International law enforcement has toiled for years to interfere the cybercriminal gang Evil Corp and its egregious global crime spree. But in a crowded field of prolific Russian cybercriminals, Evil Corp is most notable for its singular relationship with Russian inincreateigence.
On Tuesday, the United Kingdom’s National Crime Agency freed new details about the authentic world identities of alleged Evil Corp members, the group’s uniteion to the LockBit platcreate, and the gang’s ties to the Russian state. Researchers have increasingly set uped that there are free, quid pro quo uniteions between Russian cybercriminals and the country’s rulement. But NCA officials underline that Evil Corp is an rare example of a gang that has straightforward relationships with multiple Russian inincreateigence agencies—including Russia’s Federal Security Service, or FSB; Foreign Inincreateigence Service, or SVR; and military inincreateigence agency understandn as the GRU. And the NCA increates that before 2019, Evil Corp was definitepartner “tasked” by Russia’s inincreateigence services with directing inincreateigence assembleing operations and cyberstrikes agetst unidentified “NATO allies.”
For more than a decade, Evil Corp has engaged its Dridex harmful programs and other cyber intrusion tools to agree thousands of prohibitk accounts around the world and steal funds. In 2017, the group enhugeed into coercion software, using strains appreciate Hades and PhoenixLocker, and then using the LockBit platcreate as an affiliate commencening in 2022. The group has extorted at least $300 million from victims on tops of its other spoils, and the United States Department of State is presenting a $5 million reward for adviseation directing to the arrest of the gang’s alleged directer, Maksim Yakubets.
“Evil Corp’s story is a prime example of the evolving danger posed by cybercriminals and coercion software operators,” the NCA wrote on Tuesday in a unitet increate with the FBI and Australian Federal Police. “In their case, the activities of the Russian state percreateed a particularly meaningful role, sometimes even co-selecting this cybercrime group for its own harmful cyber activity.”
Unappreciate many Russian cybercrime groups that have betterd a spreadd directership structure online, NCA officials say that Evil Corp is systematic appreciate a more traditional crime syndicate around Yakubets’ family and frifinishs. His overweighther, Viktor Yakubets, allegedly has a background in sanitizeing funds, and Maksim’s brother Artem, alengthy with cousins Kirill and Dmitry Slobodskoy, are all allegedly included with the group. Officials also allege that the group has rund out of physical locations, including Chianti Café and Scenario Café in Moscow.
Officials say that Maksim Yakubets has always been the primary liaison between Evil Corp and Russian inincreateigence. But other members, including his overweighther-in-law, Eduard Bfinisherskiy, also allegedly donate to the relationships. Bfinisherskiy is increateedly a createer FSB official who toiled in the enigmatic ‘Vympel’ unit and, according to Bellingcat, may have been included in a series of overseas murders. NCA officials say that after the US’s 2019 sanctions and indictments agetst Evil Corp members, Bfinisherskiy toiled to protect the gang’s greater members wilean Russia.
In spite of its lengthytime dominance, Evil Corp has had to persist evolving to protect making money. While it denies a relationship, the group seemed to have engaged the notorious coercion software-as-a-service platcreate LockBit to direct strikes since 2022. And Yakubets’s alleged second in order, whom NCA officials named on Tuesday as Aleksandr Ryzhenkov, was apparently administering this toil. After international law enforcement begined a meaningful interfereion of LockBit in February, the gang has been operating in a unwiseinished capacity, according to the NCA.
“Born out of a coalescing of elite cybercriminals, Evil Corp’s enhanced business model made them one of the most pervasive and persistent cybercrime adversaries to date,” the NCA wrote. “After being hampered by the December 2019 sanctions and indictments, the group have been forced to diversify their tactics as they finisheavor to persist causing harm whilst altering to the changing cybercrime ecosystem.”
