UK reveals father and son at the heart of the Evil Corp. hacking group

Britain, the US and Australia have announced sanctions against 16 people who authorities say are part of the world’s most wanted cybercrime gang.

Russia-based Evil Corp is accused of stealing about $300 million over nearly a decade.

Britain’s National Crime Agency (NCA) says it can now reveal that the gang’s notorious leader Maksim Yakubets is supported by his father Viktor Yakubets – something he had denied when interviewed by the BBC in 2021.

The information was released as part of a large, multinational operation to disrupt Evil Corp and another notorious hacking group called LockBit.

Evil Corp is known for their mafia-like approach and has been waging a campaign of destructive cyber attacks worldwide for over a decade.

In 2019, Maksim Yakubets was sanctioned and offered a $5 million bounty for his arrest, along with another man named Igor Turashev.

Other Russian individuals, including Yakubets’ brother Artem, were also named as part of the US sanctions and designations.

In 2021 the BBC traveled to Russia to find and interview members of the gang to get their side of the story.

In a former home of Maksim Yakubets, we found his father passionately defending his son while claiming his personal innocence.

But now the NCA says Yakubets senior was a key part of the cybercrime group, accusing him of helping the gang launder some of their stolen money.

In addition to the Yakubets’ relatives, Maksim’s father-in-law was also sanctioned for helping to protect and coordinate the group with his connections to Russian security services.

Western authorities have now officially linked Eduard Benderskiy, a former high-ranking FSB official, to Evil Corp.

“Maksim Yakubets and his Evil Corp gang have been living the archetypal Russian hacker-playboy lifestyle seemingly untouchable by law enforcement for years, but today’s announcement shows that we are still watching, digging and determined to disrupt them and to justice,” said Will Lyne. Head of Cyber ​​Intelligence at the NCA.

Another sanction is Aleksandr Ryzhenkov, described by the NCA as the right-hand man of the younger Yakubets, and a member of the infamous LockBit ransomware gang.

It’s the first time an Evil Corp member has been linked to another major gang, indicating that hackers are working across groups to carry out attacks.

In addition to the sanctions, four arrests were also made, including two in Great Britain.

In August, the NCA executed a number of search warrants in the south of England and arrested a 46-year-old man suspected of being linked to a LockBit branch.

A 50-year-old woman was also arrested on suspicion of money laundering offences.

They too were interviewed and later released while the criminal investigation continued.

Both individuals were identified through the analysis and enrichment of data obtained during Operation Cronos – the international police operation that took down LockBit’s internal infrastructure.

“The action announced today has taken place in conjunction with extensive and complex investigations by the NCA into two of the most damaging cybercrime groups of all time,” said James Babbage, director general of threats at the NCA.

The NCA said Evil Corp’s ties to the Russian state had been exposed.

“Today’s sanctions send a clear message to the Kremlin that we will not tolerate Russian cyberattacks – neither from the state itself nor from its cybercriminal ecosystem,” Foreign Secretary David Lammy said.