Russian Cybercrime Group ‘Evil Corp’ Sanctioned by Treasury Dept.

The Treasury Dept. announced Thursday that it will impose sanctions on the Russia-based cybercrime organization known as Evil Corp, which has stolen over $100 million through malware that infected hundreds of banks & financial institutions in more than 40 countries. Additionally, the Dept. of Justice (DOJ) charged two of Evil Corp’s members with criminal violations and the State Dept. offered a reward of up to $5 million for information leading to the capture or conviction of Evil Corp’s leader.

Treasury Secretary Steven Mnuchin offered the following statement in announcing the sanctions, which were imposed under the Countering America’s Adversaries Through Sanctions Act:

“Treasury is sanctioning Evil Corp as part of a sweeping action against one of the world’s most prolific cybercriminal organizations. This coordinated action is intended to disrupt the massive phishing campaigns orchestrated by this Russian-based hacker group. [The Office of Foreign Assets Control’s] action is part of a multiyear effort with key NATO allies, including the United Kingdom. Our goal is to shut down Evil Corp, deter the distribution of Dridex, target the “money mule” network used to transfer stolen funds, and ultimately to protect our citizens from the group’s criminal activities.”

What does Evil Corp do?

Evil Corp uses the Dridex malware, which is designed to automate the theft of confidential information and online banking credentials from infected computers. Here’s how the scam works:

• Dridex malware is typically spread through massive phishing email campaigns that try to entice victims into clicking on malicious links or attachments in the email.
• Once opened, the malware is downloaded onto the computer system.
• The malware uses the compromised login information to fraudulently transfer funds from victims’ bank accounts to accounts controlled by the group, which is carried out by a network of “money mules”.

Evil Corp is led by Maksim Yakubets, who was indicted by the DOJ & is the subject of the State Dept. bounty. Yakubets has also provided assistance to the Russian government and worked for one of its leading intelligence agencies, the FSB.

— Eric Revell

(Photo Credit: iStock.com / solarseven)