DOJ charges two members of Evil Corp, a Russian hacker gang behind the Dridex malware, which allegedly stole $100M+ from banks; US Treasury sanctions Evil Corp
The US is charging Maksim Yakubets over two of the biggest cybertheft campaigns of the last decade, and offers a record reward for information on the case.
WiredBrian Barrett
Context & Ripple Effects
This is Washington's fullest swing yet at Evil Corp: the DOJ has charged leader Maksim Yakubets over the Dridex banking-malware campaigns that allegedly drained $100M+ from banks, and paired the indictment with a record State Department reward and US Treasury sanctions on the group itself — the first time this gang's finances, not just its members, are in American crosshairs.
The move set the template for everything that followed in the corpus: reporting on the gang's back-end operations and alleged FSB connections came days later, and by 2022 Mandiant documented how the sanctions forced Evil Corp into a ransomware-as-a-service pivot — evidence the pressure worked but also redirected the threat.
First-order effects
Yakubets becomes one of the world's most-wanted cybercriminals overnight — indicted, publicly named, and carrying a record reward for information leading to his capture.
The Treasury sanctions cut Evil Corp off from dollar-denominated finance, freezing the group's ability to cash out its alleged $100M+ in Dridex proceeds through normal channels.
Second-order effects
Evil Corp adapts rather than collapses: Mandiant later found it renting out ransomware through affiliate brands specifically to launder attacks past sanction screening — shifting risk onto partners who aren't on the list.
Enforcement extends downstream to the money movers: the DOJ's later charges against operators of billion-dollar laundering services like Joker's Stash target the cash-out layer Evil Corp-style groups depend on.
Third-order effects
Sanctions-plus-indictments hardens into the standard US playbook against cybercrime syndicates, forcing sanctioned groups into ever-shallower front brands and affiliate structures that make attribution harder even as the names stay constant.
The alleged FSB connections reported around Evil Corp deepen the blur between profit-driven crews and state-tolerated actors, raising the odds future sanctions regimes treat Russian cybercrime infrastructure as a national-security lever.
The trend: US cybercrime enforcement is shifting from arresting individuals to financially strangling whole gangs with Treasury sanctions — a tactic that reshapes how those gangs operate faster than it captures anyone.
For the last decade, the hackers behind Evil Corp have led a sustained assault on the bank accounts of thousands of victims across dozens of countries. Today, the FBI indicted Evil Corp's alleged leader: Maksim V. Yakubets, also known as “aqua.” https://www.wired.com/...
The dept of state put a $5M bounty on the head of Evil Corp. It puts him up there with senior al Qaeda and ISIS leaders. People the USG would have no problem sending Reaper drones after. Sleep well, Russian cyber criminal! https://twitter.com/...
I think part of the problem here is these guys are still at large and unlikely to be arrested, so the videos may kinda.. encourage people. https://twitter.com/...
Russian National Charged w/ Decade-Long Series of Hacking, Bank Fraud Offenses Resulting in Tens of Millions in Losses; 2nd Russian National Charged w/ Involvement in Deployment of “Bugat” Malware. Announced w/ @NCA_UK, @StateINL, @FBI, @WDPAnews, @USAO_NE https://www.justice.gov…
startups out here breaking their backs to come up w nonsense words that sound cute like swytch, purple squirrel, lunch badger, and mush. Russian Criminals: 🤔 EVIL CORP https://twitter.com/...
Breaking: 🔹 Charges against two leaders of Evil Corp., Russian criminal group behind credential-stealing malware Zeus and Bugat/Dridex. https://www.justice.gov/... 🔹 $5m State Dept bounty (largest ever for cyber criminal) 🔹Sanctions against EC members https://home.treasury.gov/..…
Perhaps the most important part of this story, from my perspective - is that the long arm of US law enforcement has gotten really, really good at tracking down the worst criminals behind malware. https://twitter.com/...
New: U.S. prosecutors have charged a Russian citizen for creating the Dridex malware. DOJ said Maksim Yakubets also worked for the Russian government to carry out cyberattacks. https://techcrunch.com/...