Gozi malware creator ordered to pay $9 million

A Russian man who spent about three years behind bars in the United States for creating the malware known as Gozi has been ordered to pay US$6.9 million (A$8.9 million) to cover losses to bank customers, but was spared further US prison time.

Nikita Kuzmin, 28, could have received more prison time but was sentenced to time served at a hearing in Manhattan federal court, prosecutors said in a statement. He was jailed in August 2011 and held for 37 months before authorities released him.

A probation office had recommended a sentence of 84 months, although it was not taking into account any assistance Kuzmin provided to investigators, prosecutors said. An explanation of how much assistance he has provided remains under a court seal, along with many other papers in the case.

Kuzmin's attorney, Alan Futerfas, confirmed the sentence and said Kuzmin was glad to put the episode behind him and move on to the next stage of his life. He declined to say what Kuzmin's plans were.

Prosecutors described Kuzmin as an innovator in online crime, saying he not only created Gozi but rented it out to criminals who used it to steal tens of millions of dollars from bank accounts.

The malware was disguised as a .pdf file, and security experts identified it around 2007, prosecutors said.

Kuzmin was arrested in 2010 after he travelled to a conference in the United States. He pleaded guilty in May 2011 in a cooperation agreement with US prosecutors.

In January this year, a Latvian man who admitted to having written some of the computer code was also sentenced to time served. He served 21 months in prison.