Europol takes down criminal network that stole $100 million through GozNym malware

Europol has taken down the GozNym criminal network.
 By 
Stan Schroeder
 on 
Original image replaced with Mashable logo
Original image has been replaced. Credit: Mashable

Europol has dismantled a global cybercrime network that used the GozNym malware to steal approximately $100 million, the agency announced on Thursday.

Five members of the network have been apprehended in Georgia, Moldova, Ukraine and Russia, while five remain on the run. All ten have been charged in Pittsburgh, U.S. with conspiracy to infect victims' computers with malware, steal login credentials and use them to syphon money out of victims' accounts.

The criminals targeted mostly businesses and financial institutions, using the sophisticated GozNym malware to infect victims' computers. The malware allowed them to steal login credentials and gain unauthorized access to victims' online bank accounts, steal the money and then launder it through U.S. and foreign bank accounts.

Europol, who coordinated the action with Eurojust, the European Union's Judicial Cooperation Unit, as well as the U.S. Justice Department, claims the criminals were highly specialized and well organized. They used their technical skills and a number of criminal services to recruit accomplices, perform phishing attacks, encrypt the malware to make it harder to detect by anti-virus tools and launder the money.

The leader of the ring, as well as his technical assistant, are being prosecuted in Georgia.

Original image replaced with Mashable logo
Original image has been replaced. Credit: Mashable

GozNym is a stealthy and advanced malware, created from two different malware strains (Gozi ISFB and Nymaim) and designed to attack financial institutions, primarily in the U.S. Europol estimates that the criminal network stole from more than 41,000 victims using the malware.

According to Europol, the GozNym criminal network was provided with bulletproof hosting services by an administrator of the Avalanche network of compromised systems. The administrator's apartment in Poltava, Ukraine, was searched in November 2016 and the network was dismantled. The administrator of Avalanche is now facing prosecution in Ukraine for his role in providing hosting services to the GozNym criminal network.

Topics Cybersecurity

Stan Schroeder
Stan Schroeder
Senior Editor

Stan is a Senior Editor at Mashable, where he has worked since 2007. He's got more battery-powered gadgets and band t-shirts than you. He writes about the next groundbreaking thing. Typically, this is a phone, a coin, or a car. His ultimate goal is to know something about everything.

Mashable Potato

Recommended For You
Popular Chrome extension disabled for containing malware
Google Chrome logo

Do you have one of these 17 browser extensions? They could be tracking your browsing history.
safari and chrome apps on phone

FBI investigates Steam games with hidden malware
Steam logo on laptop

Everything you need to know about the malware stealing data from Mac users
MacBook in the dark using Terminal

Newly discovered malware 'pranks' its victims – just in time for April Fools' Day
Hacker at laptop

Trending on Mashable
NYT Connections hints today: Clues, answers for April 3, 2026
Connections game on a smartphone

Wordle today: Answer, hints for April 3, 2026
Wordle game on a smartphone

What's new to streaming this week? (April 3, 2026)
A composite of images from film and TV streaming this week.

Google launches Gemma 4, a new open-source model: How to try it
Google Gemma

The biggest stories of the day delivered to your inbox.
These newsletters may contain advertising, deals, or affiliate links. By clicking Subscribe, you confirm you are 16+ and agree to our Terms of Use and Privacy Policy.
Thanks for signing up. See you at your inbox!