The U.S. Department of Justice and the U.S. Treasury have launched major coordinated actions against Evil Corp, a Russia-based cybercrime organization long known for creating and deploying malware that has siphoned off more than $100 million from financial institutions in at least 40 countries. Evidence shows the group functions much like a family business, with several relatives playing central roles.
Key Developments
- Extensive Sanctions:
The Treasury’s Office of Foreign Assets Control (OFAC) has formally sanctioned a wide network of individuals and companies tied to Evil Corp. - Global Coordination:
The United States acted in tandem with authorities in the United Kingdom and Australia, reflecting a broad international effort to curb the group’s operations. - Links to the Russian State:
Investigators have connected Evil Corp’s leadership to Russia’s Federal Security Service (FSB), raising concerns about state protection or cooperation. - Asset Freeze:
All U.S.-based property belonging to sanctioned persons and entities has been seized or blocked.
Leadership and Key Figures
- Maksim Yakubets – Widely recognized as the group’s leader; believed to maintain ties with the FSB.
- Igor Turashev – A central operator behind the Dridex malware infrastructure.
- Denis Gusev – Senior associate overseeing six affiliated companies.
- Viktor Grigoryevich Yakubets – Maksim’s father, accused of handling illicit funds.
- Sergey Yakubets – Maksim’s brother and contributor to group operations.
- Eduard Benderskiy – Former FSB officer and Maksim Yakubets’ father-in-law.
- Aleksandr Viktorovich Ryzhenkov – Key developer of advanced ransomware variants; recently indicted in the U.S. for attacks using the BitPaymer strain.
- Sergey Viktorovich Ryzhenkov – Brother of Aleksandr and active in malware engineering.
Other Significant Members
- Aleksei Bashlikov
- Ruslan Zamulko
- David Guberman
- Carlos Alvares
- Georgios Manidis
- Tatiana Shevchuk
- Azamat Safarov
- Gulsara Burkhonova
Front Companies and Related Entities
Evil Corp has relied on several businesses—often nominally legitimate—to support and conceal its operations:
- Biznes-Stolitsa, OOO
- Optima, OOO
- Treid-Invest, OOO
- TSAO, OOO
- Vertikal, OOO
- Yunikom, OOO
How Evil Corp Operates
The group runs a professionalized cybercrime infrastructure involving:
- Phishing Campaigns: Malicious emails are used to distribute the Dridex trojan and BitPaymer ransomware.
- Credential Theft: Compromised systems allow attackers to harvest banking and login data.
- Unauthorized Transfers: Stolen credentials are used to move funds into controlled accounts.
- Money Mule Networks: A global network of intermediaries helps launder and disperse the stolen funds.
Family Ties and Internal Structure
Evil Corp operates with an internal hierarchy built around family relationships, which appears to enhance its stability and operational secrecy:
- The Yakubets family forms the central leadership circle.
- The Ryzhenkov brothers play pivotal roles in malware design and deployment.
- The involvement of Eduard Benderskiy, a former FSB officer, deepens concerns about potential state-level support.
This tight-knit structure helps shield the group from infiltration and strengthens its resilience against law enforcement.
Call for Information
FinTelegram encourages whistleblowers or individuals with inside knowledge about Evil Corp, its members, or its associated businesses to come forward. We are particularly seeking details about:
- Specific roles and responsibilities of identified individuals
- Operations linked to the listed companies
- Evidence of collaboration with Russian state actors
- Planned or ongoing cybercriminal schemes
Information can be shared securely through our confidential whistleblower platform Whistle42. Protecting your anonymity remains our highest priority.
Every credible tip helps strengthen global efforts to dismantle sophisticated cybercrime networks and safeguard international financial systems.