Announcementseverity: High2024-10-01
UK NCA unmasks Evil Corp's Aleksandr Ryzhenkov as a LockBit affiliate
published by UK National Crime Agency
Actor
Russian cybercrime syndicate publicly attributed by the U.S. Treasury OFAC in December 2019, which sanctioned founder Maksim Yakubets. Operators of the Dridex banking trojan, the BitPaymer and Wasted…
Summary
The UK National Crime Agency announced that data recovered during Operation Cronos identified Aleksandr Ryzhenkov, Maksim Yakubets' deputy, as a prolific LockBit affiliate responsible for attacks against at least 60 organizations since 2022. The NCA framed the move as evidence that 2019 sanctions had forced Evil Corp to abandon proprietary ransomware brands — WastedLocker, Hades, PhoenixLocker, PayloadBIN, Macaw — in favour of operating under established ransomware-as-a-service programmes.
Tags
ncalockbitoperation-cronosransomware
Primary source
nca-newsroom.prgloo.comOther Evil Corp events
- 2024-10-01US, UK and Australia issue trilateral Evil Corp sanctions naming FSB enabler Benderskiy
- 2020-07-24Garmin global outage attributed to Evil Corp WastedLocker ransomware
- 2020-06-25Symantec discloses WastedLocker wave against 31 US organizations
- 2019-12-05US Treasury sanctions Evil Corp and designates Maksim Yakubets
- 2019-12-05DOJ indicts Maksim Yakubets and Igor Turashev over Bugat/Dridex scheme