US charges Russian 'Evil Corp' hackers with $100m banking scheme
US prosecutors have charged two members of a Russia-based hacking group that calls itself Evil Corp with masterminding a global banking fraud scheme that netted the unsubtly named gang more than $100m.
Two leading members of Evil Corp, Maksim Yakubets of Moscow and Igor Turashev from the Russian city Yoshkar-Ola, were charged with bank fraud and also sanctioned by the treasury department for developing and distributing the Dridex malware which stole swiped banking credentials from more than 40 countries. In a statement, US treasury officials called Evil Corp “one of the biggest hacking groups ever”.
British authorities described the 32year-old Yakubets as a supercar-lover who customized his Lamborghini license plate to read “thief” in Russian and ran his operation from the basements of Moscow cafes.
The US also entered Evil Corp, which also called itself the “Dridex Gang”, into its Specially Designated Nationals and Blocked Persons List.
The Dridex malware developed by the group was spread through a massive phishing operation, where targets were infected after clicking on internet links.
“Treasury is sanctioning Evil Corp as part of a sweeping action against one of the world’s most prolific cybercriminal organizations,” said Steven Mnuchin, the US treasury secretary, in a statement. “Our goal is to shut down Evil Corp, deter the distribution of Dridex, target the ‘money mule’ network used to transfer stolen funds, and ultimately to protect our citizens from the group’s criminal activities.”
US authorities worked in coordination with Britain’s National Crime Agency, which published a series of photographs and video of the hacker’s lavish lifestyle, including images of his camouflaged car streaked with fluorescent yellow.
The director general of the British agency, Lynne Owens, said that Yakubets and Evil Corp “represent the most significant cybercrime threat to the UK”.
Yakubets, originally from Ukraine, and Turashev are both still at large. Another 15 people tied to the hacking group have also been sanctioned by the treasury department. Many were believed to be living in Moscow.
“What are the chances this guy is going to face trial in the United States?” asked John Shier, an expert at UK-based cybersecurity company Sophos. “Probably next to zero.”
The US treasury department also announced a $5m bounty for information “leading to the capture or conviction of Evil Corp’s leader”. In court documents, Yakubets is described as the leader of the group.
Computer attacks attributed to the two men targeted victims in 11 states, including a bank and a school district in Pennsylvania, where the criminal charges against them were brought.
US news outlets also said that treasury officials believed that Yakubets had committed other cybercrimes on behalf of the Russian government, as part of a scheme where Russian intelligence agencies recruit criminal hackers in order to target entities related to national security.