Accused Kelihos botmaster Andrey Sabelnikov claims innocence

Andrey Sabelnikov, the Russian man accused by Microsoft of creating and operating the Kelihos spam botnet, proclaimed his innocence last week.

Microsoft said that Sabelnikov, a programmer who lives in St Petersburg "created, operated and controlled the Kelihos botnet," which at its peak comprised an estimated 45,000 compromised Windows PCs. Those systems were used to transmit up to 4 billion spam emails daily, Microsoft has alleged.

Last week, Microsoft added Sabelnikov to the list of defendants in a lawsuit first filed in September 2011, when it used a court order to take down Kelihos by commandeering its command-and-control (C&C) servers. Microsoft said its analysis showed evidence in the malware code of Sabelnikov's participation.

Sabelnikov begged to differ.

No extradition treaty

"I did not commit this crime, have never participated in the management of botnets and any other similar programs, and especially have not extracted from it any benefit," he wrote in a blog on Friday (in Russian, with Google Translate version here).

Over the weekend, Sabelnikov contacted the BBC, which first reported his claims of innocence.

In his blog, Sabelnikov also said that he had returned to Russia from the United States, where he had been on business, when he learned of the charges levelled by Microsoft.

Russian law bans extradition of its citizens to face trial in other countries.

Sabelnikov worked for a pair of security firms, Agnitum and Returnil, from 2005 through late 2011, resigning from the latter on December 21, 2011, according to that company.

Returnil said it was "extremely disappointed and angered that someone who was a member of our team could be implicated in this type of activity."

Waledac

Other security researchers have said that it was possible that Sabelnikov obtained the source code to another bot Trojan - dubbed "Waledac" - during his work at his former employers, or through his own probing of hacker forums. Kelihos, some experts believe, shares characteristics with Waledac.

"I want to emphasise that I do not have any relation to the activities of Kelihos and spam," Sabelnikov said. "Unfortunately, an avalanche of press coverage, indicating false facts and distorting reality, have unwittingly caused the companies where I have worked and now work a huge moral hazard and an impact on their business reputation."

Sabelnikov has not replied to requests for comment sent to his Skype account. Microsoft did not immediately react to a request for comment on Sabelnikov's assertion that he is innocent.

Sabelnikov has until the middle of February to answer Microsoft's charges, or face a default judgment, according to court documents.