Feds charge Evil Corp, Russia-based creators of Dridex malware, in $100 million bank hacking spree

Hackers. [Shutterstock]

The most on-brand name since “Fraud Guarantee.” The U.S. departments of Justice and Treasury departments today announced sanctions against the Russian hacking group “Evil Corp.” The Russian cybercrime organization stole…

The most on-brand name since “Fraud Guarantee.”

The U.S. departments of Justice and Treasury departments today announced sanctions against the Russian hacking group “Evil Corp.”

The Russian cybercrime organization stole “at least” $100 million from banks using malware that grabbed users' banking credentials, the DOJ/Treasury joint press release says.

The name “Evil Corp.” seems to allude to the corporation in “Mr. Robot.”

The crime org is “run by a group of individuals based in Moscow, Russia, who have years of experience and well-developed, trusted relationships with each other,” says the Treasury Department press release.

Here is the full announcement from the U.S. Department of Treasury, released today.

Cyber-related Designations; Counter Terrorism Designation Removal
12/5/2019

OFFICE OF FOREIGN ASSETS CONTROL
Specially Designated Nationals List Update

The following individuals have been added to OFAC's SDN List:

ALVARES, Carlos, Moscow, Russia; DOB 18 May 1971; POB Spain; Gender Male; National ID No. AV176942 (Spain) (individual) [CYBER2] (Linked To: EVIL CORP).

BASHLIKOV, Aleksei, Moscow, Russia; DOB 18 Mar 1988; POB Russia; Gender Male; Passport 4509592875 (Russia) (individual) [CYBER2] (Linked To: EVIL CORP).

BURKHONOVA, Gulsara, Moscow, Russia; DOB 06 Apr 1977; POB Russia; alt. POB Tajikistan; Gender Female; Passport 9707561379 (Russia) (individual) [CYBER2] (Linked To: EVIL CORP).

GUBERMAN, David, Moscow, Russia; DOB 01 Mar 1971; POB Ukraine; Gender Male; National ID No. 7201105 (Israel) (individual) [CYBER2] (Linked To: EVIL CORP).

GUSEV, Denis Igorevich (Cyrillic: ГУСЕВ, ДЕНИС ИГОРЕВИЧ) (a.k.a. GOTMAN, David; a.k.a. POMOJAC, Marin), Moscow, Russia; DOB 10 Jun 1986; alt. DOB 08 Jul 1977; alt. DOB 07 Oct 1987; POB Moscow, Russia; alt. POB Ceadir-Lunga, Moldova; citizen Russia; Gender Male; Passport 717386212 (Russia); alt. Passport A1167292 (Moldova); alt. Passport 1213007 (Israel) (individual) [CYBER2] (Linked To: EVIL CORP).

MANIDIS, Georgios, Moscow, Russia; DOB 23 Aug 1971; Gender Male; National ID No. AV2752462 (Greece) (individual) [CYBER2] (Linked To: EVIL CORP).

PLOTNITSKIY, Andrey (a.k.a. KOVALSKIY, Andrey Vechislavovich; a.k.a. STREL, Andrey), Moscow, Russia; DOB 25 Jul 1989; Gender Male (individual) [CYBER2] (Linked To: EVIL CORP).

SAFAROV, Azamat, Moscow, Russia; DOB 26 Mar 1990; POB Uzbekistan; Gender Male; National ID No. CE2236830 (Uzbekistan) (individual) [CYBER2] (Linked To: EVIL CORP).

SHEVCHUK, Tatiana, Moscow, Russia; DOB 08 Jan 1970; Gender Female; National ID No. BB299742 (Ukraine) (individual) [CYBER2] (Linked To: EVIL CORP).

SLOBODSKOY, Dmitriy Alekseyevich, Russia; DOB 28 Jul 1988; Gender Male; Passport 721007353 (Russia) (individual) [CYBER2] (Linked To: EVIL CORP).

SLOBODSKOY, Kirill Alekseyevich, Moscow, Russia; DOB 26 Feb 1987; POB Moscow, Russia; nationality Russia; Gender Male; Passport 721025114 (Russia); National ID No. 4508818947 (Russia) (individual) [CYBER2] (Linked To: EVIL CORP).

SMIRNOV, Dmitriy Konstantinovich, Moscow, Russia; DOB 10 Nov 1987; citizen Russia; Gender Male (individual) [CYBER2] (Linked To: EVIL CORP).

TUCHKOV, Ivan Dmitriyevich, Russia; DOB 27 Nov 1986; POB Moscow, Russia; Gender Male; Passport 45092006504 (Russia); alt. Passport 753931329 (Russia); VisaNumberID 525867504 (France) (individual) [CYBER2] (Linked To: EVIL CORP).

TURASHEV, Igor Olegovich (a.k.a. "ENKI"; a.k.a. "NINTUTU"), Russia; DOB 15 Jun 1981; Gender Male (individual) [CYBER2] (Linked To: EVIL CORP).

YAKUBETS, Artem Viktorovich, Moscow, Russia; DOB 17 Jan 1986; POB Polonnoye, Khmelnitskaya Oblast, Ukraine; citizen Russia; Gender Male (individual) [CYBER2] (Linked To: EVIL CORP).

YAKUBETS, Maksim Viktorovich (a.k.a. "AQUA"), Moscow, Russia; DOB 20 May 1987; POB Polonnoye, Khmelnitskaya Oblast, Ukraine; citizen Russia; Gender Male; Passport 4509135586 (Russia) (individual) [CYBER2] (Linked To: EVIL CORP; Linked To: FEDERAL SECURITY SERVICE).

ZAMULKO, Ruslan, Moscow, Russia; DOB 25 Jun 1970; POB Ukraine; Gender Male; National ID No. HB698865 (Ukraine) (individual) [CYBER2] (Linked To: EVIL CORP).

The following entities have been added to OFAC's SDN List:

BIZNES-STOLITSA, OOO (Cyrillic: ООО БИЗНЕС-СТОЛИЦА) (a.k.a. OBSHCHESTVO S OGRANICHENNOI OTVETSTVENNOSTYU BIZNES-STOLITSA), d. 14 korp. 1 pom. Khll/kom. 1, ul., Sokolovo-Meshcherskaya Moscow, Moscow 125466, Russia; D-U-N-S Number 50-722-4994; Tax ID No. 7733904024 (Russia); Government Gazette Number 40335667 (Russia); Registration Number 5147746417682 (Russia) [CYBER2] (Linked To: GUSEV, Denis Igorevich).

EVIL CORP (a.k.a. DRIDEX GANG), Moscow, Russia; Moldova [CYBER2].

OPTIMA, OOO (Cyrillic: ООО ОПТИМА) (a.k.a. OBSHCHESTVO S OGRANICHENNOI OTVETSTVENNOSTYU OPTIMA), d. 2 korp. 2 pom. 1, ul., Kominterna Moscow, Moscow 129344, Russia; D-U-N-S Number 50-579-8144; Tax ID No. 7716740680 (Russia); Government Gazette Number 17325717 (Russia); Registration Number 1137746232260 (Russia) [CYBER2] (Linked To: GUSEV, Denis Igorevich).

TREID-INVEST, OOO (Cyrillic: ООО ТРЕЙД-ИНВЕСТ) (a.k.a. OBSHCHESTVO S OGRANICHENNOI OTVETSTVENNOSTYU TREID-INVEST), 11/2, ul., Sadovaya-Chernogryazskaya Moscow, Moscow 105064, Russia; D-U-N-S Number 50-722-5114; Tax ID No. 7701416320 (Russia); Government Gazette Number 40214946 (Russia); Registration Number 5147746418782 (Russia) [CYBER2] (Linked To: GUSEV, Denis Igorevich).

TSAO, OOO (Cyrillic: ООО ЦАО) (a.k.a. OBSHCHESTVO S OGRANICHENNOI OTVETSTVENNOSTYU TSENTR AVTOOBSLUZHIVANIYA), 9, per., Omski Kurgan, Kurganskaya Oblast 640000, Russia; D-U-N-S Number 68-215-4722; Tax ID No. 4501122896 (Russia); Government Gazette Number 78739479 (Russia); Registration Number 1064501172394 (Russia) [CYBER2] (Linked To: GUSEV, Denis Igorevich).

VERTIKAL, OOO (Cyrillic: ООО ВЕРТИКАЛЬ) (a.k.a. OBSHCHESTVO S OGRANICHENNOI OTVETSTVENNOSTYU VERTIKAL), d. 102/1, ul. Beregovaya Kogalym, Khanty-Mansiski, Avtonomny Okrug – Yugra Okr. 628482, Russia; D-U-N-S Number 50-630-4726; Tax ID No. 8608056026 (Russia); Government Gazette Number 26149774 (Russia); Registration Number 1138608000189 (Russia) [CYBER2] (Linked To: GUSEV, Denis Igorevich).

YUNIKOM, OOO (Cyrillic: ООО ЮНИКОМ) (a.k.a. OBSHCHESTVO S OGRANICHENNOI OTVETSTVENNOSTYU YUNIKOM), d. 18, ul. Tsentralnaya Kogalym, Khanty-Mansiski, Avtonomny Okrug – Yugra Okr. 628483, Russia; D-U-N-S Number 68-321-9795; Tax ID No. 8608052180 (Russia); Government Gazette Number 97396163 (Russia); Registration Number 1068608008204 (Russia) [CYBER2] (Linked To: GUSEV, Denis Igorevich).

The following deletions have been made to OFAC's SDN List:

AMHAZ, Issam Mohamad (a.k.a. AMHAZ, 'Isam; a.k.a. AMHAZ, Issam Mohamed), Ghadir, 5th Floor, Safarat, Bir Hassan, Jenah, Lebanon; Issam Mohamad Amhaz Property, Ambassades (Safarate), Bir Hassan Area , Ghobeiri, Baabda, Lebanon; DOB 04 Mar 1967; POB Baalbek, Lebanon; nationality Lebanon; Additional Sanctions Information – Subject to Secondary Sanctions Pursuant to the Hizballah Financial Sanctions Regulations; Passport RL0000199 (Lebanon); Identification Number 61 Nabha; Chairman, Stars Group Holding; General Manager, Teleserveplus (individual) [SDGT].

AMHAZ, Issam Mohamed (a.k.a. AMHAZ, 'Isam; a.k.a. AMHAZ, Issam Mohamad), Ghadir, 5th Floor, Safarat, Bir Hassan, Jenah, Lebanon; Issam Mohamad Amhaz Property, Ambassades (Safarate), Bir Hassan Area , Ghobeiri, Baabda, Lebanon; DOB 04 Mar 1967; POB Baalbek, Lebanon; nationality Lebanon; Additional Sanctions Information – Subject to Secondary Sanctions Pursuant to the Hizballah Financial Sanctions Regulations; Passport RL0000199 (Lebanon); Identification Number 61 Nabha; Chairman, Stars Group Holding; General Manager, Teleserveplus (individual) [SDGT].

AMHAZ, 'Isam (a.k.a. AMHAZ, Issam Mohamad; a.k.a. AMHAZ, Issam Mohamed), Ghadir, 5th Floor, Safarat, Bir Hassan, Jenah, Lebanon; Issam Mohamad Amhaz Property, Ambassades (Safarate), Bir Hassan Area , Ghobeiri, Baabda, Lebanon; DOB 04 Mar 1967; POB Baalbek, Lebanon; nationality Lebanon; Additional Sanctions Information – Subject to Secondary Sanctions Pursuant to the Hizballah Financial Sanctions Regulations; Passport RL0000199 (Lebanon); Identification Number 61 Nabha; Chairman, Stars Group Holding; General Manager, Teleserveplus (individual) [SDGT].

Last Updated: 12/5/2019 9:44 AM