🇺🇦
UKRAINE
#2 WCI
FRAUD TYPES
Ransomware, carding, malware dev, hacking-for-hire
KEY FACTS
#2 globally for cybercrime skill. War has not reduced output. Criminal/hacktivist overlap.
REPORT FRAUD IN UKRAINE1▸
No agency for Ukraine in our directory yet.
See all countries we cover ▸
Search the Report Fraud directory.
BORN HERE4▸
4 people in our case files were born in Ukraine. Tap to open the report.
OPERATED HERE4▸
Physically based or working in Ukraine — lived, ran an office, met victims or was stationed here, per the record. Hacking a target here does not count.
Ukraine
WHAT THEY DID HERE, AND WHEN
2015–2018Runs FIN7's servers, encrypted channels and card-data aggregation as its systems administrator, per the DOJ.SOURCE: DOJ W.D. Wash.
Ukraine
WHAT THEY DID HERE, AND WHEN
2019Spends about a month in Ukraine, which the government says was used to move funds.SOURCE: sentencing filings
Kyiv, Ukraine
WHAT THEY DID HERE, AND WHEN
2005–2014Advises Viktor Yanukovych's Party of Regions; the income is hidden offshore.SOURCE: Indictment
Ukraine
WHAT THEY DID HERE, AND WHEN
2019–2021Runs REvil attacks as the affiliate 'Rabotnik', including the July 2021 Kaseya attack.SOURCE: DOJ N.D. Tex.
OUR CASES BY CATEGORY▸
Share of the 6 cases tied to Ukraine (born or operated here)
FRAUD METHODS TIED HERE13▸
From the Global Fraud Encyclopedia and the cases above. Tap a method for its page.
#3 RansomwareEncyclopedia · used in our cases ▸#6 Card-Not-Present (CNP) Fraudused in our cases ▸#7 Money Launderingused in our cases ▸#8 Securities Fraud / Insider Tradingused in our cases ▸#10 Tax Evasion / Tax Fraudused in our cases ▸#17 Investment Scam (General)used in our cases ▸#20 Wire Fraudused in our cases ▸#22 PhishingEncyclopedia · used in our cases ▸#24 Digital Skimming (Magecart)used in our cases ▸#31 Credential StuffingEncyclopedia ▸#39 Banking Trojanused in our cases ▸#69 Supply Chain Fraudused in our cases ▸#85 Pump and Dumpused in our cases ▸KNOWN FOR▸
THE PICTURE▸
Ukraine hosts scam call centres that target victims across Europe with fake investment platforms and bank- or police-impersonation calls; the UN Office on Drugs and Crime estimated that up to 1,500 such call centres operated there as recently as 2024, many in and around Dnipro (bne IntelliNews citing UNODC, 2025). In October 2024, Czech, Latvian, Lithuanian and Ukrainian authorities, with Eurojust, hit a network running call centres in Dnipro, Ivano-Frankivsk and Kyiv, with estimated losses above EUR 10 million from more than 400 known victims (Eurojust, 2024). Ukraine's Cyber Police and Europol also arrested suspects in an investment scheme said to take more than EUR 200 million a year (Europol/Cyber Police, 2024). Several Ukrainian nationals have been convicted in the US for ransomware and banking-malware schemes.
TOP FRAUDSTERS FROM HERE2▸
Vyacheslav Penchukov PLEADED GUILTYREPORT PENDING
Tens of millions of dollars (stolen from victims' bank accounts, per DOJ) · 2009–2021
Leader in the Jabber Zeus banking-malware crew and the IcedID malware operation; sentenced to two concurrent nine-year terms in the US.
SOURCE: US Department of Justice, July 2024
Oleksandr Ieremenko FUGITIVEREPORT PENDING
$4.1M (alleged trading profits) · 2016–2019
Charged with hacking the US SEC's EDGAR filing system to steal non-public earnings releases for insider trading.
SOURCE: US Department of Justice / SEC, Jan 2019
FRAUD BY CATEGORY▸
No official body here publishes a breakdown of fraud by type, so we show none rather than guess.
KEY NUMBERS▸
Up to 1,500 Fraudulent call centres estimated to operate in Ukraine (2024) (UNODC via bne IntelliNews, 2025)
EUR 10M+ Losses to 400+ known victims of one Dnipro/Ivano-Frankivsk/Kyiv call-centre network (Eurojust, Oct 2024)
EUR 200M+ a year Alleged take of an investment-fraud scheme disrupted by Cyber Police and Europol (Europol / Ukraine Cyber Police, 2024)
WHO FIGHTS IT▸
Cyber Police Department of the National Police leads call-centre raids, often with Europol and Eurojust.
Office of the Prosecutor General ran special operation 'Connect' with EU partners against a transnational call-centre network.
October 2024 Eurojust-supported joint action with Czechia, Latvia and Lithuania against call centres in Dnipro, Ivano-Frankivsk and Kyiv.
US prosecutions of extradited Ukrainians (Vasinskyi, 2024; Penchukov, 2024) for ransomware and banking malware.
SOURCES▸
bne IntelliNews, 2025
Eurojust press release, Oct 2024
Europol / Bitdefender, 2024
Prosecutor General of Ukraine
US Department of Justice press releases, 2019–2024
Case lists and figures compiled September 2026 from court records, regulators and major press; statuses change. Series reports above are fact-checked case files.