Russia’s ‘Evil Corp’ Hackers Unmasked by Sweeping Sanctions

A tight-knit family of hackers and intelligence operatives was the driving force behind Russia’s “Evil Corp” cybercrime syndicate, sanctions leveled by London, Washington and Canberra have revealed.
Once considered the “most significant cybercrime threat in the world,” Evil Corp has been credited with spying on NATO allies at the behest of Russia’s intelligence services.
It has also used phishing scams to pilfer more than $100 million from a string of companies across dozens of countries, according to a 2019 US indictment.
Financial sanctions rolled out by the United Kingdom, the United States and Australia jointly target Evil Corp figures such as Maksim Yakubets, the leader of the hacking group.
But the sanctions also shed light on the tight-knit nature of the group’s operations, detailing a family tree that included Yakubets’ brother, cousins and father.
On Tuesday, the U.S. Treasury also sanctioned Eduard Benderskiy — a former Spetsnaz officer and Yakubets’ father-in-law — who was suspected of orchestrating “Evil Corp’s relationship with the Russian state.”
“Today’s sanctions send a clear message to the Kremlin that we will not tolerate Russian cyber-attacks — whether from the state itself or from its cyber-criminal ecosystem,” UK Foreign Secretary David Lammy said.
Australian Foreign Minister Penny Wong added: “We are using all elements of our national power to make Australia more secure and to keep Australians safe.”
Additionally, all three nations leveled sanctions against Aleksandr Ryzhenkov, a previously unknown hacker who the UK’s National Crime Agency linked to the prolific LockBit ransomware group.
LockBit was one of the major developers of malicious software that allows criminals to lock victims out of their networks, steal their data and demand a ransom for its return. In 2023, Canada’s Communications Security Establishment estimated that LockBit was used in 44% of ransomware incidents worldwide.
A Message from The Moscow Times:
Dear readers,
We are facing unprecedented challenges. Russia’s Prosecutor General’s Office has designated The Moscow Times as an “undesirable” organization, criminalizing our work and putting our staff at risk of prosecution. This follows our earlier unjust labeling as a “foreign agent.”
These actions are direct attempts to silence independent journalism in Russia. The authorities claim our work “discredits the decisions of the Russian leadership.” We see things differently: we strive to provide accurate, unbiased reporting on Russia.
We, the journalists of The Moscow Times, refuse to be silenced. But to continue our work, we need your help.
Your support, no matter how small, makes a world of difference. If you can, please support us monthly starting from just $2. It’s quick to set up, and every contribution makes a significant impact.
By supporting The Moscow Times, you’re defending open, independent journalism in the face of repression. Thank you for standing with us.