{
	"id": "06d85241-0edf-4a85-bdca-436281aa4ad5",
	"created_at": "2026-04-06T00:14:07.530208Z",
	"updated_at": "2026-04-10T13:12:42.105893Z",
	"deleted_at": null,
	"sha1_hash": "b3eb877540e4cbed7b383f11392f0b5e7a61b470",
	"title": "Russian Hacker behind 'NeverQuest' Malware, Wanted by FBI, Is Arrested in Spain",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 659258,
	"plain_text": "Russian Hacker behind 'NeverQuest' Malware, Wanted by FBI, Is\r\nArrested in Spain\r\nBy The Hacker News\r\nPublished: 2017-01-22 · Archived: 2026-04-05 19:55:25 UTC\r\nA Russian computer hacker wanted by the FBI on hacking allegations was arrested and jailed in Spain earlier this\r\nweek, while a decision on his extradition to the United States has yet to be made.\r\nThe Guardia Civil, Spanish law enforcement agency officers, have detained 32-year-old Stanislav Lisov at\r\nBarcelona–El Prat Airport based on an international arrest warrant issued by Interpol at the request of the FBI.\r\nLisov is arrested on suspicion of creating and operating the NeverQuest Banking Trojan, a nasty malware that\r\ntargeted financial institutions across the world and caused an estimated damage of $5 Million.\r\nThe arrest was made after U.S. intelligence agencies found that Russian hackers were behind the November 2016\r\nelection hacks that possibly influenced the presidential election in Donald Trump's favor.\r\nhttp://thehackernews.com/2017/01/neverquest-fbi-hacker.html\r\nPage 1 of 3\n\nHowever, Spanish police made an official statement, saying that the FBI had requested the arrest of Lisov after an\r\ninvestigation that started in 2014.\r\nNeverQuest banking trojan provided fraudsters access to computers of people and financial institutions to steal\r\nbanking data.\r\nThe Trojan, which spreads itself via social media, email and file transfer protocols, can modify content on banking\r\nwebsites and inject rogue forms into these sites, allowing attackers to steal login credentials from users.\r\nhttp://thehackernews.com/2017/01/neverquest-fbi-hacker.html\r\nPage 2 of 3\n\nNeverQuest can also allow malicious attackers to take control of a compromised computer through a Virtual\r\nNetwork Computing (VNC) server and then use those computers to log into the victim’s online bank and perform\r\nthe theft.\r\n\"A thorough investigation of the servers operated by Lisov in France and Germany revealed databases\r\nwith stolen lists of information from accounts of financial institutions, with data indicating, among\r\nother things, account balances,\" the Spanish Civil Guard said Friday. \r\n\"One of the servers leased by Lisov contained files with millions of login credentials, including\r\nusernames, passwords, and security questions and answers, for the bank and financial website\r\naccounts.\"\r\nLisov reportedly works as a systems administrator and website developer for a local company in Taganrog,\r\nRussia.\r\nThe Russian hacker is being held under observation by authorities in the north-eastern region of Catalonia before\r\nSpain's High Court decides whether to extradite him to the United States.\r\nFound this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content\r\nwe post.\r\nSource: http://thehackernews.com/2017/01/neverquest-fbi-hacker.html\r\nhttp://thehackernews.com/2017/01/neverquest-fbi-hacker.html\r\nPage 3 of 3",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia",
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"http://thehackernews.com/2017/01/neverquest-fbi-hacker.html"
	],
	"report_names": [
		"neverquest-fbi-hacker.html"
	],
	"threat_actors": [],
	"ts_created_at": 1775434447,
	"ts_updated_at": 1775826762,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/b3eb877540e4cbed7b383f11392f0b5e7a61b470.pdf",
		"text": "https://archive.orkl.eu/b3eb877540e4cbed7b383f11392f0b5e7a61b470.txt",
		"img": "https://archive.orkl.eu/b3eb877540e4cbed7b383f11392f0b5e7a61b470.jpg"
	}
}