Evil Corp

A Moscow cybercrime group behind the Bugat/Dridex banking trojan, later the WastedLocker, Hades and Phoenix ransomware strains, with reported ties to Russian intelligence.

A crew whose malware stole bank logins and drained accounts in over 40 countries — more than $100M per the Treasury — before turning to ransomware and, after sanctions, to renting LockBit.

Evil Corp grew out of the Zeus banking-malware scene around 2009 and from 2011 ran Bugat, later Dridex, which infected computers through spam and drained online bank accounts; the Treasury put the thefts above $100 million. On 5 December 2019 the US sanctioned the group, indicted Maksim Yakubets and Igor Turashev and offered $5 million for Yakubets, who was filmed driving a Lamborghini around Moscow. Sanctions made victims reluctant to pay its ransomware, so members rebranded strains and worked as LockBit affiliates; in October 2024 the UK, US and Australia named 16 more of them and the family and FSB links behind the group.

5 December 2019: OFAC sanctioned Evil Corp and 17 individuals; indictments unsealed in Pittsburgh and Nebraska; State Department offered $5M for Yakubets. 1 October 2024: US, UK and Australia sanctioned 16 more members and exposed Aleksandr Ryzhenkov as a LockBit affiliate; Ryzhenkov indicted. Co-conspirator Igor Turashev also charged (2019).