"Eduard Benderskiy (Benderskiy), a former Spetnaz officer of the Russian Federal Security Service (FSB), which is designated under numerous OFAC sanctions authorities, current Russian businessman, and the father-in-law of Evil Corp's leader Maksim Viktorovich Yakubets (Maksim), has been a key enabler of Evil Corp's relationship with the Russian state," alleges the U.S. Department of the Treasury announcement. The Evil Corp cybercrime syndicate has been hit with new sanctions by the United States, United Kingdom, and Australia, with the US also indicting one of its members for conducting BitPaymer ransomware attacks. The United States also unsealed an indictment today against suspected Evil Corp member Aleksandr Ryzhenkov for conducting ransomware attacks on multiple victims in the US. In 2019, the United States sanctioned seventeen individuals and seven entities linked to the Evil Corp gang, including the group's leader, Maksim Yakubets. "Benderskiy was a key enabler of their relationship with the Russian Intelligence Services who, prior to 2019, tasked Evil Corp to conduct cyber attacks and espionage operations against NATO allies," alleges a joint NCA announcement. This also means that organizations that suffer ransomware attacks by Evil Corp will no longer be able to make ransom payments without approval by OFAC or risk facing sanction violations. Evil Corp is a cybercrime syndicate known for creating and distributing the Dridex banking Trojan and various ransomware families used in attacks worldwide. In 2019, Evil Corp split, with some members creating a new ransomware operation known as DoppelPaymer, which shared much of the same code as BitPaymer. BitPaymer is the first ransomware encryptor created by Evil Corp, which they began using in attacks in 2017. Evil Corp deployed new ransomware variants under different names to evade US sanctions, such as WastedLocker, Hades, Phoenix CryptoLocker, PayLoadBin, and Macaw. After the US charged members of the Evil Corp for stealing over $100 million, it added the gang's leader, Maksim Yakubets, and other members of the cybercrime gang to the Office of Foreign Assets Control (OFAC) sanction list. Due to these sanctions, many ransomware negotiation firms refused to conduct payments with Evil Corp operations due to the risks of violating sanctions. The two sanctioned entities are Vympel-Assistance LLC and Solar-Invest LLC, which are owned by Benderskiy, the reported father-in-law of Evil Corp's leader Maksim Yakubets. In a trilateral action, the UK and Australia are also sanctioning some of the Evil Corp suspects designated by OFAC today or in its 2019 sanctions.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Tue, 01 Oct 2024 16:31:25 +0000