Evil Corp: 6. Fatherland

This BBC podcast is supported by ads outside the UK. I'm Martha Stewart, and I believe the best gifts aren't just beautiful. They're useful every single day. Lennox has brought timeless beauty and lasting quality to our tables for generations. And their Lennox Spice Village is the perfect holiday gift for someone you love or for yourself. It's more than a spice rack.

It's a charming collection of hand-painted houses that turn ordinary spices into extraordinary experiences. Imagine cinnamon from a tiny Victorian cottage. or oregano from a pastel townhouse, suddenly a simple meal becomes a moment to savor. Because spices can be more than ingredients. They can inspire memories, warmth, and joy all year long. Give a gift that lasts beyond the holidays. Discover the collection at lennox.com slash spicevillage.

I'm Martha Stewart, and I believe the best gifts are not only beautiful, but useful every single day. And Lenox has brought timeless beauty and lasting quality to our tables for generations. and their Lenox Spice Village is the perfect holiday gift for someone you love or for yourself. Spice Village transforms everyday spices into inspired memories filled with warmth and joy all year long. Give a gift that lasts beyond the holidays. Discover the collection at Lennox.com slash Spice Village.

Before we begin our special extended sixth and final episode of Cyberhack Evilcore, we have some exciting news. Cyberhack will return in 2026 with a brand new season. Yes, season four. Keep listening at the end of this episode for a first chance to hear our Season 4 trailer. He's rifling through his PDF about Evilcore. Yeah, my PDF of Evilcore.

Peering into his notes, the head of cyber intelligence at the UK National Crime Agency, the country's top force against serious and organised crime. In his 15-year career, one name keeps popping up. What is it about Evil Corp that has been such a mission for the NCAA and for you? They have been a really consistent and persistent threat. This is Will Line. They've always been on our radar.

because they cause such harm to victims across the UK and around the world. And at the centre of it all, the man line says runs evil core. Maxim Jakubiec.

Jakubets has been on our radar for a really long time. Will and I look at videos and images of Maxim Jakubets. They appear to be from around a decade ago. He looks to be in his late 20s, maybe early 30s. In one, a neon-camouflaged Lamborghini is pulling donuts in Moscow.

I think it's Yakovits and some of his friends, frankly, just like messing about in Moscow. At one point, they get stopped and questioned by a police officer, don't they? Doesn't really look like he cares. Yeah, it didn't really look like he was really worried about getting arrested or getting a ticket or anything like that. For Will Line, it's clear back then that Maxime Jacobietz wasn't bothered about trying to keep a low profile. We're looking at a picture now of him driving a Ferrari.

I've seen this picture. Someone sent me this picture a couple of years ago. And it looks to me like he's perhaps being followed by a security team. Is that your reading of that picture? Or am I reading too much into it? He's getting followed by like a, you know, black. Yeah. Mercedes van, isn't he? Exactly, yeah. The money that he's got and the bounty on his head could perhaps warrant personal security. A $5 million US government bounty, remember?

Yeah, there's money and notoriety that he has living in Russia. I can see how some people may think that. Yeah, certainly. Willein is happy to talk about his work, but he's still careful about what he says. Here's a senior British official talking in detail about the hunt for Maxime Jakubets and Evil Corps for the first time.

These pictures we're looking at, they're part of a strategy. Officials aren't just trying to take out Maxim Jakubets' computers. They say the goal now is to make life harder for him, personally. The people behind the keyboard are the threat. They are the ones that we need to aim to try to disrupt in some way, shape or form. And that's a huge challenge given where these individuals live and the way that they operate.

But since he became one of the FBI's most wanted, Maxim Jakubetz has been less keen to show off his wealth online. In fact, he's become something of a ghost. That's not to say that investigators like Will have lost track of him entirely. They've turned to another source as they try to keep tabs on Jakubets and his crew. Wagons became a thing.

wagent wagent that's a new one wives and girlfriends intelligence okay so the individuals in evil core had pretty good operational security so weren't putting pictures on social media places that we might be able to find them and uncover what they're doing but their wives and girlfriends did seem to enjoy documenting virtually every facet of their life in what they did.

And we realised that there's lots of familial connections within the Evil Core group. They went to each other's big life events like birthday parties and the births of the kids and they lived a really lavish lifestyle. is what we quickly recognized we had the flash cars the number plate that reads thief in russian uh yeah for the team really interesting i think kind of like getting to

understand and build a picture of the people that are behind the keyboard and that recognition that money can buy you lots of things but not perhaps taste. Taste aside, the real sting is in his notes. That PDF document in front of him.

It shifts our story from keyboards and cash to the corridors of power. We went the furthest I think we've ever been in terms of describing some of the relationship with the Russian intelligence services for the evil core group within that document. and the kind of tasking relationship that existed between elements of the Russian intelligence services and Yakubitsyn Co. This is CyberHack EvilCore.

This series has never just been about cybercrime. It's about something potentially more dangerous. A question that Western intelligence agencies can't ignore. Is Evil Corp just a gang or a weapon? of the Russian state. I'm Joe Tidy. And I'm Sarah Rainsford. Episode 6, Fatherland.

Good morning. Thank you all for being here. We're here today to identify and announce charges against a Russian national whom the Department of Justice alleges is responsible for two of the worst computer hacking. and bank fraud schemes of the past decade. December 5, 2019. Ten years after Jabezus first rolled through the US. American and British officials stand up and publicly say the name they've been talking about in private for years.

Maxim Yakubets of Moscow, Russia. Maxim Yakubets. Maxim Yakubets. Yakubets, also known as Aqua, and his co-conspirators have operated. and improve multiple malware variants to go after as many victims as possible. They allege that there are at least 300 victim organisations in 43 different countries. with losses reaching more than $100 million. The NCAA's World Line was in the room that day and helped orchestrate the announcement.

Delivering this type of operational activity is really complex. Loads of different elements of this have to come together at the right moment. It all needs to be synced up and coordinated. By this point, the FBI and British investigators had known Maxim Yakubyat's name for almost a decade after Russia's Federal Security Service, the FSB, first confirmed his name. based on information the FBI had gleaned from the Jabezus chat.

So why didn't you say it then, if you've had that name for so long? It's the level of confidence that we have. So we can make an attribution, but building the level of confidence that you need, particularly for our US partners, to get to the point where you think that beyond reasonable doubt you're going to be able to prove that, and that attribution is right.

is a really long, difficult process for us often. One of the indictments unsealed that day by the US District Court had the final piece of evidence that convinced the authorities they could go public. had already tied Aqua to Maxim through an email address used to buy a pram online. The indictment alleges that in 2018, a Russian woman applying for a US visa listed her ex-husband as Maxim Yakubets.

It also listed her home address, the same one where that baby pram had been delivered. It goes on to say she was travelling with a child whose father was Maxime Jakubiec. And that child's birthday matched what the FBI had seen in the Jabezus chat log between Aqua and Tank back in 2009. So what's going on over there? She's giving birth. I will write later.

Okay, new dad. Now that officials are able to say Maxim Jakobets publicly, his name becomes a tool that Western officials can use against him. Having your name, your face... or your description on a wanted poster makes moving around freely much more difficult. We know that's true from his old buddy Tank, or Vyacheslav Pencikov, who's now in prison in Colorado.

Simply naming them in an indictment accomplishes a great deal. State sponsors and other clients prize hackers for their anonymity, deniability, and their stealth. Calling these actors out publicly through these indictments strips away that anonymity. Will Lyon says every word coming off that stage was carefully scripted. Your messaging...

The public and you're messaging potentially the threat actors and you're messaging policymakers and all that type of thing. There's also another message to Moscow in all of this. First, officials call cybercrime a national security threat.

Then came something bigger. As of 2017, Yakubets was working for the Russian FSB, one of Russia's leading intelligence organizations. This was jaw-dropping. For years, it had been rumored in cybersecurity circles. But now the claim was official in a statement from the US Treasury released that same day. Yakubets was tasked to work on projects for the Russian state.

to include acquiring confidential documents through cyber-enabled means and conducting cyber-enabled operations on its behalf. That's huge. It's not just about money anymore. The US Treasury is saying he's working for the FSB, Russian Domestic Intelligence. But what kind of projects or operations? Well, we don't know. When I asked Will Line from the UK's NCA...

he wasn't willing to share details. So those confidential documents that we heard about could be corporate, government or military. The statement doesn't say. What it does say is this, from the American perspective. Maxime Jakubets has crossed a line from alleged cybercriminal to alleged state-sponsored hacker. And they allege that the line was crossed in 2017.

A year that suddenly becomes a turning point in his story. In 2017, he'd just turned 30. And while the Americans say he was beginning work for the FSB... He was also marrying his second wife at that lavish ceremony we told you about at the start of the series. The one at the golf course north of Moscow that cost a quarter of a million dollars to rent.

The one with a pavilion decked out like an imperial palace. The one where the staff all had to sign NDAs. And two years later, when the US unveils the indictments against Maxime. It also places him and his closest wedding guests on a sanctions list for their alleged roles in Evil Cor. Among them, his brother Artem and two cousins.

Sanctions can freeze assets and block international business. It's a sort of financial chokehold. Looking at a picture now of Jacobet sort of lying down in the back of what looks like a stretch limbo or something. half asleep, and then someone else sort of mugging off to the camera. Who's that? That's Kjul Wodskoy, Maxim Jakovic's cousin. One of Evil Call? Yeah. What was his role?

A mixture of kind of like hacking, like technical activity and involved in some of the moving of funds and money laundering type activity for the Evil Core Group. Some of Maxime's other relatives on the sanctions list. cousin Dimitri and big brother Artem, were named as having allegedly, quote, logistical, technical and financial functions within EvilCore.

When someone hears about a case like this very often, the first response is, well, there's nothing you can really do about these. Today, we're here to demonstrate that we can and will. So, on this December day in 2019, Maxim Jakobets is named and indicted by US authorities for his alleged roles in the Jabba Zeus campaign and in leading the Drydex campaign we talked about last time. Also that day...

Any US assets he has are frozen and travel is suddenly much harder. He's now on a watch list and could be arrested if he was to travel abroad. And Western authorities have publicly signalled to Moscow.

They believe he works for the FSB. Probably not a good day in the Jakubets camp. But for all the claims of disrupting Evil Corps, did it really make a difference? Understanding your impact when you deliver these type of operations is really challenging. It's really hard. It is about undermining trust and confidence within EvilCore as a group for their standing within that cybercrime ecosystem.

And it absolutely is about signalling and messaging to the public that we are taking this seriously and that they may better be able to protect themselves and enhance resilience in that way. I pressed Will more on this. He said that that moment did mark a change in the kinds of attacks they were seeing, including from Drydex, one of the tools Evil Corp is said to have used to spread devastating yet lucrative ransomware.

that Drydex operation was successful. So when you look at what happened, Drydex disappeared at that point and lots of the group have laid pretty low for quite an extended period of time. So yeah, I think it was an impactful investigation and it was, I think, the start of a new way of us trying to deliver.

outcomes against threat actors that reside in jurisdictions that are challenging for us to deliver traditional criminal justice outcomes synonymous for law enforcement and the NCA. Traditional criminal justice outcomes, like arrest and conviction.

Yeah, I think that's police speak. You're exactly right. This could perhaps have all been over years ago if Russian investigators acted on their own intel. But for some reason, that never happened. Here's what I take away from that story. I think back in the Jabezuse days, Maxine probably wasn't working for the FSB. Otherwise, it's hard to see why the Russians would have shared his name and that stuff about the pram in the apartment with the FBI.

But by 2017, the Americans claim he definitely is providing what they call direct assistance to the Russian government. In fact, they say that as of April 2018, Yakubets was in the process of getting a licence to work with Russian classified information from the FSB. Who knew that was a thing? We did write to the press office for the Russian embassy in London to ask if the Russian government...

or its intelligence agencies, had ever employed, consulted, or engaged Maxim Jacobetz in any way, but they didn't reply. So, did the Kremlin... Push back in 2019 when Maxime was first named by US authorities? Kind of. It didn't touch the FSB allegation, though. It focused on the criminal indictments.

Vladimir Putin's spokesman said Russia didn't like its citizens being tried in foreign courts. He then claimed Russia was always ready to cooperate with the US in fighting cybercrime, but said its offers were ignored. To put that in context, though, Russia routinely offers to investigate incidents where it is the chief suspect. Everything from poisonings to alleged war crimes. Of course, nothing ever comes of it.

It is trolling on a state level. After US authorities went public and unsealed the indictments against Jacobetz, Will Line of the UK's NCA says Maxime and Evilcore went dark for at least six months. But they were by no means gone forever. Signs they were active started to pop up again.

In fact, they seem to be more ambitious than ever. And what did you learn about Evil Corridor in that period? They were going out and specifically looking for victims where they may be able to extort the biggest ransom possible. This was the strategic leap forward the FBI's Keith Malarsky told us about. Maxine, he said, took ransomware to the next level, so-called big game hunting. Will Lyne says that following the sanctions and indictments...

Evilcore began using a new piece of ransomware called Phoenix Locker to huge effect. You don't need to know the details of how it works, but you do need to know what it could do. There was a Phoenix Locker ransomware attack in 2021 that led to, we think, a $40 million payment to EvilCore. At the time, we think that that was probably the biggest ransomware payment that had ever been made.

$40 million. Even in today's cybercrime standards, that is a huge haul. By the standards of the day, though, astronomical. Did he name the company? No, of course not. He said he wouldn't name victims to protect their privacy, even though I asked. But at the time, it was reported to be a giant American insurance firm called CNA Financial. We tried to talk to them about the attack. So what did they say?

A very firm no comment. Still, $40 million in one heist. If it was Evil Corp, it's quite the response to those indictments. It seems to show they didn't care.

Yeah, but the group wasn't entirely unruffled. I'm looking for Maxim Jakubets. I'm from the BBC. There is no Maxim Yakubets here. He hasn't been here for 15 years. Just a second. In 2021, I was in Moscow on my own mission to find Maxim Yakubets. And I ended up at his dad's front door. Look, Maxim is not here. I'm his father. So where was this place? Am I fancy?

Well, it was an apartment on the outskirts of Moscow. We went there at night, I remember, after a long and fruitless day of knocking on other doors around the city that we had linked to Yakubets and Co. This was one of the last addresses on our list, a bit of a last chance. I remember it was a block with a tall fence all around the building and they had automatic security gates and an empty security guard room in the lobby with CCTV feeds of the block. We walked in and got the lift up.

I was there with a colleague from the BBC's Russian service. Maxim's father, Victor, answered the door. We are making a BBC documentary about sanctions and indictments. from the US against Russian hackers. I've seen your film of that encounter. I remember his clean-shaven head and his shiny chain. That's him. He was pretty angry as well. I'll never forget his right eye was twitching rapidly as he started ranting about the American and British allegations against his son.

He said the $5 million bounty for his son's arrest had led him and his family to live in fear of attack from people looking to shake them down. Kind of like what Tank claimed happened to him. When you're labelled most wanted by the FBI, then people realise you might be sitting on a load of money and they want a piece of the pie. But when I met him, Jacobet Sr. was adamant his son Maxime was not a cybercriminal. So you're telling me that your son...

is not a criminal and he's not rich. So in this bit, he's telling you that his son is completely average. Then he says he's actually above average because he does earn money, he calls it a wage, and he can allow himself some things. But a Lamborghini? Well, Victor denied that Maxime owned a Lamborghini. He said that they could be rented. He also said... So here he's telling you to show him the document where it says clearly this Lamborghini belongs to Maxim Jakubiec.

Yeah, we never found that particular document. But we did find one later, registered in his second wife's name, and a Mercedes, and a Porsche, and a Mitsubishi. So what did Maxim's dad say he did for work exactly? He refused to say. He said it would only lead to Maxime being persecuted. I asked to talk to Maxime, but he claimed to me that he's had no contact with him for years.

That doesn't sit right with what we've heard about Evil Corps being a close-knit family group. That was late 2021. I spent 10 days in Moscow and other cities in Russia chasing Maxim Yakubets and other Evil Corps accused. We tried addresses where companies associated with them are located. We called countless phone numbers as well. Finally, I got this. A number of a company owned by someone indicted alongside Maxime as a senior figure in Evilcore.

a man called Igor Turashev. Hello, I'm looking to find Igor Turashev. Well, that was quick. You don't really need to speak Russian to get what happened there. Yeah, my Russian colleague explained we were from the BBC and wanted to talk to Igor Turashev. And then the person... We don't know who it was, of course. Hung up. Though it seems Will Lyne from the UK's National Crime Agency was quite impressed you got to speak to Maxime's dad. I think we were...

Probably quite surprised the BBC went to Russia to talk to him and you were able to track him down. I think the fact that he kind of stonewalled you a little bit and was like, you know, you've got nothing to do with this. I think it's probably what we would have expected, actually.

Jacobetz's father, he mentioned without any prompting that the bounty had put them at risk. He said it's not safe enough for us now because they're worried about the bounty. When you hear something like that as a law enforcement officer who's... trying to stop these guys? Does that make you feel pleased that you are adding an element of difficulty to their lives?

When we're designing these operations in general, we're really thoughtful around the type of outcomes that we want to deliver. Of course, we don't want people to be put in harm's way. We don't want people's families to be at risk. You want them to look over their shoulders though, don't you? We want them to recognise that we won't give up in our pursuit of delivering justice for their thousands of victims and all the enormous amounts of harm that they've caused all around the world.

It's not just the financial harm, it's the psychological toll. You see ransomware attacks on the healthcare sector, you see ransomware attacks on... public sector organisations and their inability to deliver services to the public. You know, this is really serious harm that's being caused. And I think I draw back and look upon that. And so, yeah, I definitely don't buy the story that he's innocent. business person who's rented a Lamborghini. So shall we recap?

In late 2019, British investigators joined their US counterparts and they signalled to Russia that they believe Maxime Yakubets was doing jobs for the FSB. Will Lyon says Maxime laid low for six months after that. But he also alleges then that in 2021, Evil Corp came raging back with that $40 million heist, what was then the biggest ransomware attack in history. So much for naming and shaming.

In fact, that year, the US Department of Justice called Maxime Jacobietz the top cyber criminal in the world. That might have stroked his ego, but the timing wasn't great, because cybercrime was about to hit the headlines. in a massive way. No guess. It's May 2021. Commuters along America's east coast are met with a nasty surprise. No guess.

People are holding up their cameras as they go past pumps. No gas. Thousands of stations are out of gas. It is affecting 50 million Americans. So there's no gas. Nobody has gas. People have been going out of their minds. Scrambling to get gas and driving miles and miles just to find gas. There's no gas because the company that runs the main pipeline on the eastern seaboard, Colonial, has been hit by a ransomware attack.

Its boss, Joseph Blount Jr., admits... We had cyber defences in place, but the unfortunate reality is that those defences were compromised. The company was locked out of its IT systems. More than 5,000 miles of pipeline were down. For days, they tried to get it going. It was an all-hands-on-deck situation. But finally, he says, in the name of the national interest...

Colonial paid a $4.4 million ransom to get its computers back. Considering the consequences of potentially not bringing the pipeline back on as quickly as I possibly could... I chose the option to make the ransom payment in order to get all the tools necessary to bring the pipeline on as quick as we possibly could, safely as well as securely. Messing with people's cars crosses a line in the US.

It shakes the foundations of everyday life. And it rattles those at the top too. The US government declared a state of emergency. Russia was blamed almost immediately. President Biden himself weighed in. We do not believe the Russian government was involved in this attack. But we do have strong reason to believe that the criminals who did the attack are living in Russia. That's where it came from.

A Russian government attack could have been considered an act of war. A Russian criminal attack falls below that threshold, hence President Biden's distinction. Some cybersecurity experts, though, I think the line between the two is blurry. The FBI quickly named the group behind the attack, Darkside. There was no suggestion Evil Cor or Maxime Jacobietz were involved.

But it still had deep ramifications for EvilCore. This was just one of several high-profile ransomware attacks on American companies and government institutions in 2021, and many were traced back to Russia. ransomware went from kind of like a niche cybercrime problem to a really significant national security threat in a pretty short period of time. In June 2021, a month after the Colonial Pipeline attack,

I traveled to Geneva to cover the first summit between the US and Russian presidents. By that point, relations were dire. The US had accused Russia of election interference. Russian troops were massing near Ukraine. Biden had just agreed with an interviewer's comment that Putin was a killer. Both countries had expelled diplomats. I was watching it closely too. Cyber attacks were high on the American agenda.

Beyond the Colonial Pipeline hack, there was the SolarWinds attack, which the FBI said was likely Russian. It infiltrated thousands of organisations, including US government agencies. The two leaders met at a handsome 18th-century manor house overlooking Lake Geneva. Vladimir Putin arrived first and then Joe Biden rolled up with his entourage. They shook hands, then went inside for pictures.

Mostly stony-faced. So expectations were low? You could say that. They talked for five hours. But afterwards, they each spoke separately to the press. The White House wouldn't share the podium with Putin. Putin went first. He repeated what his spokesman had said after Maxim Jakubiec had been named two years earlier.

that Russia is open to cooperating on cybercrime. Then he claimed that most cyberhacks originated from the US and that the Americans had not responded to several Russian requests for help. More trolling? More trolling. Then it was Biden's turn. The bottom line is I told President Putin that we need to have some basic rules of the road that we can all abide by. Certain critical infrastructure should be off limits to attack, period.

I remember this. He said he gave the Russians a list of 16 areas of critical infrastructure that they shouldn't attack, including the fuel network. Yeah, and he raised the colonial pipeline attack specifically. I looked at him, I said, how would you feel if ransomware took on the pipelines from your oil fields? He said, it would matter. I pointed out to him, we have significant cyber capability.

And if in fact they violate his basic norms, we will respond. Cyberman. He knows. It was clearly a warning. But would Russia take him seriously? The question for me was where that left Maxim Jacobetz and Evil Corp. The Americans were alleging he was the world's top cyber criminal after all. If Maxim did have links to the FSB, as American and British investigators allege... Then now might be the time for him to check they had his back.

While holiday shopping is almost always fun, credit can be confusing. Download the MyFICO app now and shop with confidence, knowing that you can stay on top of your credit 24-7. Get your FICO score straight from the people that created it. Plus free credit monitoring and a free credit report every month. No credit card required. FICO scores are used by over 90% of lenders. So trust the MyFICO app to keep you in the know.

Visit MyFICO.com slash free or download the MyFICO app today. The holidays are about giving something truly special. I'm Martha Stewart, and I believe the best gifts aren't just beautiful. They're useful every single day. Lenox has brought timeless beauty and lasting quality to our tables for generations. And their Lenox Spice Village is the perfect holiday gift for someone you love or for yourself.

It's more than a spice rack. It's a charming collection of hand-painted houses that turn ordinary spices into extraordinary experiences. Imagine cinnamon from a tiny Victorian cottage. or oregano from a pastel townhouse, suddenly a simple meal becomes a moment to savor. Because spices can be more than ingredients. They can inspire memories, warmth, and joy all year long. Give a gift that lasts beyond the holidays. Discover the collection at lennox.com slash spicevillage.

In the wake of the presidential summit between Joe Biden and Vladimir Putin, American anger over the wave of ransomware attacks didn't die down. Since the Jabezus days, it was Americans running small businesses across the country that had been suffering at the hands of cyber criminals. Easy targets left out of pocket. But the colonial pipeline attack was a flashpoint. The moment when the scale of the ransomware threat became impossible to ignore.

I find myself increasingly in front of communities, often in rural communities, where I'm there to talk about something very different. United States Senator Elisa Slotkin from Michigan. And the first question they asked me from farmers to school teachers and... superintendents is, what are we doing to protect ourselves from this onslaught of attacks? It's November 2021.

five months after Putin and Biden had met in Geneva. I had a big group of superintendents in my office yesterday, and every single one of them had had ransomware attacks, and many had paid the ransom to get the school data back. Senator Slotkin is part of a Homeland Security Committee looking for answers from the White House Cybersecurity Director, Chris Inglis.

Since the summit between the president and Putin and the president laying down that marker, have we seen attacks from Russian-based groups, particularly those groups that were responsible for some of our biggest disruptions? Have you seen a decrease, an increase, or no change in their level of attempts to attack us?

answering the question head on, we have seen a discernible decrease. It's too soon to tell whether that is because of the material efforts undertaken by the Russians or the Russian leadership. It may well be that the transgressors in this space have simply kind of lain low, understanding that this is for the moment a very hot time for them. How hot?

In Moscow, the business newspaper Comissants suggested that the temperature had spiked. A week after that hearing, it reported that American and Russian cyber officials were swapping intelligence. and that a blow had been struck against Evil Corp and other alleged cybercrime groups. What that blow looked like, Commissante didn't say. Tank, the former Jabba Zeus boss we interviewed in prison,

mentioned this period of time. He said Russian officials did arrest a number of people after the summit, people said to be cybercriminals, but one of his Russian criminal contacts told him, It's all for TV. It's all bullshit.

So was Maxim Jakubiec once again laying low? Will Line, the head of cyber intelligence at Britain's National Crime Agency, says if he was, it wasn't for long. In 2022, we tracked some Evilcore ransomware ransom payments to a laundering network that was operating in South Korea.

So we worked with the authorities there to arrest and actually gain a prosecution on an individual who was involved in laundering Evil Corp funds out of South Korea. I was shocked when he told me this. This South Korean connection to Evil Corp. has never been reported. We're constantly learning how far the group's alleged operations spread. So, Maxim Yakubiet seems to have survived whatever kind of crackdown might have happened, or not, in Russia.

following the Putin-Biden summit. But Will Line says Maxim Yakubiec was still squarely on his radar and he'd come across new intelligence that would allow a repeat of the name and shame operation of 2019. I remember joking with someone in the office, it might take five years to have another Operation Against Evil Call Group, and it actually ended up being just less than five years. In 2024, the NCAA released a dossier.

That was the document that Will was rifling through at the start of this episode. It's called Evil Corps Behind the Screens. It collates a lot of information that's already publicly known. But it does also add some new explosive claims. We went the furthest I think we've ever been in terms of describing some of the relationship with the Russian intelligence services for the evil core group within that document.

and the kind of tasking relationship that existed between elements of the Russian intelligence services and Yakovitsyn co. The standout paragraph reads like this. Evil Corp held a privileged position and the relationship between the Russian state and this cyber criminal group went far beyond the typical state criminal relationship of protection, payoffs and racketeering.

In fact, the document says, prior to 2019, Evil Corp were tasked by Russian intelligence services to conduct cyber attacks and espionage operations against NATO allies. How do you know that? So we know that through the course of our investigation, we've uncovered those links and uncovered that specific piece of information that's led us to draw that conclusion in the paper. Is that a message that you've seen?

Or a trail of activity. We can't go into the specific methods or techniques that we've used to uncover that connection. But yeah, we have high confidence that it exists there. But you use the term high confidence, which I know from my years of cyber reporting.

That means you're pretty certain this is the case because otherwise you would say medium confidence or low confidence. So are you telling us that what's written in your report, there is a direct link and there is previous tasking? That's true, 100%.

High confidence means exactly that, really. We have high confidence that that tasking took place and that that relationship was in place in that time period. And that is a relationship that we don't see in many other countries around the world, is it? Where cyber criminals who are out to make money... have a relationship with the state whereby the state leans on them for certain operations. We don't see that in many countries, do we?

No, we don't. And that's why I think this is pretty atypical, actually. Even for elite Russian cybercrime groups, this is quite an unusual relationship that the evil core group enjoy, that privileged position with the Russian intelligence services. So, the plain English summary. The NCA believes Maxim Yakubiec was a cybercriminal who became a Russian state agent using Evil Corps to attack NATO countries. I did press Will on what else he could tell us about that.

But he wouldn't bite. That is literally as much as we're going to be able to say. He did try. But that allegation wasn't the only new twist in the NCA's dossier. It also extended the sanctions to include Maxim's family. Maxim, his brother, and two cousins were already subjects to travel bans and asset freezes. But now his father, Viktor, the man I met in Moscow... and his father-in-law were added to the list.

we think was involved in some of the money movements and money laundering associated to the all-gotten gains that the evil call group generated over the years. So very much, I think, on the financial side. Do you imagine that in the early days of... Jacobetz's cybercriminality, he would have turned to his father and said, I've got this money coming in, what do I do with it? Is that how you envisaged him being pulled into the cybercriminality?

Yeah, good question. I don't know actually how he would have become involved in it, but the cybercriminal activity in their personal and professional lives are so intertwined. I think the family business kind of became running big cyber criminal operations and he was a part of that. The NCA dossier says Maxim's dad, Victor Jakubiec. had significant historical ties to money laundering. Will Lyon wouldn't say anything else about that, but it is intriguing.

Viktor was born in 1964, so he was 27 when the Soviet Union collapsed. That was followed by a decade of gangster capitalism, organised crime and massive corruption. So how did Viktor fit in? I've been kicked out of Russia, accused of being a national security threat, so I can't go there and check it out. But Viktor was living in Ukraine when Maxim and his brother Artem were born.

And to understand how this family allegedly came to sit on top of a global cybercrime gang, we should start where they started. Polone. That's where the boys were born in the late 80s, in western Ukraine. The town used to have a famous porcelain factory, but it's long gone. When I went there earlier this year, it felt like the kind of place you'd just pass through without noticing. There's around 20,000 people, a few shops.

There's a pink World War II memorial, but there's not much more. Did people there recognise the Jacobetz name? Yeah, quite a few, but hardly anyone would talk on the record. One man just described Victor as a guy who knew how to make money. I did meet a local teacher, though, who was happy to chat a bit. Vadim remembered the Yakovits boys. He told me that the two brothers had lived in Polone and they went to the school that we were standing outside. He also said they went to his summer camp.

But it was Victor that he really remembered. Because Victor, he told me, had something no one else did back then. A video recorder. In those days, that was a big deal. And he remembers distinctly that Victor brought that to the summer camp, and the kids all got to watch Tom and Jerry. I asked him where he'd got it, because it must have been expensive, and he agreed.

If you had one at home in those days, Vadim said, then it meant you'd made it. You were somebody. So Victor was a man of distinction. So it seems. Vadim told me he stood out, but it was hard to get much more. What did you make of that? I'm not sure. I mean, it could just be small town caution, people being wary of an outsider. But at one point, I caught a man taking a picture of our car.

There was one detail we did get, though. People who would talk to me remembered Victor as Vitya Kalbasnik. That's the sausage man. We found the old meat processing plant where he used to work, out on the edge of town. The business went bankrupt years ago. But as you were poking around by a derelict-looking building, a dog emerged, and then a woman. in her dressing gown. It turned out her gran used to do the books for the sausage plant, and she shared Victor's employment records with us.

They show he was a man on the up. In April 1987, the month Maxime was born, Victor is listed as a worker in the warehouse. A year later, Comrade Jakubets is promoted to senior receiver of raw materials, which I guess means meat. By 1989, he's foreman of the sausage shop, someone with responsibility over others. There's another document that shows Victor left Polone for advanced training. Sausage school? Something like that. And a man who studied with him told us something interesting.

He said back in 1995, Victor and the rest of the family upped and left Polone in the middle of the night for Russia. Maxim would have been eight years old. Documents from the sausage factory. Show Victor did leave the company at that time. Why did he go? And what did he leave behind? I was told the family left a new house half built. But I left Polone with a lot of questions still unanswered.

What does a foreman at a rural Ukrainian sausage factory have to do with an alleged global cybercrime syndicate? Maybe nothing. Maybe everything. His kids certainly didn't learn about computers in Polone. A teacher there told me they didn't get any at the school until well after the Jacobetz family had left town. Still, it's a snapshot of Maxime's roots, not the obvious starting place for someone who would one day host a wedding fit for a prince.

The final big reveal from that NCA dossier concerns perhaps the wedding's most prominent man after the groom, the father of the bride. His name? Edouard Bendersky. A photo has him walking arm in arm with his daughter across the lawn towards a raised pergola covered in flowers. Guests applaud as the two approach. Maxime stands waiting, centre stage.

Edouard leads the bride down an aisle, flanked by towering bouquets, and escorts her to Maxime's side before taking his seat in the front row. There's another photo of him in his tuxedo, beaming, clearly a proud dad. Although, from Bandersky's own telling, he's probably more comfortable in fatigues than formal wear. Eduard Bandersky used to be head of Russia's Hunters and Anglers Association.

And in that capacity, he met Vladimir Putin in 2012. In the official transcript, Bendersky confides... Personally, I am more of a hunter than an angler. He started young. taken out at 10 by his father, a Soviet soldier. He became a champion, even crowned King of the Hunt at his club. As an adult, the trophy kills he collected included animals with names like fantasy creatures. There are also the more familiar bear, wolf, deer.

His online hunting journal tracks 132 kills in a high Alpine world that few ever see. And he posts photos next to these stunning creatures he's killed. Here's an entry from Tajikistan. The Belangry Gorge, it was a real lost world. There was nothing except wild animals and high mountains. The journal is a chronicle of tireless pursuit.

It wasn't an easy hunt. The mountains in New Zealand are hard to walk. The Caucasus mountains tested hunters for strength, as always. One line comes up again and again. I harvested it with the first shot. I got that nice 12-year-old trophy with the first shot. A male brown bear was taken at a distance of 300 meters with the first shot. A marksman who thrills in the kill in the most challenging environments. This is Maxime's new father-in-law. And the man the NCA says protects him.

Edward Bendersky after the 2019 disruption of the Evil Call group. utilised his influence and his position of power in Russia to protect the group and to provide them with some sort of level of security and to ensure that they weren't pursued by the internal Russian authorities. So back in 2019, when the US and the UK first revealed Maxime's name, when they put his face on the FBI Most Wanted poster and offered a $5 million bounty,

Will Lyne says Edouard Bendeski stepped in to protect his son-in-law. And again, how do you know that? Are you inside their emails? We can't talk about methods or tactics. But what I would say is that, yeah, it's all built over the course of a really long period of time and the painstaking work that the team in the UK and with international partners have put into this over many, many years.

Here's what we do know. Bendersky is not just an elite hunter. He's a former elite soldier, ex-special forces, said to have deep connections in Russia's security world. Edward Bandersky is a reportedly retired, relatively senior officer from the FSB, which is a part of the Russian intelligence services. From the early 1990s, Bandersky was part of the FSB's secretive counter-terrorism unit.

Vimple. The NCA says he now heads various organisations that use the Vimple name. Here's Bendesky himself talking about Vimple on Russian television. He's listing some of the key moments from what's described as Vimple's proud history, although I've seen some of their actions myself firsthand.

Well, let's hear now live from Moscow. Our correspondent Sarah Rainsford is close to the theatre where the hostages are being held at gunpoint. October 2002 and Chechen militants have stormed the Dubrovka Theatre. bursting onto stage during a packed performance. Heavily armed men and women strapped with explosives. At first, people thought it was part of the show. Sarah, what's the latest information coming out from inside the theatre?

Well, there's still very little concrete information actually coming out. that children over 12 have to stay and there are still a lot of children some of them are from the cast and other children who are in the audience watching the play those are all still in there around 700 people still held at gunpoint

The militants were threatening to kill everyone if the Russian military didn't pull out of Chechnya, where there'd been a grinding war for years. I remember protesters outside begging the authorities to do a deal and save the hostages. But at dawn, after three days of talks, the special forces, including Vimple, moved in. First, they pumped the auditorium full of a mystery gas that knocked everyone out. Then they shot the hostage takers.

I later spoke to a woman who was in the theatre. We were sitting, dozing. It was five o'clock or so in the morning, and suddenly there was a strange smell. The last thing I heard was when the Chechen shouted, turn on the air conditioning, it's gas. More than 100 people died in that rescue attempt.

Most because the authorities refused to name the gas and reveal the antidote. It was horrific. But the siege was broken and the Chechen militants were dead. And for some in Russia, that made Vimpel heroes. We tell you all of this to show that Wimpel are serious operators. And while Maxim Jakobetz's father-in-law wasn't part of the theatre siege operation, he was, by his own words, a proud member of the group.

The NCA dossier describes Eduard Benderski as a highly connected individual still closely involved with the Kremlin's activities. It also says that he used his status and contacts to help Evil Core build... Relationships with officials from the Russian intelligence services. And then comes the real standout line in that file. The NCA says, through Vimple...

Vandersky has been involved in multiple overseas assassinations on behalf of the Russian state. It's a huge claim. The only public source the NCA points to... Bellingcat is a collective of investigative journalists who specialise in open source intelligence. They've exposed everything from war crimes to state-sponsored assassinations by analysing publicly available data.

Stuff like satellite imagery, flight records, even TikTok videos. Bellingcat's work has been used by governments and courts. Take flight MH17. the passenger jet that was shot down over eastern Ukraine in 2014, killing 298 people. Bellingcat traced the missile system back to a Russian military brigade using nothing more than open source clues that included...

dashcam videos. The official investigation led by the Dutch later confirmed their findings. So when the NCA cites Bellingcat, it's not a casual reference, it's a source.

with a track record of shaping real-world cases. So what did they say about Eduard Bendersky? It's a long story. Settle in. The scene, an August day in Berlin, 2019. It's the summer holidays and in the Kleiner Tiergarten, a park, families are out enjoying the greenery. Zelim Karkushvili was walking the predictable route back from the mosque to his home, which always went through the middle of this park. That's Christo Grozev. He was Bellingcat's lead Russia investigator.

Zelimhan Hangashvili was a former Chechen rebel commander living in Berlin. A cyclist approaches Hangashvili from behind. The person took out a gun and shot several times into the body of Angushvili. Then he stepped off the bike and made a control shot, as they call it, into the back of the head of Zelim Khan. And he left on the bike. A murder in broad daylight, with people all around. A little further on, the assassin ducks into some bushes.

Then two teenagers see him dump the bike, the pistol and a wig in the nearby river. Thanks to the phone call from the teenagers to the police and the description they gave, the killer was picked up just a few minutes later as he was... walking down one of the nearby streets together with the tourist crowd. For the victim's family, there was no mystery here. The Russians considered Hangashvili a terrorist.

And they have a long history of going after such people. I spoke to Zelimhan's brother, Zorab. I knew there were threats from the Russian security services. But I would never have thought someone could kill him in Berlin because Germany has good intelligence services and wouldn't allow someone to be killed. I guess I was wrong. You knew straight away who it was?

It was very clear that it was the Russians. My brother had learned that the FSB had paid for information about him, that he was being hunted. Why didn't the Russians like him then? Because he was against them, their ideology, their occupation of Chechnya, their actions and threats. Back to Berlin. The German police arrested the man in the park. He and his lawyers claimed he was a construction worker on holiday, not a hitman. The Germans asked Moscow to check his identity.

And the Russians confirmed the story. But Krzysztof Grozeff and Bellingcat believed the suspect was using a false identity. Consulting leaked Russian databases... They saw that his name had only appeared a few years earlier, which signalled to them that it was fake. Then, Bellingcat compared photos of the assassin with others online.

and established what they believed to be his true identity. Vadim Krasikov. German authorities were impressed and grateful. And in long, if I remember correctly, 75... page indictment my findings were quoted probably 120 times by the prosecutor. German officials wanted Christo to testify as an expert witness. He was reluctant.

fearing for his safety and that of his family. Ultimately, the investigators and the prosecution essentially guilted me into going, saying, we depend on your testimony and otherwise you may walk free. And I thought, mm-hmm. I don't want to have that on my conscience. So I did say yes, ultimately. So Christo testified in court directly opposite the assassin.

I had to face the killer for three days in a row who would be staring me down as if he was sending a message, when this is over I'm going to get to you. In the end, the court found Vadim Krasikov guilty of murder. And the judge said he'd acted on the orders of state agencies of the Russian Federation. This was and is nothing other than state terrorism, he said. Krasikov was sentenced to life. Moscow denied everything.

But then we have to find out who sent him to conduct the assassination. And that's where the name Edward Bendersky popped up for the first time. Now we're moving to allegations that have not been tested in court, but that Bellingcat and one of Germany's leading news magazines have published. We have not independently verified them, but these are the claims.

that Britain's National Crime Agency are talking about in their dossier on Evil Corp. We contacted various organisations associated with him in Russian and in English. We got no reply. Bellingcat's evidence, tying him to the murder in Berlin, rests on the metadata in the assassin's phone records from six months before the hit. And we found that one number was the most frequently called number among those many, many people that he called. And that number resolved to the name Edward Bendersky.

Krzysztof Grozeff says the assassin was also calling organisations run by Benderski. There was one thing in common between the top 22 numbers that were most frequently called. All of them belonged to one or another entity with the name Vimple. Vimple, Eduard Bandersky's old unit.

Christo is seeing a number of private companies with the Vimple name in the assassin's call data. There's no question. He's the boss of all these companies and everybody that communicated with the killer was below him, the organisational structure. Bendersky was called at crucial moments during the preparation for this assassination. He was a deniable state assassination unit leader.

By deniable, he means that using a private company to carry out a hit gives the authorities room to say it wasn't us. Bellingcat and its partners, the investigative website The Insider and Germany's Der Spiegel, published these allegations in February 2020, six months after the assassination. Just before they did, they actually managed to contact Eduard Bandersky.

And it's not an easy call to make. I remember we called Wendersky and said we have all this evidence pointing to the fact that your number has been called many times by this killer. And we believe that it was you who spoke to him. And there was a flat denial. Bendersky said, absolutely not. I've never spoken to this guy. And I don't know. It's probably a number that I don't use or used in the past. And what was extremely ironic and scary at the same time that...

He was saying all of this from exactly the same number that the killer had been speaking to so many times. There is a significant footnote to this story. Those are Americans greeting relatives who've been locked up in Russia. Last August, the United States and Russia carried out their largest prisoner exchange since the end of the Cold War.

Our correspondent Sarah Rainsford is following the story. We've not seen anything like this in modern Russia. It is really quite extraordinary what we're seeing unfold now. Russia and its ally Belarus released 16 people. including the Wall Street Journal reporter Evan Gershkovic, one of my old Moscow colleagues. And now their brutal ordeal is over and they're free. The US and its allies released eight people, including...

the convicted Berlin assassin, Vadim Krasikov. And as Krasikov got off the plane in Moscow, Vladimir Putin was there to greet him in person, with a handshake and a hug. Putin's spokesman, who previously called any Kremlin connection to the murder groundless speculation, now says... Get this, Krasikov is...

an FSB employee. We told you it was a long story. Let's bring it back to Evilcore and Maxime Jakubets. Edward Bandersky is accused by the NCA of protecting Evil Corp and by Bellingcat of helping Russia carry out assassinations abroad. It's part of a bigger picture of allegations against Evil Corp. that it's not only protected from the Russian state, but also working for it, targeting NATO countries. The evidence for that is sparse, but the mere fact that the British authorities say this...

is significant. We asked lots of cyber security experts for direct evidence backing this up and couldn't find any. We should say everyone we've named in this series was given a chance to respond to the allegations we've been talking about. We contacted Maxim Jakubets, his brother, his cousins and others linked to Evilcore, writing to them in Russian and English using email addresses registered to them. None of them replied.

Then I asked someone who knew and worked with Maxine back in the Jabba Zeus days, Tank, who's now in prison in Colorado. Remember, we weren't allowed to record there, so an actor is reading a summary of our notes. What does Tank make of the alleged connection between hackers and the FSB? It's an obvious fact. All notorious groups are doing special tasks for the FSB. Do you have any evidence of that? Yeah.

But I can't tell you. What about Maxim Jakobets specifically? Of course. He was doing special assignments. I let that claim hang in the air. Then he shrugged. This is my guess. Hmm. Yeah. So much in Russia seems to go on in the shadows. It does. And after all this time, all these interviews, documents, the raids and the indictments, we still can't say for sure.

But we do know this. Evil Corp hasn't gone away. Not in the courts. Not in the code. Not in the minds of those tracking them. Six years on, Will Line, the NCA's head of cyber intelligence... still has that FBI Most Wanted poster for Maxime Jacobiette hanging in his office. And they're still wanted. Still wanted, yeah, indeed. The history tells us that they are persistent.

they are capable and that in all probability they will be able to come back in way, shape or form. Brian Krebs, the American journalist who first wrote about Aqua back in 2009, says Evil Corp are not just survivors.

They're shapeshifters. What makes them so dangerous? There's a finite number of people that are the movers and shakers. They are the force multipliers of CyberCrod. And these guys very much are... force multipliers if you are able to take a ransomware group and shape-shift it in a moment into something else that's a fairly high degree of organizational

sophistication, organizational maturity, and I don't know what the next criminal innovation that will sweep the world beyond ransomware will be, but I'm going to be willing to bet that whatever it is, these guys will be at the forefront of it. For now, that's the end of our story. But is it the end for Evil Call?

That was episode six of six of Cyberhack Evilcore from the BBC World Service. Cyberhack Evilcore is a BBC long-form audio production for the BBC World Service. It's presented by me, Joe Tidy. And me, Sarah Rainsford. We'd like as many people as possible to hear our stories, so please leave a rating and a review and do tell others about CyberHack. It really does help.

CyberHack returns with Season 4 in 2026. Follow or subscribe so you don't miss out. Want to know more? Well, we promised you a trailer. Here it is. Over to Geoff White. Coming soon on CyberHack. Don't play games with us. My boss is coming now and we'll start raising prices for you. We take you inside a business like no other. We need to go hard on the intimidation. There is going to be panic. I'm dying laughing. The business is extortion. High stakes, high tech, highly organised.

dig deeper and torment them the whole office will rob them the story starts in the most unlikely of places one of those small seaside towns that's a little bit kind of frayed and rough at the edges It's kind of lost a little bit of that sparkle. Where a gang of hackers made the most outrageous demand for money. They wanted millions. We're not talking about saying, Cindy, can you just give me a few thousand pounds?

We've had access to a giant trove of the gang's private messages, voiced here by actors. We'll take you inside their world and we'll unpack a criminal scheme that made them rich beyond their wildest dreams. How much? 7.5 million. Come on, really? This is my favourite job. I will never leave. But while they piled up the cash, their victims suffered. Put these people behind this cyber attack. Take my life away. And that put the gang in the crosshairs of the world's elite cyber troops.

There are men here in suits with earpieces that have come to investigate it. The tables got turned and an international game of cat and mouse began. They'll find you and that's it. You're gone. We'll take you from an English seaside town to a world of diamonds and opulence Oh, and we'll also be taking a trip to Hollywood

I'm Geoff White and I'll be back with the new series of Cyber Hack. If you lapped up the Lazarus ice, if you loved Evil Corp, this will be a story you really don't want to miss. Hit subscribe now. and turn on your push notifications so we can let you know when the first episode drops. We asked three million. You are sabotaging yourself. Nothing personal, just business. The holidays are about giving something truly special.

I'm Martha Stewart, and I believe the best gifts aren't just beautiful. They're useful every single day. Lenox has brought timeless beauty and lasting quality to our tables for generations. And their Lenox Spice Village is the perfect holiday gift for someone you love or for yourself. It's more than a spice rack.

It's a charming collection of hand-painted houses that turn ordinary spices into extraordinary experiences. Imagine cinnamon from a tiny Victorian cottage or oregano from a pastel townhouse. Suddenly, a simple meal becomes a moment to savor. Because spices can be more than ingredients. They can inspire memories, warmth, and joy all year long. Give a gift that lasts beyond the holidays. Discover the collection at lennox.com slash spicevillage.

While holiday shopping is almost always fun, credit can be confusing. Download the MyFICO app now and shop with confidence, knowing that you can stay on top of your credit 24-7. Get your FICO score straight from the people that created it. plus free credit monitoring and a free credit report every month. No credit card required. FICO scores are used by over 90% of lenders, so trust the MyFICO app to keep you in the know. Visit MyFICO.com slash free or download the MyFICO app today.