The civil complaint follows the coordinated take down of Kelihos in September. Microsoft initially targeted those responsible for the domains used by Kelihos. Now the company said that its investigation showed that some of the defendants’ sub domains may have been legitimate, but that many were being used for questionable purposes with links to disreputable online activities. After working with its first round of defendants, Microsoft says it has evidence that Mr. Sabelnikov wrote the code for and either created, or participated in creating, the Kelihos malware.

Microsoft alleges that Mr. Sabelnikov registered more than 3,700 “cz.cc” sub domains from Mr. Piatti and dotFREE Group SRO, and misused those sub domains to operate and control the Kelihos botnet, according to a blog post by Microsoft's Digital Crime Unit (DCU).