FBI linguist. The references in the advertisement to "[PH]" are those of the linguist a-nd
reflect that a word has been translated phonetically.

#
\

3:17-mJ-00135-DMS

I

・機2017
APR・・
22

 Every sparnlning is being automatically monitored for quality,
regular automatic spallnlning and running test messages.

ヽ
Ⅳith

I conduct spamming on my databases of USA[PH],Europe,Or
other countries you are interested in. I anl constantly collecting and
testing neⅥr addresses from different sources. ]Databases are updated

daily and l have enough of collected volume, in order to provide
individual databases of addresses for each ne、 v spanllning.

The prices for one spamming(for a million ofdelivered messages)
are:

$200.00-legal advertising,adult,mortgage[P耳 ],leaOS,pill,
IPH],replication[PH],and etc.

$300.00-drops,also known as employment spam
$500.00-scam,phishing
l am interested in large clients,and l actively incentive that Ⅵ
large discounts.The larger is the order volume,the bigger is a discount.

rith

Discounts start just at two million,and they may exceed 50%.Veriサ
prices for any amount more than one lnillion.
For contact use」 abber(XMPP):jabbeメ Эhoneseocolrn
An alternative comlnunication channelis ICQ 104967.
I always、velcome ne、v and old clients,as、 vell as feedback!
Good luck and keep it up.

Petr Severa

52. LEVASHOV continues to use the nickname Severa in operation ofthe
Kelihos botnet. On or about March 20,2017,an indiv■ dual kno、 vn

to la、 v

enforcement contacted LEVASHOV,who is currently believed to be traveling
Outside of Russia,viaュ chat application to express interest in purchasing one or
more spanl deliveries. Upon an initial inquiry looking for the``services of Peter

Severa"and a request to conflrnl pricing and services offered,LEVASHOV
responded on ⅣIarch 21,2017: ``IIi,I aln Peter Severa. I were away. what do you
ヽVant

tO Send?jOb Offe[rlS,dating,phiShing'Inal、

ハrare?Or、 ハZhat?"
綱
罵をな飯!ζ

3:17-m」 -00135-DⅣ IS

23

APR-52017

 58.

In subsequent exchanges between Severa and the individual on March

know based
20,20\7 ,severa stated that he accepts bitcoins. "Job offers"-which I
priced at
on my training and experience refers to money muie solicitations4-ursrs
,,300 usd per 1 million emails, 450 per 2

milllion]." However, severa also indicated

usd
price differentials for different kinds of spam deliveries: "phishing, scam etc 500

per

1

mil . . . 750 per 2." Severa also confirmed that the individual could purchase

Severa
spam to be sent only to a specific country (including the United Statesj.

stated: ,,i need just payment and letter to start," and instructed that, "[A]fter

payment put it to archive with password and upload to sendspace'com'" According
big
to sendspace.com's website, "send,space is the best way to send large files, too

world'"
for email attachments, to friends, family and businesses, anywhere in the
Severa also indicated that he has "10-15 orders daily'"

b4.

On or about March 21, 2017, the individual paid Severa in bitcoin to

purchase a spam campaign to be directed at the United States' The spam email
job
submitted to Severa included, a link to a website advertising "work from home"

opportunities. severa responded that the "Mailing takes 3-4 hours, but response can
come

during 2-4 days, people don't read emails instantly." He again reiterated that

he has "10-15 orders dailY."

A ,,mule" or "money mule" is an individual who is used to transport or launder stolen
individuals
money in furtherance of criminal activity and its related organizations. These
can bL either wittingly or unwittingly participating in the fraud.
4

■′

3:17-mj-00135-DMS
24

 55.

The individual then asked Severa,

"I had client recontact me about

ransomware. you can do?" Within approximately twenty minutes, Severa responded

via chat:
do mailings for installs, it costs 500 usd per 1 million emails,
750 usd per 2 mil, 1k per 3 mil. I can't send attached file inbox on
volume, nobody can now, so send letter just with link to file or landing.
I need just payment and letter to start.

I

you need fresh text which never sent before, and you should
randomize it by synonyms, by my template. You can use synonym.com
service to find variants. You can do html message, but images only by
links, not attachments.
Template:
{Spam lBlackmailing lPhishing Mailing} is {good lverv good lthe
bestl! Always {send luse lorder lask for}{it lthis}{.   !   !!U
Samples(don't write these, it's generating automatically):
1) Blackmailing is good! Always order it!
2) Phishing Mailing is the best! Always use it!!!
3) Spam is the best! Always send this'

56.

Based on my training and experience and the exchange between

Severa and this individual,

I believe that

Severa's reference to "mailings for

installs" refers to the distribution of malware, including ransomware.

b7.

The individual then asked Severa

if he "send[s] out stocks or

pharma? does pricing change." Severa immediately responded:

SEVERA:

lega1 offers?
stocks what do you mean?
pharma is 200 usd per 1 million emails

Individual:

penny stocks..buy/sell

3:17-mj-00135-DMS
25

APR

- 5 201i

 SEVERA:

it's PD
PumP and dumP
i have 25 mil traders list
mY Price usuaIIY is 1Vo of trade
with 5-10k dePosit

Individual:
SEVERA:

fair
57obY Yahoo numbers

Individual:
SEVERA:

ok'

good to know

in advance

(PrevClose+LastPrice) l2I Volume * 57o
i can move it good, just find the stock
and we need dePosit
i'Il subtract each day numbers, when it 0

i

stoP

58.

Individual:

i've know some people in the market who

SEVERA:

ask them
we need the stock, if they can release news on
it - it's cool too
PeoPle buY on news
5-10k usd deposit, I accept btc or wire' or wmz

suggest stocks from time to time

common
Based on my training and experience, I believe that "btc" is a

abbreviation for bitcoin

and.

"wmz" is a common abbreviation for webMoney'

allows
webMoney is a very popular alternative online payment system' webMoney

maintained
its users to store fund.s in different "purses," where each purse can be

as

rubles' I have
a separate currency, such as U.S. dollars, or Russian Federation
records revealed
examined webMoney account records tied to LEVASHOV. Those

the use of IP address 91.122.62.16, the same IP utilized to access LEVASHOV',s
have
icloud account in his real name. This same IP address was also found to

JE

3:17-mj-00135-DMS

26

APR

-

52017

 accessed a WebMoney identifier (i.e. account) ending

in 4986. Of note, registered

under this account is the WebMoney purse ending in 1018, which is the purse
supplied by LEVASHOV, under his Severa alias, when requesting parment for his

spamming services with the individual referenced above.

bg.

Additionally, I identified two instances when 9L.t22.62.16 accessed the

WebMoney account ending in 4986, expressed by WebMoney in terms of dates/times

when access would "begin" and "end.." In the first instance, I observed that
LEVASHOV received an iTunes update from Apple, via 91.L22.62.16, approximately
11 hours prior to when the WebMoney account was accessed from

that same IP

address. In the second instance, the same IP address accessed the WebMoney
account between May 17 and 18, 2076, and

I observed

one iTunes update a

little

over an hour prior to that period and another update approximately 14 hours after

that

access period ended. Based on my

training and experience, the overlapping use

of the IP address for an iTunes account in LEVASHOV's name and a criminally

used WebMoney account by the alias Peter Severa indicates that Peter Severa is

LEVASHOV.

JI]RISDICTION

60.

This Court has jurisdiction to issue the requested warrant under Rule

41(bX6XB) because the above facts establish there is probable cause to believe that

the items to be searched are protected computers that have been damaged without

authorization and are located in fi.ve or more judicial districts and that there is
probable cause to believe that activities related to the crime being

investigated
E"LrEauELr \

&

3:17-mj-00135-DMS

21

APR

_

52017

 occurred within this judicial district's

61. It is possible to d.etermine the IP addresses of computers infected by
is a Peer to
Keiihos by passively participating in the Kelihos botnet' Because it
Kelihos infections'
Peer botnet, infected computers exchange data on other known

In this way the botnet remains connected internally'

62.

Examination of peer lists exchanged between peers in the botnet has

District of
revealed IP addresses that geolocate to Alaska, connecticut, the western
York,
Washington, Central District of California and the Southern District of New
and numerous other judicial districts. Geolocation is a term that denotes the

examination of where an IP address is likely to be located. For example, IP
also based
addresses assigned to an ISP based in Alaska likely belong to subscribers

in Alaska. Afber identifying one such victim located in Alaska, in April 2016,1
received consent to examine her computer for evidence of a Kelihos infection.

I

found that her computer's configuration settings had been changed, and that an
executable fi}e was set to open any time her computer started up. Examination of

this executable file revealed that it was Kelihos.

63.

The presence of Kelihos exposed this victim to signifi.cant potential for

harm, in the form of stolen credentials, personal information, and victimization of
other malicious payloads such as ransomware. Moreover, the victim's computer was

Fed. R. Crim. P. 41 was amended on Decemtrer 1, 2016. RuIe 41(b)(6XB) is a new
venue provision which went into effect on that date'
b

APR ―懸2017

3:17-mj-00135-DMS
28

 also subject to be used for the distribution of high volumes of spam to others

without her knowledge. While an Alaskan-based Kelihos infected computer would
emails
send spam emails to victims worldwid€, Dy investigation revealed that these
were frequently directed to other Alaskan recipients'

64.
of maiicious

Furthermore, Kelihos continues to target Alaskans with a high volume

spam. I have studied a list of email addresses used by the Kelihos

botnet, one of which was titled "pharma-b+pharma+trade," and contained almost
100 emaii addresses whose domains include k12.ak.us, meaning that these
addresses are utilized by employees of school d.istricts within Alaska. The same

list

has nearly 5,000 entries of emails utilizing the GCI.net domain. This domain,

administered by General Communication Inc. (GCI), is one of the most popular

Internet service providers within Alaska. I have also examined a March 28,2017
Keiihos job message that directed the distribution of a spam message to 10,000

email accounts, three of which utilized email addresses with the domain
uas.alaska.edu, which corresponds to the University of Alaska Southeast. Another

included email account utilized the cijuneau.ak.us domain, which corresponds to
the city of Juneau. The subject line of the spam email was, "Do you want to impress
your female partner tonight?" and the emaii included a link to a website which
purported to be the "Canadian Health and Care Mall." The website offered for sale
a large number of prescription medications, including drugs such as Viagra and

Cialis, pain relief medications such as Celebrex and Torado}, antibiotics such

as

Amoxicillin and Zithromax, and Antidepressants such as Ptozac and Weilbutrin.

-}f
3:17-1刊 -00135-]DⅣ IS

APR…
29

521117

 I

The website itself contained fraudulent endorsements from the Federal Drug

Administration, American Pharmacists Association and Verisign

65.

To effectively combat the P2P structure of the Kelihos botnet, the FBI

with assistance of private partners will participate in the exchange

of peer lists and

job messages with other infected computers.6 The FBI's communications, however,

wiil not contain any commands, noi will they contain IP addresses of any of the
infected computers. Instead, the FBI replies will contain the IP and routing

information for the FBI's "sinkhole" serer. As this new routing information
permeates the botnet, the Kelihos infected computers

will

cease any current

malicious activity and learn to only communicate with the sinkhole. The effect of
these actions will be to free individual infections from exchanging information with

the Kelihos botnet and with LEVASHOV. This will stop Kelihos's most immediate
harm, the harvesting of personal data and credentials, and the transmittal of that
d.ata to servers under LEVASHOV's control. Another portion of the Kelihos job
messages is a

iist, known as the IP filter list. This list functions as a type of

blacklist, preventing communication with those IPs contained within the frlter list.

If necessary, the FBI also seeks authorization to send a filter list to TARGET
COMPUTERS to block Kelihos infected computers from continuing to communicate

The law is unsettled as to whether the operation authorized by the proposed
warrant constitutes a search or seizure. However, in an abundance of caution, the United
States is seeking a warrant.
6

3:17-mj-00135-DMS
30

APR

*

5 2017

 with router nodes.

66.

The sinkhole server will be a dead end destination that does not

capture content from the infected computers. The sinkhole server, however,

will

record the unique IP address and associated routing information of the infected
machine so that the FBI can alert the proper Internet Service Providers of the
existence of infected machines on their network and to monitor the effectiveness of

the disruption effort. By noti$ring Internet Service Providers, the unwitting victims
can be alerted as to their status of victims and be assisted in the removal of Kelihos

from their computers.

67.

Additionally, because the Kelihos malware directs infected machines to

request peer lists from the Golden Parachute Domains when they are unable to
reach any peers, the disruption effort
aiso redirected to the sinkhole.

will not be effective unless the domains

are

In order to prevent LEVASHOV from using the

Golden Parachute Domains to recapture peers,

it

is essential that these domains be

kept out of LEVASHOV's hands. The Temporary Restraining Order sought as part
of this action denies LEVASHOV these domains through an order to the Domain

Registries responsible for the U.S.-based top level domains requiring them to

redirect connection attempts to the sinkhole server.

68.

Rule 41(e)(2) of the Federal Rules of Criminal Procedure requires that

the warrant command the iaw enforcement offrcer (a) "to execute the warrant

within

a specified time no longer than 14 days" and (b) to "execute the warrant

during the daytime unless the judge for good cause expressly authorizes execution

3:17-mj-00135-DMS

APR -52017
31

 at another
peer

time

The government seeks permission to transmit the updated

list at any time of day or night for 30 days after the date the warrant is

authorized. There is good cause to allow such a method of execution as the time of
deployment causes no additional intrusiveness or inconvenience to anyone. More
specifrcally, the government has no control of the timing or when the infected
computers

will

access the peer

list. In addition, the government

seeks to transmit

the peer list and job messages for 30 days, because based on my training and
experience

I am aware that it may take many weeks

to reach the thousands of

computers infected by Kelihos. While the technical disruption should see

immediate results, computers that are powered off or not connected to the Internet

will not be redirected until they connect to the Internet, which

could be weeks after

the initiation of the disruption. Because any privacy invasion that may occur

during this 30 day time period is minimal, and the benefits of continuing to disrupt
the Kelihos botnet are significant, the government believes that the extended time
period for execution of this warrant is appropriate in this case.

69.

Pursuant to 18 U.S.C.

$ 3103a(b) and

Federal Rule of Criminal

Procedure 41(0(3), I request that this Court authorize the officers executing the

warrant to d.e1ay notice until seven days after the technical measures authorized by
the warrant have commenced.

70.

There is reasonable cause to believe that providing immediate

notification of the warrant may have an adverse result, as defined in 18 U.S.C.

3:17-mj-00135-DMS
32

$

贔
APR-5201 /

 2705. Providing immediate notice to the owners or users of the TARGET
COMPUTERS would likely trigger media coverage of the Department's efforts to

disrupt the Kelihos botnet, which could tip offLEVASHOV or any as-yet
unidentified co-conspirators that that the United States is attempting to seize
control of the botnet. Such a notifi.cation would seriously jeopardize the ongoing
investigation, as such a disclosure would give that person an opportunity to destroy
evidence, change patterns of behavior, notify confederates, and flee from

prosecution. See 18 U.S.C. $ 3103a(b)(1). In particular, I am aware that Kelihos is
a complicated malware variant, and LEVASHOV or others operating at his

direction could, easily change the malware. Nearly the entire Kelihos botnet can be
updated within 24 hours. The Kelihos botnet has been updated in this manner

previously in response to the activities of private industry researchers conducting
sinkholes or publishing research papers detailing Kelihos vulnerabilities.

7t.

Accordingly, for each of the aforementioned reasons,

it

is respectfully

requested that this Court issue a search warrant authorizing the following:
a deployment of updated peer lists and job messages to the
TARGET COMPUTERS, without prior announcement, within 30 days
from the date this Court issues the requested warrant;

b.

that the government may receive and review, at any time of day
or night, within 30 days from the date the Court authorizes the use of
the specified interactive techniques, such IP and routing information
that is subsequently transmitted to a computer controlled by the FBI
or its private partners working under the direction and control of law
enforcement;

3:17-mj-00135-DMS
33

基［

a.

 that provision of a copy of the search warrant and receipt may,
allowed by 1aw, be effectuated by
in addition to any other n
"ihod.
(e'g', Adobe
electronic delivery of true and accurate electronic copies
PDF frle) to any owners of affected computers by means of internet
publication;
d.

that, pursuant to 18 U.S.C. $ 3103a(b)(3), to satisff the notifi-cation
requirement of RuIe 41(0(3) of the Federal Rules of criminal
Pricedure, the government may delay providing a copy of the search
warrant and the receipt for any property taken until seven days after
the technical measures authorirld by the warrant have commenced'
Respectfullv submitted,
Signature Redacted
si

ELLIOTT PETERSON
Special Agent
Federal Bureau of Investigation

Subscrihed and sworn to before me

.2ot7:
°
-f ゞ
■nttEBttH肌
瀾17:、

[絲集一一
鸞野
ぶ鸞
UNITED STATES MAGISTRATE」 UDGE

34

７ｆ

-00135-DMS

Ｉ硼

Ａ

3:17-m」