Evil Corp Cybercrime Syndicate Faces Global Sanctions from OFAC and Allies
The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC), alongside the UK’s Foreign Commonwealth and Development Office (FCDO) and Australia’s Department of Foreign Affairs and Trade (DFAT), has imposed sanctions on members of Evil Corp, a notorious Russia-based cybercrime syndicate. This group is primarily known for developing and distributing the Dridex malware, as reported by Chainalysis.
Global Disruption of Evil Corp
The joint sanctions announced in October 2024 build upon a 2019 OFAC designation targeting Evil Corp’s leaders, including Maksim Yakubets. The syndicate has been responsible for infecting computers and stealing over $100 million from financial institutions worldwide. The UK’s FCDO has sanctioned 16 individuals linked to Evil Corp, with the National Crime Agency publishing an extensive investigation into the group’s activities.
Australia’s DFAT also joined the effort by sanctioning key members of the syndicate. European law enforcement agencies have taken coordinated action against Lockbit, a group with ties to Evil Corp, leading to arrests and the seizure of ransomware infrastructure.
Evil Corp’s Connections to Lockbit
Evil Corp’s activities have overlapped with those of Lockbit, a separate cybercriminal organization. Both groups have used similar tactics, such as employing the same cryptocurrency deposit addresses at centralized exchanges, indicating a possible collaboration in their illicit activities. This connection is highlighted in a 2022 Mandiant report discussing Evil Corp’s rebranding efforts to evade sanctions.
Robust Family Ties and State Connections
Evil Corp’s operations are deeply intertwined with familial connections, many of whom have ties to Russian state security services. Maksim Yakubets, the group’s leader, has been linked to Russia’s Federal Security Service (FSB). His father-in-law, Eduard Benderskiy, a former FSB officer, is noted for facilitating Evil Corp’s relationship with Russian intelligence.
Other family members, such as Maksim’s father Viktor and his likely brother Artem Yakubets, have also been sanctioned for their roles in supporting the syndicate’s activities.
Global Coordination Against Cybercrime
The sanctions against Evil Corp are part of a broader international effort to combat cybercrime, particularly those involving cryptocurrency. Recent actions include the German Federal Criminal Police’s takedown of Russian no-KYC exchanges and OFAC’s designation of Russian Exchange Cryptex. These coordinated efforts underscore the importance of international collaboration in addressing cyber threats.
William Lyne, Head of Cyber Intelligence at the NCA, emphasized the significance of partnerships in disrupting cybercriminal networks, highlighting the role of blockchain transparency in tracking illicit activities. The recent sanctions and related actions signal ongoing efforts to dismantle cybercrime syndicates and hold perpetrators accountable.