Unmasked: The Evil Corp cyber gangster who worked for LockBit

In Putin’s pocket

During its investigation, the NCA also firmed up evidence of long-suspected links between Evil Corp and the Kremlin, revealing that Evil Corp ringleader Yakubets has been in the pocket of the Russian government and actively sought contacts and connections at the highest levels of the intelligence community.

Significantly, Yakubets was aided in this by his father-in-law, Eduard Benderskiy, a former high-ranking official in the FSB, who leveraged his contacts to hep Yakubets develop his relationship with the Russian state.

It has long been known that a link existed between Yakubets and the state via ex-Spetsnaz officer Benderskiy, who likely has the ear of Russian leader Vladimir Putin.

However, the NCA also revealed new intelligence that prior to 2019, Evil Corp was officially tasked with conducting cyber attacks and espionage actions against Nato countries.

After the December 2019 action against Evil Corp, in which Yakubets was indicted by the US, Benderskiy also brought his influence to bear in Moscow, leaning on others in the Russian government to make sure his family members were left alone.

Eduard Benderskiy is among the individuals newly-sanctioned today.

The NCA stressed that the relationship between the two was highly unusual, and that most Russia-based cyber criminal gangs operate on a financially motivated basis, albeit receiving a certain degree of arms-length "protection" from Moscow.

UK foreign secretary David Lammy said: “I am making it my personal mission to target the Kremlin with the full arsenal of sanctions at our disposal. Putin has built a corrupt mafia state with himself at its centre. We must combat this at every turn, and today’s action is just the beginning.”

LockBit takedown a humiliation for the gang

The LockBit gang, which infamously disrupted Royal Mail’s international services for weeks at the start of 2023, was taken down in Operation Cronos in February 2024 after a prolific crime spree that at one point saw it account for over a quarter of all known ransomware attacks worldwide.

Operation Cronos resulted in the near complete compromise of the LockBit operation. This was accomplished not merely through a technical takedown of its server infrastructure, but by creatively turning some of the gang’s tactics on it, among them the naming and shaming of key members, including its self-aggrandising leader Khoroshev.

Notably, Khoroshev himself was was trolled by the NCA earlier in the year when they revealed he did not, as he claimed, drive a Lamborghini but rather an elderly Mercedes that, living in sanctioned Russia, he could not get spare parts for anymore.

In this way, cyber experts say, the authorities have ensured that the crew is not just unable to operate, but has been humiliated in the eyes of its peers, and although individuals associated or affiliated with LockBit attempted a fightback at first, the reputational damage that the crew sustained in the takedown, along with a series of outbursts that got the unstable Khoroshev banned from underground cyber crime forums, meant nobody wanted to work with LockBit anymore, and these efforts largely faltered.

This is not to say the danger from LockBit has passed - eight months on, the ransomware locker itself remains a threat and has been used on new victims, but it has tended to be older, leaked builds being deployed without much success by small-time affiliates. With its credibility in tatters, the LockBit gang, said the NCA, is not what it was.

“The disruption that we carried out was as much about disrupting the group as it was about disrupting their trajectory of growth and preventing them becoming even bigger,” said Webb.

More arrests

In recent weeks, the NCA revealed, more arrests have been made in the UK and Europe of individuals who laundered money for LockBit. French authorities have arrested a suspected developer, while in Spain one of the main facilitators of LockBit’s infrastructure has been taken into custody, and a total of nine servers seized.

The NCA has also relaunched LockBit’s dark web portal, which it took over in February and has been using to taunt the cyber criminals, publishing more details of some of the individuals arrested in recent weeks.