FBI’s Most-Wanted Zeus and IcedID Malware Mastermind Pleads Guilty

A Ukrainian countrywide has pleaded responsible in the U.S. to his job in two unique malware strategies, Zeus and IcedID, among May perhaps 2009 and February 2021.

Vyacheslav Igorevich Penchukov (aka Vyacheslav Igoravich Andreev, father, and tank), 37, was arrested by Swiss authorities in October 2022 and extradited to the U.S. last year. He was additional to the FBI’s most-required checklist in 2012.

The U.S. Office of Justice (DoJ) described Penchukov as a “leader of two prolific malware groups” that contaminated 1000’s of computer systems with malware, foremost to ransomware and the theft of millions of pounds.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

This integrated the Zeus banking trojan that facilitated the theft of bank account facts, passwords, individual identification numbers, and other specifics vital to login to on-line banking accounts.

Penchukov and his co-conspirators, as element of the “large-ranging racketeering company” dubbed Jabber Zeus gang, then masqueraded as staff members of the victims to initiate unauthorized fund transfers.

They also applied persons residing in the U.S. and other parts of the world as “cash mules” to get the wired money, which were in the end funneled to overseas accounts controlled by Penchukov et al. A successor to Zeus was dismantled in 2014.

The defendant has also been accused of facilitating malicious exercise by helping guide attacks involving the IcedID (aka BokBot) malware from at the very least November 2018. The malware is capable of acting as an information and facts stealer and a loader for other payloads, these kinds of as ransomware.

Ultimately, as investigative journalist Brian Krebs documented again in 2022, he managed to evade prosecution by Ukrainian cybercrime investigators for many a long time due to his political connections with former Ukrainian President Victor Yanukovych.

Subsequent his arrest and extradition, Penchukov pleaded responsible to a single depend of conspiracy to commit a racketeer-motivated and corrupt corporation (RICO) act offense for his leadership part in the Jabber Zeus group. He also pleaded responsible to a single rely of conspiracy to commit wire fraud for his management purpose in the IcedID malware group.

Penchukov is scheduled to be sentenced on May perhaps 9, 2024, and faces a greatest penalty of 20 a long time in jail for each individual count.

The progress arrives as the DoJ declared the extradition of a 28-12 months-aged Ukrainian national from the Netherlands in relationship with fraud, money laundering and aggravated id theft by allegedly working and promoting an details stealer acknowledged as Raccoon.

Mark Sokolovsky, who was arrested by Dutch authorities in March 2022, leased Raccoon to other cybercriminals on a malware-as-a-services (MaaS) design for $200 a month. It initial became out there in April 2019.

“These individuals employed many ruses, such as email phishing, to put in the malware on to the pcs of unsuspecting victims,” the DoJ explained.

“Raccoon infostealer then stole particular facts from target desktops, such as login qualifications, monetary details, and other private documents. Stolen information was applied to commit fiscal crimes or was bought to other individuals on cybercrime forums.”

At the very least 50 million exclusive qualifications and sorts of identification have been harvested by the malware, according to the U.S. Federal Bureau of Investigation (FBI) estimates.

Sokolovsky’s arrest was accompanied by a coordinated takedown of Raccoon’s electronic infrastructure, but a new edition of the stealer, called RecordBreaker, has since emerged in the wild.

He has been charged with a person count of conspiracy to dedicate fraud and related activity in link with desktops, 1 depend of conspiracy to dedicate wire fraud, a person count of conspiracy to commit dollars laundering, and a single count of aggravated identification theft.

Found this article exciting? Comply with us on Twitter  and LinkedIn to read additional exceptional material we put up.