A coordinated trilateral action by the UK's National Crime Agency (NCA), FBI, and Australian Federal Police documented in reporting by The Record has for the first time publicly named Eduard Benderskiy — a former high-ranking Russian intelligence official and KGB Vympel veteran — as a key enabler and protector of Evil Corp, establishing the most significant publicly documented link between the Russian state and the country's organized cybercrime ecosystem.
Evil Corp: A Decade of Criminal Infrastructure
Evil Corp is a structured cybercrime organization — operating more like a traditional vertical hierarchy than the loosely affiliated groups common in Russian cybercrime — that has been active for over a decade. First sanctioned and indicted by the U.S. in 2019, the group is responsible for the GameOverZeus and Dridex banking trojans and botnets, and is assessed to have stolen hundreds of millions of dollars from victims worldwide. Its leader, Maksim Yakubets, was simultaneously charged in 2019 with conducting criminal operations and providing direct assistance to Russia's FSB — acquiring confidential documents from victims' systems on behalf of Russian intelligence while running criminal campaigns.
The 2019 indictment also named several of Yakubets' relatives — his brother Artem, and cousins Kirill and Dimitriy Slobodskoy — reflecting the group's family-centered leadership structure. Tuesday's action added Aleksandr Ryzhenkov, identified as Yakubets' right-hand man and the most senior Evil Corp member not directly related to him, to the public record for the first time. The U.S. DOJ simultaneously unsealed an indictment charging Ryzhenkov for using BitPaymer ransomware to target victims across the United States. Separately, the NCA identified Ryzhenkov as a LockBit affiliate, extending the group's documented ransomware activity beyond its own tooling.
Benderskiy: The Kremlin Connection
Benderskiy — confirmed as Yakubets' father-in-law — is described by the NCA, FBI, and AFP as using his "extensive influence with the Russian state to protect the group," particularly after the 2019 sanctions and indictment left Evil Corp's senior members exposed. According to the advisory, Benderskiy was also instrumental in tasking Evil Corp to "conduct cyberattacks and espionage operations against NATO allies" through his ongoing relationship with the Kremlin, though he holds no current formal position within Russia's security apparatus.
Russian media has described Benderskiy as a veteran of the KGB's Vympel special forces unit — now the FSB's Directorate V — for which he appeared as a spokesperson in 2011. He currently serves as president and chairman of the Club of Mountain Hunters (KGO-Club) and has operated both a security company and charity under the Vympel name. Investigative journalists at Bellingcat reported in 2020 that Benderskiy used the Vympel charity to assist the FSB in the 2019 assassination of Chechen former platoon commander Zelimkhan Khangoshvili in Berlin.
State-Criminal Nexus: Beyond Tacit Support
The Benderskiy disclosure builds on a documented pattern of direct FSB engagement with Russian cybercriminals that goes beyond the "tacit support" typically described in policy discussions. The 2017 U.S. charges against two FSB officers for directing criminal hackers against Yahoo accounts, the 2023 sanctioning of Trickbot senior member Vitaly Kovalev for his relationship with Russian intelligence services, and now Evil Corp's documented tasking against NATO allies all indicate that at least in certain cases, the relationship between Russian state intelligence and organized cybercrime is operational and directive rather than merely permissive. Western officials emphasized that the Benderskiy case is exceptional rather than the norm — but its level of detail sets a new benchmark for public attribution of state-criminal collaboration in the cyber domain.
The coordinated action included sanctions designations by the U.S. Treasury (seven individuals, two entities), 15 additions to the UK cyber sanctions list, and three designations by Australia — a multilateral scope reflecting the global reach of Evil Corp's victimization campaigns.