Latvian man, extradited to Minnesota, charged in malware scheme that targeted Star Tribune website

A Latvian man who authorities say targeted the Star Tribune's website several years ago with a malware virus has been extradited to Minnesota and faces federal charges in connection with the alleged scheme.

Peteris Sahurovs, 28, also known as "Piotrek" and "Sagade," was charged in 2011 in U.S. District Court in Minneapolis with wire fraud, computer fraud and conspiracy. He was arrested in Latvia in June 2011 but was released and later fled. He was caught in Poland last November. At one time, Sahurovs was the FBI's fifth most-wanted cybercriminal, and a reward of up to $50,000 was offered for information leading to his arrest and conviction.

According to the U.S. Attorney's office, Sahurovs and others created a phony advertising agency and claimed they represented an American hotel chain that wanted to buy advertising on startribune.com.

When the ad began running online, the alleged conspirators changed the computer code in the ad to infect website users' computers with a virus.

The indictment said the malware caused users' computers to freeze up and then generated a series of pop-up warnings to try to trick users into buying purported "antivirus" software to fix the problems. The software "unfroze" the computers and stopped the pop-ups but the malware stayed on the computers.

Users who didn't buy the "antivirus" software found that all of their information, data and files stored on their computers became inaccessible. The prosecutor's office said the scheme generated more than $2 million for Sahurovs and his co-conspirators.

Sahurovs is charged with two counts of wire fraud and one count each of conspiracy to commit wire fraud and unauthorized access to a protected computer. He made his first court appearance Monday.

Pat Pheifer • 612-673-7252