A hacking kingpin reveals all to the BBC

[ad_1] Joe Tidy Cyber correspondent, Colorado

<img sizes="(min-width: 1280px) 50vw, (min-width: 1008px) 66vw, 96vw" srcset="https://ichef.bbci.co.uk/news/240/cpsprodpb/a80f/live/4b1f5a30-b955-11f0-aa13-0b0479f6f42a.png.webp 240w,https://ichef.bbci.co.uk/news/320/cpsprodpb/a80f/live/4b1f5a30-b955-11f0-aa13-0b0479f6f42a.png.webp 320w,https://ichef.bbci.co.uk/news/480/cpsprodpb/a80f/live/4b1f5a30-b955-11f0-aa13-0b0479f6f42a.png.webp 480w,https://ichef.bbci.co.uk/news/640/cpsprodpb/a80f/live/4b1f5a30-b955-11f0-aa13-0b0479f6f42a.png.webp 640w,https://ichef.bbci.co.uk/news/800/cpsprodpb/a80f/live/4b1f5a30-b955-11f0-aa13-0b0479f6f42a.png.webp 800w,https://ichef.bbci.co.uk/news/1024/cpsprodpb/a80f/live/4b1f5a30-b955-11f0-aa13-0b0479f6f42a.png.webp 1024w,https://ichef.bbci.co.uk/news/1536/cpsprodpb/a80f/live/4b1f5a30-b955-11f0-aa13-0b0479f6f42a.png.webp 1536w" src="https://ichef.bbci.co.uk/news/480/cpsprodpb/a80f/live/4b1f5a30-b955-11f0-aa13-0b0479f6f42a.png.webp" loading="eager" alt="BBC Digital numbers and a fingerprint appear on a bright orange background. In the centre, framed inside a magnifying glass, is a young smiling man with close-cropped dark hair." class="sc-5340b511-0 hLdNfA"/> BBC Vyacheslav Penchukov, aka "Tank", left 1000's of victims the world over

After years of studying about "Tank" and months of planning a go to to him in a Colorado jail, I hear the door click on open earlier than I see him stroll into the room.

I arise prepared to present this former cyber-crime kingpin an expert hey. However, like a cheeky cartoon character, he pokes his head round a pillar with a large grin on his face and winks.

Tank, whose actual title is Vyacheslav Penchukov, climbed to the highest of the cyber-underworld not a lot with technical wizardry, however with felony attraction.

"I'm a pleasant man, I make pals simply," the 39-year-old Ukrainian says, with a broad smile.

Having pals in excessive locations is alleged to be one of many causes Penchukov managed to evade police for thus lengthy. He spent almost 10 years on the FBI's Most Wished checklist and was a pacesetter of two separate gangs in two distinct durations of cyber-crime historical past.

It's uncommon to talk to such a high-level cyber-criminal who has left so many victims behind him; Penchukov spoke to us for six hours over two days as a part of the continuing podcast collection Cyber Hack: Evil Corp.

The unique interview - Penchukov's first ever - reveals the internal workings of those prolific cyber-gangs, the mindset of a few of the people behind them and never-before-known particulars about hackers nonetheless at giant - together with the alleged chief of the sanctioned Russian group, Evil Corp.

It took greater than 15 years for authorities to lastly arrest Penchukov in a dramatic operation in Switzerland in 2022.

"There have been snipers on the roof and the police put me on the bottom and handcuffed me and put a bag on my head on the road in entrance of my children. They have been scared," he remembers with annoyance.

He's nonetheless bitter about how he was arrested, arguing that it was excessive. His 1000's of victims world wide would strongly disagree with him: Penchukov and the gangs he both led or was part of stole tens of tens of millions of kilos from them.

Within the late 2000s, he and the notorious Jabber Zeus crew used revolutionary cyber-crime tech to steal instantly from the financial institution accounts of small companies, native authorities and even charities. Victims noticed their financial savings worn out and stability sheets upended. Within the UK alone, there have been greater than 600 victims, who misplaced greater than £4m ($5.2m) in simply three months.

Between 2018 and 2022, Penchukov set his sights increased, becoming a member of the thriving ransomware ecosystem with gangs that focused worldwide firms and even a hospital.

Englewood Correctional Facility, the place Penchukov is being held, wouldn't allow us to take any recording gear contained in the jail, so a producer and I make notes throughout the interview as we're watched over by a guard close by.

<img sizes="(min-width: 1280px) 50vw, (min-width: 1008px) 66vw, 96vw" srcset="https://ichef.bbci.co.uk/news/240/cpsprodpb/d84e/live/ee2d6ac0-b9ad-11f0-bf90-1bb4be2cb649.jpg.webp 240w,https://ichef.bbci.co.uk/news/320/cpsprodpb/d84e/live/ee2d6ac0-b9ad-11f0-bf90-1bb4be2cb649.jpg.webp 320w,https://ichef.bbci.co.uk/news/480/cpsprodpb/d84e/live/ee2d6ac0-b9ad-11f0-bf90-1bb4be2cb649.jpg.webp 480w,https://ichef.bbci.co.uk/news/640/cpsprodpb/d84e/live/ee2d6ac0-b9ad-11f0-bf90-1bb4be2cb649.jpg.webp 640w,https://ichef.bbci.co.uk/news/800/cpsprodpb/d84e/live/ee2d6ac0-b9ad-11f0-bf90-1bb4be2cb649.jpg.webp 800w,https://ichef.bbci.co.uk/news/1024/cpsprodpb/d84e/live/ee2d6ac0-b9ad-11f0-bf90-1bb4be2cb649.jpg.webp 1024w,https://ichef.bbci.co.uk/news/1536/cpsprodpb/d84e/live/ee2d6ac0-b9ad-11f0-bf90-1bb4be2cb649.jpg.webp 1536w" src="https://ichef.bbci.co.uk/news/480/cpsprodpb/d84e/live/ee2d6ac0-b9ad-11f0-bf90-1bb4be2cb649.jpg.webp" loading="lazy" alt="A man in a light green shirt stands holding a microphone outside a light brown brick building surrounded by high fences" class="sc-5340b511-0 hLdNfA"/> Correspondent Joe Tidy exterior Englewood Correctional Facility in Colorado

The very first thing that stands out about Penchukov is that, though he's wanting to be launched, he appears in excessive spirits and is clearly benefiting from his time in jail. He tells me he performs lots of sport, is studying French and English - a well-thumbed Russian-English dictionary stays by his facet all through our interview - and is racking up high-school diplomas. He have to be sensible, I recommend. "Not sensible sufficient - I am in jail," he jokes.

Englewood is a low-security jail with good services. The low-rise however sprawling constructing sits within the foothills of the Rocky Mountains in Colorado. The dusty grass verges surrounding the jail are teeming with noisy prairie canine scurrying into their burrows at any time when disturbed by jail autos coming and going.

It's a good distance from Donetsk, Ukraine, the place he ran his first cyber-crime gang after falling into hacking by way of video games cheat boards, the place he would search for cheats for his favorite video video games like Fifa 99 and Counterstrike.

He turned the chief of the prolific Jabber Zeus crew - so named due to their use of the revolutionary Zeus malware and their favorite communication platform, Jabber.

Penchukov labored with a small group of hackers that included Maksim Yakubets - a Russian who would go on to be sanctioned by the US authorities, accused of main the notorious cyber-group Evil Corp.

Penchukov says that all through the late 2000s, the Jabber Zeus crew would work out of an workplace within the centre of Donetsk, placing in six to seven-hour days stealing cash from victims abroad. Penchukov would usually finish his day with a DJ set within the metropolis, enjoying beneath the title DJ Slava Wealthy.

Cyber-crime in these days was "simple cash", he says. The banks had no thought the right way to cease it and police within the US, Ukraine and the UK couldn't sustain.

<img sizes="(min-width: 1280px) 50vw, (min-width: 1008px) 66vw, 96vw" srcset="https://ichef.bbci.co.uk/news/240/cpsprodpb/c40e/live/7ba7a3e0-b894-11f0-ba75-093eca1ac29b.jpg.webp 240w,https://ichef.bbci.co.uk/news/320/cpsprodpb/c40e/live/7ba7a3e0-b894-11f0-ba75-093eca1ac29b.jpg.webp 320w,https://ichef.bbci.co.uk/news/480/cpsprodpb/c40e/live/7ba7a3e0-b894-11f0-ba75-093eca1ac29b.jpg.webp 480w,https://ichef.bbci.co.uk/news/640/cpsprodpb/c40e/live/7ba7a3e0-b894-11f0-ba75-093eca1ac29b.jpg.webp 640w,https://ichef.bbci.co.uk/news/800/cpsprodpb/c40e/live/7ba7a3e0-b894-11f0-ba75-093eca1ac29b.jpg.webp 800w,https://ichef.bbci.co.uk/news/1024/cpsprodpb/c40e/live/7ba7a3e0-b894-11f0-ba75-093eca1ac29b.jpg.webp 1024w,https://ichef.bbci.co.uk/news/1536/cpsprodpb/c40e/live/7ba7a3e0-b894-11f0-ba75-093eca1ac29b.jpg.webp 1536w" src="https://ichef.bbci.co.uk/news/480/cpsprodpb/c40e/live/7ba7a3e0-b894-11f0-ba75-093eca1ac29b.jpg.webp" loading="lazy" alt="A man with close-cropped brown hair is wearing sunglasses indoors and a pair of headphones around his neck. He appears to be inside a nightclub." class="sc-5340b511-0 hLdNfA"/> After hacking by day, Penchukov carried out as DJ Slava Wealthy by night time

In his early 20s, he was making a lot cash he purchased himself "new vehicles like they have been new garments". He had six in whole - "all costly German ones".

However police acquired a breakthrough after they managed to listen in on the criminals' textual content chats in Jabber and found the true identification of Tank utilizing particulars he had given away in regards to the delivery of his daughter.

The web closed in on the Jabber Zeus crew, and an FBI-led operation referred to as Trident Seashore noticed arrests in Ukraine and the UK. However Penchukov slipped by way of the online due to a tip-off from somebody he won't title. And because of one in every of his quick vehicles.

"I had an Audi S8 with a 500-horsepower Lamborghini engine so once I noticed the cops flashing lights in my rear view mirror, I jumped the crimson mild and misplaced them simply. It gave me an opportunity to check the complete energy of my automobile," he says.

He laid low with a pal for some time, however when the FBI left Ukraine, the native authorities appeared to lose curiosity in him.

So Penchukov saved beneath the radar and, he says, went straight. He began an organization shopping for and promoting coal, however the FBI was nonetheless on the path.

"I used to be on vacation in Crimea once I acquired a message from a pal who noticed that I had been placed on the FBI Most Wished checklist. I believed I had acquired away with all of it - then I realised I've a brand new downside," he says, an apparent understatement.

<img sizes="(min-width: 1280px) 50vw, (min-width: 1008px) 66vw, 96vw" srcset="https://ichef.bbci.co.uk/news/240/cpsprodpb/f8cf/live/50e5d490-b896-11f0-b2a1-6f537f66f9aa.png.webp 240w,https://ichef.bbci.co.uk/news/320/cpsprodpb/f8cf/live/50e5d490-b896-11f0-b2a1-6f537f66f9aa.png.webp 320w,https://ichef.bbci.co.uk/news/480/cpsprodpb/f8cf/live/50e5d490-b896-11f0-b2a1-6f537f66f9aa.png.webp 480w,https://ichef.bbci.co.uk/news/640/cpsprodpb/f8cf/live/50e5d490-b896-11f0-b2a1-6f537f66f9aa.png.webp 640w,https://ichef.bbci.co.uk/news/800/cpsprodpb/f8cf/live/50e5d490-b896-11f0-b2a1-6f537f66f9aa.png.webp 800w,https://ichef.bbci.co.uk/news/1024/cpsprodpb/f8cf/live/50e5d490-b896-11f0-b2a1-6f537f66f9aa.png.webp 1024w,https://ichef.bbci.co.uk/news/1536/cpsprodpb/f8cf/live/50e5d490-b896-11f0-b2a1-6f537f66f9aa.png.webp 1536w" src="https://ichef.bbci.co.uk/news/480/cpsprodpb/f8cf/live/50e5d490-b896-11f0-b2a1-6f537f66f9aa.png.webp" loading="lazy" alt="FBI The headline says "Wanted by the FBI"; underneath it says "conspiracy to participate in racketeering activity; bank fraud. conspiracy to violate the computer fraud and abuse act; conspiracy to violate the identity theft and assumption deterrence act; aggravated identity theft." Under that, there are images of three men and their names: Ivan Viktorovich Klepikov, aliases petrovich, nowhere; Alexey Dmitrievich Bron, alias "the head"; Vyacheslav Igorevich Penchukov, aliases tank, father." class="sc-5340b511-0 hLdNfA"/> FBI Penchukov (R) was among the many FBI's most needed; his two co-conspirators have but to be caught

His lawyer on the time was calm, although, and suggested him to not fear: so long as he didn't journey exterior of Ukraine or Russia, US police couldn't do a lot.

The Ukrainian authorities did ultimately come knocking - however to not arrest him.

Penchukov had been outed as a rich hacker needed by the West and he alleges that just about every single day, officers would come and shake him down for cash.

His coal-selling enterprise was going properly till Russia's invasion of Crimea in 2014. President Putin's so-called "Little Inexperienced Males" - Russian troopers in unmarked uniforms - ruined his enterprise and missiles struck his condo in Donetsk, damaging his daughter's bed room.

Penchukov says that it was enterprise troubles and the fixed payouts to Ukrainian officers that led him to as soon as once more fireplace up his laptop computer and get again into the cyber-crime life.

"I simply determined it was the quickest technique to earn a living to pay them," he says.

His journey charts the evolution of contemporary cyber-crime - from fast and straightforward checking account theft to ransomware, immediately's most pernicious and damaging kind of cyber-attack utilized in high-profile hacks this yr, together with on UK Excessive Avenue stalwart Marks & Spencer.

He says ransomware was tougher work however the cash was good. "Cyber-security had improved loads, however we have been capable of make about $200,000 a month. A lot increased income."

In a revealing anecdote, he remembers rumours that began a few crew being paid $20m (£15.3m) from a hospital that had been crippled by ransomware.

Penchukov says the information fired up the a whole lot of hackers within the felony boards who all then went after US medical establishments to repeat the pay day. These hacker communities have a "herd mentality", he says: "Folks do not care in regards to the medical facet of issues - all they see is 20 tens of millions being paid."

<img sizes="(min-width: 1280px) 50vw, (min-width: 1008px) 66vw, 96vw" srcset="https://ichef.bbci.co.uk/news/240/cpsprodpb/cbdc/live/566ee6c0-b956-11f0-ba75-093eca1ac29b.jpg.webp 240w,https://ichef.bbci.co.uk/news/320/cpsprodpb/cbdc/live/566ee6c0-b956-11f0-ba75-093eca1ac29b.jpg.webp 320w,https://ichef.bbci.co.uk/news/480/cpsprodpb/cbdc/live/566ee6c0-b956-11f0-ba75-093eca1ac29b.jpg.webp 480w,https://ichef.bbci.co.uk/news/640/cpsprodpb/cbdc/live/566ee6c0-b956-11f0-ba75-093eca1ac29b.jpg.webp 640w,https://ichef.bbci.co.uk/news/800/cpsprodpb/cbdc/live/566ee6c0-b956-11f0-ba75-093eca1ac29b.jpg.webp 800w,https://ichef.bbci.co.uk/news/1024/cpsprodpb/cbdc/live/566ee6c0-b956-11f0-ba75-093eca1ac29b.jpg.webp 1024w,https://ichef.bbci.co.uk/news/1536/cpsprodpb/cbdc/live/566ee6c0-b956-11f0-ba75-093eca1ac29b.jpg.webp 1536w" src="https://ichef.bbci.co.uk/news/480/cpsprodpb/cbdc/live/566ee6c0-b956-11f0-ba75-093eca1ac29b.jpg.webp" loading="lazy" alt="A man with close-cropped brown hair smiles in front of a large chandelier" class="sc-5340b511-0 hLdNfA"/> Penchukov's gang left many victims; one stated they felt "disbelief and horror" at dropping their cash

Penchukov rebuilt his connections and expertise to grow to be one of many high associates of ransomware companies, together with Maze, Egregor and the prolific group Conti.

When requested if these felony teams labored with Russian safety companies - an everyday accusation from the West - Penchukov shrugs and says: "In fact." He says that some ransomware gang members typically talked about talking to "their handlers" within the Russian safety companies, just like the FSB.

The BBC wrote to the Russian Embassy in London, asking if the Russian authorities or its intelligence companies engaged with cyber criminals to assist cyber espionage, however acquired no reply.

Penchukov quickly rose to the highest once more and have become a pacesetter of IcedID - a gang that contaminated greater than 150,000 computer systems with malicious software program and led to varied sorts of cyber-attack, together with ransomware. Penchukov was in control of a staff of hackers who would sift by way of the contaminated computer systems to work out how greatest to earn a living from them.

One sufferer they contaminated with ransomware in 2020 was the College of Vermont Medical Heart within the US. Based on US prosecutors, this led to the lack of greater than $30m (£23m) and left the medical centre unable to offer many essential affected person companies for greater than two weeks.

Though no-one died, prosecutors say the assault, which disabled 5,000 hospital computer systems, created a danger of dying or critical damage to sufferers. Penchukov denies he really did it, claiming he solely admitted to it with the intention to cut back his sentence.

General, Penchukov, who has since modified his surname to Andreev, feels the 2 nine-year sentences he's serving concurrently are an excessive amount of for what he did (he's hoping to get out a lot sooner). He has additionally been ordered to pay $54m (£41.4m) in restitution to victims.

His view as a younger hacker who began in cyber-crime as an adolescent is that Western firms and other people may afford to lose cash and that every part was lined by insurance coverage anyway.

However once I communicate to one in every of his early victims from the Jabber Zeus days, it's clear his assaults did have a dangerous affect on harmless folks.

Lieber's Baggage, a family-run enterprise in Albuquerque, New Mexico, had $12,000 (£9,200) stolen in a single swipe by the gang. Proprietor Leslee nonetheless remembers the shock years later.

"It was simply disbelief and horror when the financial institution referred to as as a result of we had no thought what had occurred, and the financial institution clearly did not have any thought," she says.

Whereas a modest sum, it was devastating for the enterprise, as the cash was used for paying hire, shopping for merchandise and paying workers.

They didn't have any financial savings to fall again on and, to make issues worse, Leslee's aged mom was in control of the corporate accounts and he or she blamed herself till the theft was uncovered.

"We had all of these emotions, the anger, the frustration, the worry," she says.

After I ask them what they want to say to the hackers accountable, they suppose it's futile to attempt to change the minds of those callous criminals.

"There's nothing that lets say that may have an effect on him," Leslee says.

"I would not give him the time of day," her husband Frank provides.

Penchukov says he didn't take into consideration the victims, and he doesn't appear to take action a lot now, both. The one signal of regret in our dialog was when he talked a few ransomware assault on a disabled youngsters's charity.

His solely actual remorse appears to be that he turned too trusting along with his fellow hackers, which finally led to him and lots of different criminals being caught.

"You may't make pals in cyber-crime, as a result of the subsequent day, your pals might be arrested and they're going to grow to be an informant," he says.

"Paranoia is a continuing pal of hackers," he says. However success results in errors.

"When you do cyber-crime lengthy sufficient you lose your edge," he says, wistfully.

<img sizes="(min-width: 1280px) 50vw, (min-width: 1008px) 66vw, 96vw" srcset="https://ichef.bbci.co.uk/news/240/cpsprodpb/cc8e/live/8b148a70-b8a1-11f0-aa13-0b0479f6f42a.png.webp 240w,https://ichef.bbci.co.uk/news/320/cpsprodpb/cc8e/live/8b148a70-b8a1-11f0-aa13-0b0479f6f42a.png.webp 320w,https://ichef.bbci.co.uk/news/480/cpsprodpb/cc8e/live/8b148a70-b8a1-11f0-aa13-0b0479f6f42a.png.webp 480w,https://ichef.bbci.co.uk/news/640/cpsprodpb/cc8e/live/8b148a70-b8a1-11f0-aa13-0b0479f6f42a.png.webp 640w,https://ichef.bbci.co.uk/news/800/cpsprodpb/cc8e/live/8b148a70-b8a1-11f0-aa13-0b0479f6f42a.png.webp 800w,https://ichef.bbci.co.uk/news/1024/cpsprodpb/cc8e/live/8b148a70-b8a1-11f0-aa13-0b0479f6f42a.png.webp 1024w,https://ichef.bbci.co.uk/news/1536/cpsprodpb/cc8e/live/8b148a70-b8a1-11f0-aa13-0b0479f6f42a.png.webp 1536w" src="https://ichef.bbci.co.uk/news/480/cpsprodpb/cc8e/live/8b148a70-b8a1-11f0-aa13-0b0479f6f42a.png.webp" loading="lazy" alt="FBI Page from FBI website that shows four different images of the same man - young, with light brown hair. At the top of the page, it says the text: "Wanted by the FBI - Maksim Viktorovich Yakubets. Conspiracy; conspireacy to commit fraud; wire fraud; bank fraud; intentional damage to a computer."" class="sc-5340b511-0 hLdNfA"/> FBI Yakubets - generally known as 'Aqua' - was added to the FBI's Most Wished checklist in 2019

As if to focus on the disloyal nature of the cyber underworld, Penchukov says he intentionally prevented any additional contact along with his one-time Jabber Zeus collaborator and pal Maksim Yakubets after the Russian was outed and sanctioned in 2019 by Western authorities.

Penchukov says that he seen a definite change within the hacker neighborhood as folks shunned working with Yakubets and lots of of his alleged Evil Corp associates.

Beforehand Penchukov and "Aqua", as Yakubets was identified, had frolicked in Moscow ingesting and consuming in luxurious eating places. "He had bodyguards, which I believed was unusual - virtually like he needed to indicate off his wealth or one thing," he says.

Being ostracised from the cyber crime world didn't deter Evil Corp although and final yr, the UK's Nationwide Crime Company accused different members of the Yakubets household of being concerned within the decade-long crime spree, sanctioning 16 members of the organisation in whole.

However in contrast to Penchukov, the possibilities of police collaring him or others within the gang appear low. With a $5m bounty out for data resulting in his arrest, Yakubets and his alleged co-conspirators are unlikely to repeat Penchukov's mistake of leaving their nation.