Two Russians indicted over Dridex and Zeus malware

Two Russian citizens have been indicted in the US over their alleged role in the dissemination of the Bugat – more recently known as Dridex – and Zeus banking trojans, described as two of the worst computer hacking and bank fraud schemes of the past decade.

The indictments mark the culmination of a multi-year, multinational investigation which, besides US law enforcement, included the UK’s National Crime Agency (NCA) and the Metropolitan Police.

The two men, both currently believed to be in Russia, are Maksim Yakubets, who has been charged for his alleged role as the leader of an organised criminal gang responsible for the distribution of the Bugat malware package, and co-conspirator Igor Turashev.

Both men were indicted in Pittsburgh, Pennsylvania, on 10 counts, including conspiracy, computer hacking, wire fraud and bank fraud. Additionally, Yakubets, who went by the online handle “Aqua”, has been charged in a criminal complaint in Lincoln, Nebraska, over his role in the dissemination of Zeus.

Bugat targeted Windows users through macros in Microsoft software, which executed and downloaded the trojan when its targets opened email attachments in Word or Excel. Zeus, which also affected Microsoft Windows endpoints, stole banking credentials through keylogging and form grabbing, and was also used to install the CryptoLocker ransomware strain.

Speaking at a press conference in Washington DC, US assistant attorney general Brian Benczkowski said: “Yakubets is a true 21st century criminal who, with the stroke of a key and the click of a mouse, committed cyber crimes across the globe. He has earned his place on the FBI’s list of the world’s most-wanted cyber criminals.

“Yakubets and his co-conspirators did not discriminate in their choice of targets. For example, the Nebraska complaint alleges that Yakubets was directly involved in the theft of tens of thousands of dollars from a religious order of Franciscan sisters. 

“Maksim Yakubets and the members of his criminal networks devised and implemented the kinds of criminal schemes so audacious and sophisticated that they would be difficult to imagine if they were not real. 

“Each and every one of these computer intrusions was, effectively, a cyber-enabled bank robbery. We take such crimes extremely seriously and will do everything in our power to hold these criminals to justice”

“Sitting quietly at computer terminals far away, these cyber criminals allegedly stole tens of millions of dollars from unwitting members of our business, non-profit, governmental, and religious communities. 

“Each and every one of these computer intrusions was, effectively, a cyber-enabled bank robbery. We take such crimes extremely seriously and will do everything in our power to hold these criminals to justice.”

The losses incurred through the activities of Yakubets’ group – known as Evil Corp – totalled hundreds of millions of pounds in both the UK, the US, and other countries.

Additional investigations in the UK targeted a network of money launderers who funnelled profits back to Evil Corp, for which eight people have already gone to prison. Other intelligence supplied through UK law enforcement has helped support sanctions brought against the group by the US Treasury’s Office of Foreign Asset Control.

The NCA described the operation as a sophisticated and technically skilled one, which represented one of the most significant cyber crime threats ever faced in the UK.

Lynne Owens, NCA director general, said: “The significance of this group of cyber criminals is hard to overstate; they have been responsible for campaigns targeting our financial structures with multiple strains of malware over the last decade. We are unlikely to ever know the full cost, but the impact on the UK alone is assessed to run into the hundreds of millions.”