US puts $5 million bounty on Russian hacking group Evil Corp. leader

The US and UK announced charges Thursday against the Russian hacking group Evil Corp., alleging that the organization was behind "two of the worst computer hacking and bank fraud schemes of the past decade." 

The international hacking schemes started in May 2009 and are ongoing, according to US Department of Justice and the United Kingdom's National Crime Agency. The two governments announced the charges of conspiracy, computer hacking, wire fraud and bank fraud against Maksim Yakubets, Evil Corp.'s alleged leader, and Igor Turashev, an alleged hacker associated with the group. Both are Russian citizens, and US officials allege that Yakubets has worked with the Russian government on other cyberattacks. 

Along with the charges, the US State Department and the FBI announced a $5 million reward for any information leading to Yakubets' arrest -- the largest reward ever offered for a cybercriminal. 

"Maksim Yakubets allegedly has engaged in a decade-long cybercrime spree that deployed two of the most damaging pieces of financial malware ever used and resulted in tens of millions of dollars of losses to victims worldwide," Assistant Attorney General Brian Benczkowski said in a statement.

Evil Corp. is accused of creating the banking malware Dridex, sometimes known as Bugat or Cridex. The malware was designed to automatically steal financial and personal information on computers it infected, specifically targeting online banking credentials. 

Dridex later evolved to include ransomware -- malware that encrypts crucial files and holds computers hostage until victims pay the hacker. The malware would infect computers by tricking victims into clicking links in emails or a fake online banking page, according to the indictment. 

The hack hit several businesses, including two banks, four companies involved in petroleum, a building materials supply company, a firearm manufacturer and a school district, according to court documents. 

"These cybercriminals targeted individuals and companies in western Pennsylvania and across the globe in one of the most widespread malware campaigns we have ever encountered," US Attorney for the western district of Pennsylvania Scott Brady said in a statement. 

Prosecutors are also charging Yakubets for his alleged role in the Zeus malware, a hacking campaign that started in May 2009 and allegedly stole millions of dollars from bank accounts. The alleged hackers infected thousands of computers and stole passwords and account numbers, which they used to log into banking accounts, according to the indictment. 

The hack hit 21 municipalities, banks and nonprofit organizations in 11 states. The malware attempted to steal $220 million from its victims, and successfully stole $70 million from people's bank accounts. 

"Yakubets and his associates have allegedly been responsible for losses and attempted losses totaling hundreds of millions of dollars," Rob Jones, director of the United Kingdom's National Crime Agency, said in a statement. "This is not a victimless crime, those losses were once people's life savings, now emptied from their bank accounts." 

You can read the indictment here: