UK sanctions cyber-crime gang it says Russia charged with attacking NATO

LONDON (Reuters) -Britain said on Tuesday it had sanctioned 16 members of the Russian cyber-crime gang Evil Corp, a group it said had been tasked by Russia to conduct operations against NATO allies.

Evil Corp was once believed to be the most significant cyber-crime threat in the world, Britain’s National Crime Agency (NCA) said after taking coordinated action with officials in the United States and Australia.

“Today’s sanctions send a clear message to the Kremlin that we will not tolerate Russian cyber-attacks – whether from the state itself or from its cyber-criminal ecosystem,” foreign minister David Lammy said in a statement.

In 2019, the U.S. indicted and sanctioned Evil Corp’s alleged leader, the Lamborghini-driving Maksim Yakubets, and put a $5 million bounty out for information leading to his arrest.

In its latest disclosure, the NCA said the group had been tasked by Russian intelligence services to conduct cyber-attacks and espionage operations against NATO allies, although it gave no further details.

Yakubets, it said, had worked with Russia’s Federal Security Service (FSB), Foreign Intelligence Service (SVR) and military intelligence unit GRU.

His father-in-law, Eduard Benderskiy, a former high-ranking official of the FSB, was also an enabler of Evil Corp’s activities and helped protect the group after the U.S. action in 2019, the NCA said.

The British agency said Evil Corp also had close connections with the ransomware group LockBit, which had targeted the Industrial and Commercial Bank of China, Boeing and Britain’s Royal Mail among others, and which Western law enforcement agencies disrupted earlier this year.

Yakubets’ right-hand man Aleksandr Ryzhenkov had been identified as a LockBit affiliate and was involved in ransomware attacks against numerous organisations, the NCA said.

“The action announced today has taken place in conjunction with extensive and complex investigations by the NCA into two of the most harmful cyber-crime groups of all time,” said James Babbage, Director General for Threats at the NCA.

Britain said among those targeted in its new sanctions, which included asset freezes and travel bans, were Yakubets, Artem Viktorovich Yakubets and Viktor Grigoryevich Yakubets.

In a separate announcement, the U.S. justice department said it had indicted Ryzhenkov for deploying a strain of ransomware known as BitPaymer to attack numerous victims in Texas and throughout the country.

“Today’s charges against Ryzhenkov detail how he and his conspirators stole the sensitive data of innocent Americans and then demanded ransom,” said Deputy Attorney General Lisa Monaco.

“With law enforcement partners here and around the world, we will continue to put victims first and show these criminals that, in the end, they will be the ones paying for their crimes.”

(Reporting by Michael Holden; Additional reporting by Catarina Demony; Editing by Alistair Smout and Mark Potter)