UK Takes Action Against Evil Corp for Attacks on NATO Nations

The British government has imposed strict sanctions on 16 alleged members of the Russian cybercrime syndicate Evil Corp, accusing the group of conducting operations on behalf of the Russian state to target NATO allies through cyberattacks. This latest move is part of a coordinated effort with U.S. and Australian officials to counteract what is considered one of the most dangerous cyber threats globally. The sanctions include asset freezes and travel bans, sending a strong message to Moscow that cyberattacks, whether state-sponsored or enabled through a network of cybercriminals, will not be tolerated.

British Foreign Minister David Lammy emphasized the gravity of the situation, stating, “Today’s sanctions send a clear message to the Kremlin that we will not tolerate Russian cyber-attacks—whether from the state itself or from its cyber-criminal ecosystem.” These sanctions follow long-standing tensions between Western nations and Russia regarding cyber-espionage, data breaches, and ransomware attacks that have targeted critical infrastructure, government systems, and private entities in the West.

Evil Corp, once considered the largest cyber-crime threat globally, has been under international scrutiny for years due to its involvement in large-scale ransomware and malware operations. The group’s leader, Maksim Yakubets, became infamous after the U.S. indicted and sanctioned him in 2019. Yakubets, who was known for his opulent lifestyle, including driving luxury cars like a Lamborghini, has been the subject of a $5 million bounty placed by the U.S. government for information leading to his arrest. His connections with high-ranking officials in Russian intelligence, including his father-in-law Eduard Benderskiy, a former officer of Russia’s Federal Security Service (FSB), have been critical to the group's ability to operate with impunity in Russia. Benderskiy has reportedly protected the group from law enforcement after the U.S. imposed sanctions in 2019.

According to the National Crime Agency (NCA), Evil Corp has been linked to multiple branches of Russian intelligence, including the FSB, the Foreign Intelligence Service (SVR), and the military intelligence unit GRU. The group has been accused of conducting cyber-espionage and disruptive cyber-attacks, further escalating the threat posed by Russian state-sponsored cyber activities. The NCA’s latest disclosure highlights that Evil Corp was tasked with supporting Russian intelligence operations by targeting NATO allies, although the specific details of these operations remain classified.

Among the individuals sanctioned are Yakubets and several family members, including Artem Viktorovich Yakubets and Viktor Grigoryevich Yakubets, all of whom have been implicated in the group’s illicit activities. In addition to their ransomware schemes, Evil Corp has been closely associated with the ransomware group LockBit, which has been responsible for high-profile attacks on major global corporations such as Boeing, the Royal Mail, and the Industrial and Commercial Bank of China. Western law enforcement agencies disrupted LockBit’s operations earlier this year, dealing a significant blow to the group.

One of Evil Corp’s key associates, Aleksandr Ryzhenkov, Yakubets’ right-hand man, has also been linked to LockBit and played a crucial role in ransomware attacks. The U.S. Department of Justice (DOJ) recently indicted Ryzhenkov for deploying a ransomware strain known as BitPaymer, which has been used in numerous attacks targeting victims across Texas and other U.S. states. Deputy Attorney General Lisa Monaco remarked, “Today’s charges against Ryzhenkov detail how he and his conspirators stole the sensitive data of innocent Americans and then demanded ransom.” Monaco stressed that law enforcement agencies across the globe will continue to prioritize victims of these attacks and collaborate to dismantle cybercrime networks. “In the end, these criminals will be the ones paying for their crimes,” she added, underscoring the global determination to hold cybercriminals accountable.

The sanctions against Evil Corp and its affiliates are part of a broader international effort to combat the growing threat of ransomware and other cybercrime activities that have targeted both public and private sector institutions. The close collaboration between the U.K., U.S., and Australia reflects the recognition that no single country can tackle the cybercrime problem alone. Cybercriminal groups, particularly those with state backing, operate transnationally, often exploiting the lack of coordination between nations to evade justice. By imposing sanctions and leveraging legal actions, Western countries are aiming to disrupt these networks, limit their financial resources, and curtail their ability to operate globally.

In addition to sanctions, the NCA highlighted the ongoing investigations into Evil Corp and its associates, describing the efforts as some of the most extensive and complex in the history of cybercrime enforcement. James Babbage, Director General for Threats at the NCA, acknowledged the significance of these operations, calling them “the most harmful cyber-crime groups of all time.” He reiterated the commitment of law enforcement to dismantling these organizations and bringing their members to justice.

The global crackdown on cybercriminals like Evil Corp marks a pivotal moment in the fight against ransomware and cyber-espionage. As cyber threats continue to evolve, governments, tech companies, and security agencies are increasingly working together to protect critical infrastructure, businesses, and citizens from these disruptive attacks. While the battle against cybercrime is far from over, the sanctions against Evil Corp signal a clear intention from Western powers to defend against the growing wave of state-sponsored cyber-attacks and hold those responsible accountable for their actions.