Alex Yucel, 25, owned the organization “Blackshades” that sold a sophisticated and pernicious form of malicious software, known as RAT, to several thousand people in more than 100 countries, prosecutors said.
The 25-year-old was arrested in Moldova in November 2013 and extradited to the United States. He initially pleaded not guilty to five counts but later confessed to computer hacking in February.
In exchange, his sentence of less than five years is far below the maximum 17 years in jail that he initially faced by going to trial.
Nearly 100 people were arrested in joint European and US raids in May 2014 targeting the creators, sellers and users of the malware in 16 countries.
Two customers and a Blackshades administrator have already been sentenced to between one and two years in prison after pleading guilty.
Yucel's co-creator, Michael Hogue, pleaded guilty in January 2013 and is awaiting sentencing.
The program, dubbed RAT for “Remote Access Tools,” allowed hackers to access private photographs, passwords, spy on victims through webcams, lock data and then send out “ransom notes” to extort money.
It could also harass or frighten victims through messages that computers would read aloud, and in some cases, it gave hackers access to webcams to spy inside private homes.
More than half a million computers were infected. The malware generated sales of $350,000 from more than 6,000 customers between 2010 and 2014, US officials said.
It could be bought by hackers for $40.
“This malware victimized thousands of people across the globe and invaded their lives. But Yucel's computer hacking days are now over,” US attorney for Manhattan, Preet Bharara, said.
Yucel also got three years' supervised release and a fine of $200,000.