Evgeniy Bogachev

GameOver Zeus was a banking trojan botnet — a network of infected computers used to steal banking credentials and drain accounts, running from approximately 2011. Its operator, per the FBI and DOJ, was Evgeniy Bogachev, who went by 'slavik' and other aliases. At its peak, the botnet had infected approximately one million machines worldwide. [SOURCE: FBI; DOJ]

The same infrastructure that ran the banking-trojan operation was used to distribute CryptoLocker — a program that encrypted a victim's files and demanded payment in Bitcoin for the decryption key. This is the point where ransomware, as it is understood today, begins: a demand for cryptocurrency in exchange for access to something the victim needs. Every ransomware case that follows — Cases 056 through 060 — traces back to this model.

Over $100 million in losses have been attributed to the GameOver Zeus operation by the FBI. The ransomware operation's losses are counted separately. [SOURCE: FBI] Bogachev's personal take was a share of the criminal proceeds — not the full loss figure.

In June 2014, Operation Tovar — a coordinated effort by the FBI, DOJ, Europol, and private sector partners — disrupted GameOver Zeus's botnet infrastructure. The operation temporarily cut the connection between infected machines and the botnet's command-and-control systems. The DOJ unsealed Bogachev's indictment on June 2, 2014.

Bogachev was not arrested. He was not in a jurisdiction that would extradite him. He was believed to be in Russia. By the time the takedown was executed, he had been operating criminal infrastructure for years from a location the US could reach legally but not physically.

The FBI offered a $3 million reward for information leading to his arrest and conviction — at the time, one of the largest rewards ever offered for a cybercriminal. Subsequent reporting indicated that Bogachev's botnet was also used to conduct intelligence collection on Ukrainian government communications — suggesting an overlap between criminal cybercrime and Russian state intelligence interests that would become a documented theme in later years. [SOURCE: security researcher reporting; US government characterizations]

He is still at large. As of September 2026, he has been a fugitive for more than twelve years. He is believed to be in Krasnodar, Russia. He has never been tried. No reward has been collected.