Feds charge Evil Corp, Russia-based creators of Dridex malware, in $100 million bank hacking spree

The most on-brand name since "Fraud Guarantee."

The U.S. departments of Justice and Treasury departments today announced sanctions against the Russian hacking group "Evil Corp."

The Russian cybercrime organization stole "at least" $100 million from banks using malware that grabbed users' banking credentials, the DOJ/Treasury joint press release says.

The name "Evil Corp." seems to allude to the corporation in "Mr. Robot."

The crime org is "run by a group of individuals based in Moscow, Russia, who have years of experience and well-developed, trusted relationships with each other," says the Treasury Department press release.

Here is the full announcement from the U.S. Department of Treasury, released today.

Cyber-related Designations; Counter Terrorism Designation Removal
12/5/2019

OFFICE OF FOREIGN ASSETS CONTROL
Specially Designated Nationals List Update

The following individuals have been added to OFAC's SDN List:

ALVARES, Carlos, Moscow, Russia; DOB 18 May 1971; POB Spain; Gender Male; National ID No. AV176942 (Spain) (individual) [CYBER2] (Linked To: EVIL CORP).

BASHLIKOV, Aleksei, Moscow, Russia; DOB 18 Mar 1988; POB Russia; Gender Male; Passport 4509592875 (Russia) (individual) [CYBER2] (Linked To: EVIL CORP).

BURKHONOVA, Gulsara, Moscow, Russia; DOB 06 Apr 1977; POB Russia; alt. POB Tajikistan; Gender Female; Passport 9707561379 (Russia) (individual) [CYBER2] (Linked To: EVIL CORP).

GUBERMAN, David, Moscow, Russia; DOB 01 Mar 1971; POB Ukraine; Gender Male; National ID No. 7201105 (Israel) (individual) [CYBER2] (Linked To: EVIL CORP).

GUSEV, Denis Igorevich (Cyrillic: DDDDD', D"DDDD DDDDDD'DD) (a.k.a. GOTMAN, David; a.k.a. POMOJAC, Marin), Moscow, Russia; DOB 10 Jun 1986; alt. DOB 08 Jul 1977; alt. DOB 07 Oct 1987; POB Moscow, Russia; alt. POB Ceadir-Lunga, Moldova; citizen Russia; Gender Male; Passport 717386212 (Russia); alt. Passport A1167292 (Moldova); alt. Passport 1213007 (Israel) (individual) [CYBER2] (Linked To: EVIL CORP).

MANIDIS, Georgios, Moscow, Russia; DOB 23 Aug 1971; Gender Male; National ID No. AV2752462 (Greece) (individual) [CYBER2] (Linked To: EVIL CORP).

PLOTNITSKIY, Andrey (a.k.a. KOVALSKIY, Andrey Vechislavovich; a.k.a. STREL, Andrey), Moscow, Russia; DOB 25 Jul 1989; Gender Male (individual) [CYBER2] (Linked To: EVIL CORP).

SAFAROV, Azamat, Moscow, Russia; DOB 26 Mar 1990; POB Uzbekistan; Gender Male; National ID No. CE2236830 (Uzbekistan) (individual) [CYBER2] (Linked To: EVIL CORP).

SHEVCHUK, Tatiana, Moscow, Russia; DOB 08 Jan 1970; Gender Female; National ID No. BB299742 (Ukraine) (individual) [CYBER2] (Linked To: EVIL CORP).

SLOBODSKOY, Dmitriy Alekseyevich, Russia; DOB 28 Jul 1988; Gender Male; Passport 721007353 (Russia) (individual) [CYBER2] (Linked To: EVIL CORP).

SLOBODSKOY, Kirill Alekseyevich, Moscow, Russia; DOB 26 Feb 1987; POB Moscow, Russia; nationality Russia; Gender Male; Passport 721025114 (Russia); National ID No. 4508818947 (Russia) (individual) [CYBER2] (Linked To: EVIL CORP).

SMIRNOV, Dmitriy Konstantinovich, Moscow, Russia; DOB 10 Nov 1987; citizen Russia; Gender Male (individual) [CYBER2] (Linked To: EVIL CORP).

TUCHKOV, Ivan Dmitriyevich, Russia; DOB 27 Nov 1986; POB Moscow, Russia; Gender Male; Passport 45092006504 (Russia); alt. Passport 753931329 (Russia); VisaNumberID 525867504 (France) (individual) [CYBER2] (Linked To: EVIL CORP).

TURASHEV, Igor Olegovich (a.k.a. "ENKI"; a.k.a. "NINTUTU"), Russia; DOB 15 Jun 1981; Gender Male (individual) [CYBER2] (Linked To: EVIL CORP).

YAKUBETS, Artem Viktorovich, Moscow, Russia; DOB 17 Jan 1986; POB Polonnoye, Khmelnitskaya Oblast, Ukraine; citizen Russia; Gender Male (individual) [CYBER2] (Linked To: EVIL CORP).

YAKUBETS, Maksim Viktorovich (a.k.a. "AQUA"), Moscow, Russia; DOB 20 May 1987; POB Polonnoye, Khmelnitskaya Oblast, Ukraine; citizen Russia; Gender Male; Passport 4509135586 (Russia) (individual) [CYBER2] (Linked To: EVIL CORP; Linked To: FEDERAL SECURITY SERVICE).

ZAMULKO, Ruslan, Moscow, Russia; DOB 25 Jun 1970; POB Ukraine; Gender Male; National ID No. HB698865 (Ukraine) (individual) [CYBER2] (Linked To: EVIL CORP).

The following entities have been added to OFAC's SDN List:

BIZNES-STOLITSA, OOO (Cyrillic: DDD DDD-DDD-DDDDDDD) (a.k.a. OBSHCHESTVO S OGRANICHENNOI OTVETSTVENNOSTYU BIZNES-STOLITSA), d. 14 korp. 1 pom. Khll/kom. 1, ul., Sokolovo-Meshcherskaya Moscow, Moscow 125466, Russia; D-U-N-S Number 50-722-4994; Tax ID No. 7733904024 (Russia); Government Gazette Number 40335667 (Russia); Registration Number 5147746417682 (Russia) [CYBER2] (Linked To: GUSEV, Denis Igorevich).

EVIL CORP (a.k.a. DRIDEX GANG), Moscow, Russia; Moldova [CYBER2].

OPTIMA, OOO (Cyrillic: DDD DDDDDD) (a.k.a. OBSHCHESTVO S OGRANICHENNOI OTVETSTVENNOSTYU OPTIMA), d. 2 korp. 2 pom. 1, ul., Kominterna Moscow, Moscow 129344, Russia; D-U-N-S Number 50-579-8144; Tax ID No. 7716740680 (Russia); Government Gazette Number 17325717 (Russia); Registration Number 1137746232260 (Russia) [CYBER2] (Linked To: GUSEV, Denis Igorevich).

TREID-INVEST, OOO (Cyrillic: DDD DDDDTMD"-DDD'DDD) (a.k.a. OBSHCHESTVO S OGRANICHENNOI OTVETSTVENNOSTYU TREID-INVEST), 11/2, ul., Sadovaya-Chernogryazskaya Moscow, Moscow 105064, Russia; D-U-N-S Number 50-722-5114; Tax ID No. 7701416320 (Russia); Government Gazette Number 40214946 (Russia); Registration Number 5147746418782 (Russia) [CYBER2] (Linked To: GUSEV, Denis Igorevich).

TSAO, OOO (Cyrillic: DDD DDD) (a.k.a. OBSHCHESTVO S OGRANICHENNOI OTVETSTVENNOSTYU TSENTR AVTOOBSLUZHIVANIYA), 9, per., Omski Kurgan, Kurganskaya Oblast 640000, Russia; D-U-N-S Number 68-215-4722; Tax ID No. 4501122896 (Russia); Government Gazette Number 78739479 (Russia); Registration Number 1064501172394 (Russia) [CYBER2] (Linked To: GUSEV, Denis Igorevich).

VERTIKAL, OOO (Cyrillic: DDD D'DDDDDDDD) (a.k.a. OBSHCHESTVO S OGRANICHENNOI OTVETSTVENNOSTYU VERTIKAL), d. 102/1, ul. Beregovaya Kogalym, Khanty-Mansiski, Avtonomny Okrug - Yugra Okr. 628482, Russia; D-U-N-S Number 50-630-4726; Tax ID No. 8608056026 (Russia); Government Gazette Number 26149774 (Russia); Registration Number 1138608000189 (Russia) [CYBER2] (Linked To: GUSEV, Denis Igorevich).

YUNIKOM, OOO (Cyrillic: DDD D(R)DDDDD) (a.k.a. OBSHCHESTVO S OGRANICHENNOI OTVETSTVENNOSTYU YUNIKOM), d. 18, ul. Tsentralnaya Kogalym, Khanty-Mansiski, Avtonomny Okrug - Yugra Okr. 628483, Russia; D-U-N-S Number 68-321-9795; Tax ID No. 8608052180 (Russia); Government Gazette Number 97396163 (Russia); Registration Number 1068608008204 (Russia) [CYBER2] (Linked To: GUSEV, Denis Igorevich).

The following deletions have been made to OFAC's SDN List:

AMHAZ, Issam Mohamad (a.k.a. AMHAZ, 'Isam; a.k.a. AMHAZ, Issam Mohamed), Ghadir, 5th Floor, Safarat, Bir Hassan, Jenah, Lebanon; Issam Mohamad Amhaz Property, Ambassades (Safarate), Bir Hassan Area , Ghobeiri, Baabda, Lebanon; DOB 04 Mar 1967; POB Baalbek, Lebanon; nationality Lebanon; Additional Sanctions Information - Subject to Secondary Sanctions Pursuant to the Hizballah Financial Sanctions Regulations; Passport RL0000199 (Lebanon); Identification Number 61 Nabha; Chairman, Stars Group Holding; General Manager, Teleserveplus (individual) [SDGT].

AMHAZ, Issam Mohamed (a.k.a. AMHAZ, 'Isam; a.k.a. AMHAZ, Issam Mohamad), Ghadir, 5th Floor, Safarat, Bir Hassan, Jenah, Lebanon; Issam Mohamad Amhaz Property, Ambassades (Safarate), Bir Hassan Area , Ghobeiri, Baabda, Lebanon; DOB 04 Mar 1967; POB Baalbek, Lebanon; nationality Lebanon; Additional Sanctions Information - Subject to Secondary Sanctions Pursuant to the Hizballah Financial Sanctions Regulations; Passport RL0000199 (Lebanon); Identification Number 61 Nabha; Chairman, Stars Group Holding; General Manager, Teleserveplus (individual) [SDGT].

AMHAZ, 'Isam (a.k.a. AMHAZ, Issam Mohamad; a.k.a. AMHAZ, Issam Mohamed), Ghadir, 5th Floor, Safarat, Bir Hassan, Jenah, Lebanon; Issam Mohamad Amhaz Property, Ambassades (Safarate), Bir Hassan Area , Ghobeiri, Baabda, Lebanon; DOB 04 Mar 1967; POB Baalbek, Lebanon; nationality Lebanon; Additional Sanctions Information - Subject to Secondary Sanctions Pursuant to the Hizballah Financial Sanctions Regulations; Passport RL0000199 (Lebanon); Identification Number 61 Nabha; Chairman, Stars Group Holding; General Manager, Teleserveplus (individual) [SDGT].

Last Updated: 12/5/2019 9:44 AM

"Evil Corp" is the most on-brand organization name since "Fraud Guarantee."

- Eamon Javers (@EamonJavers) December 5, 2019