US Cracks Down on Russian 'Evil Corp' Hackers After $100 Million Spree

U.S. authorities on Thursday took aim at a Russian cybercriminal group known as Evil Corp, indicting its Lamborghini-driving alleged leader and ordering asset freezes against 17 of his associates over a digital crime spree that has netted more than $100 million from companies across the world.

The action against Evil Corp., described by officials as one of the most damaging criminal organizations on the internet, comes with a $5 million bounty issued for information leading to the arrest of its alleged leader, Maksim Yakubets.

British authorities described the 32-year-old Yakubets as a supercar-lover who customized his Lamborghini license plate to read “Thief” in Russian and ran his operation from the basements of Moscow cafes.

“Yakubets is a true 21st century criminal,” U.S. Assistant Attorney General Brian Benczkowski said. “He’s earned his place on the FBI’s list of the world’s most wanted cyber criminals.”

Evil Corp is alleged to be behind an ever-evolving family of malicious software known Dridex, which has bedeviled banks and businesses since it first appeared in 2011. The malware works by hacking into banks and businesses and making rogue financial transfers that are eventually funneled back to the hackers.

Dridex targeted smaller businesses and organizations that lacked the sophisticated cyberdefenses of larger organizations, U.S. officials said.

Though the indictments only mentioned incidents in Nebraska and Pennsylvania, victims spanned the United States - including a dairy company in Ohio, a luggage company in New Mexico and a religious order in Nebraska, FBI Deputy Director David Bowdich told a news conference.

Losses totaled $70 million in the United States alone, officials said.

The crackdown straddled the world of cybercrime and intelligence. The U.S. Treasury and Justice Departments worked in coordination with Britain’s National Crime Agency.

The director general of the British agency, Lynne Owens, said that Yakubets and Evil Corp “represent the most significant cyber crime threat to the U.K.,” a sentiment endorsed by John Shier, an expert at U.K.-based cybersecurity company Sophos.

“I’d put them in the top tier,” he said of the group’s operators.

American and British companies were targets of choice, according to U.S. Treasury officials, but they said France, Italy, the United Arab Emirates, India and Malaysia were also badly affected.

Underlining alleged links between cybercriminals and the Russian state, U.S. Treasury officials said Yakubets worked on the side for Russia’s Federal Security Service (FSB), its domestic intelligence agency, and stole classified material on Moscow’s behalf. One senior U.S. Treasury official said that, last year, he had even applied to the FSB for a license to handle secret documents.

In addition to Yakubets, his close associate Igor Turashev was also indicted in the United States on Thursday for allegedly handling various functions for the group. U.K. authorities say they have already arrested and convicted eight other members of the network.

Reuters could not immediately locate contact details for Yakubets and Turashev, who have not been arrested and are believed to be still at large.

This is at least the second major effort by American authorities and their allies to bring down Evil Corp. A 2015 indictment also charged Yakubets and Turashev with a series of fraud and hacking crimes, but they were never arrested and - following a brief disruption - Dridex went right back to stealing money.

Shier, of Sophos, said that Thursday’s attempt appeared to be more robust - but he doubted that Yakubets would ever see justice.

“What are the chances this guy is going to face trial in the United States?” he said. “Probably next to zero.”