For the past few years, the FBI has been keeping a separate list of the US' most wanted cybercriminals. Time to take a look at who's still on it -- in no particular order.
#1 - Marksim Viktorovich Yakubets
Dridex mastermind
In December 2019, the US charged the mastermind behind the infamous Dridex malware, a Russian national named Maksim Victorovich Yakubets. He is the FBI's most wanted cybercriminal, with US authorities willing to pay up to $5 million for any information that may lead to his arrest. Igor Turashev, one of the Dridex botnet administrators, was also charged, but for a minor role in the scheme.
#2 - Evgeniy Mikhaylovich Bogachev
GameOver Zeus botnet mastermind
Evgeniy Mikhaylovich Bogachev, known as "Slavik" is a malware author who created and operated the GameOver Zeus banking trojan and adjacent botnet.
After he was charged in 2014 for the theft of over $100 million from GameOver Zeus victims, Bogachev is believed to have become a close collaborator of Russian intelligence agencies. The FBI is willing to pay up to $3 million for any information that may lead to his arrest.
#3 - DNC 2016 U.S Election Hacking
DNC hackers
On July 13, 2018, US authorities finally charged a group of Russian hackers for the infamous DNC hacks of 2015 and 2016, an incident during which two Russian cyber-espionage units breached and stole data from the servers of the Democratic National Committee. This information was later released online as part of a political influence campaign to support Donald Trump's candidacy for the US Presidency.
Twelve Russian military officers were charged. They are believed to be part of either the APT28 (Fancy Bear) or APT29 (Cozy Bear) cyber-espionage groups.
#4 - Alexsey Belan, Dmitriy Aleksandrovich Dokuchayev, and Igor Suchin.
Yahoo hackers
Back in March 2017, the US Department of Justice charged four hackers with breaching Yahoo in 2014 and stealing data on 500 million users.
One, named Karim Baratov, was arrested in Canada, and extradited to the US, where he eventually received a sentence of five years in prison.
The other three, including two officers of FSB intelligence officers, are still at large, believed to reside in Russia. Their names are Alexsey Belan, Dmitriy Aleksandrovich Dokuchayev, and Igor Suchin.
#5 - IRGC hackers
IRGC hackers
In February 2019, the US charged four Iranian nationals for conspiring with a former US Air Force intelligence agent who defected to Iran in 2013. The group used intelligence provided by the US Air Force agent to launch phishing attacks over email and social media.
One of the four hackers, Behzad Mesri, had been previously charged in November 2017 with hacking HBO and leaking unreleased episodes and scripts for HBO TV series, including from HBO's primetime show Game of Thrones.
#6 - Fujie Wang
Anthem hacker
Another highly sought-after hacker is Fujie Wang, the only member of a larger group of hackers who was identified by his real name and who participated in the Anthem hack of 2014.
Believed to be a member of a Chinese cyber-espionage unit, Wang is still at large in China. He was formally charged earlier this month.
#7 - Ahmad Al Agha and Firas Dardar
Syrian Electronic Army hackers
In March 2016, the US charged three members of the Syrian Electronic Army hacker outfit. One was arrested and extradited to the US, but two are still at large, namely Ahmad Al Agha and Firas Dardar.
#8 - Park Jin Hyok
Lazarus Group member
In September 2018, US authorities charged Park Jin Hyok, a 34-year-old North Korean, with a litany of charges based on his membership in the Lazarus Group, a North Korean government-backed hacking unit.
He stands accused of participating in the WannaCry ransomware outbreak, the 2016 Bangladesh Central Bank cyber-heist, attempts at hacking US defense contractor Lockheed Martin in 2016, the 2014 Sony Pictures hack, breaches at US movie theater chains AMC Theatres and Mammoth Screen in 2014, and a long string of attacks and successful hacks against cryptocurrency exchanges.
#9 - Zeus Banking Trojan
Zeus gang
Charged way back in 2014, this group of hackers has operated the Zeus banking Trojan. US authorities charged nine hackers, three of which are still at large.
Since their indictment, the source code of the Zeus Trojan was leaked online, and has become the inspiration and code base for tens of other banking Trojan strains.
These individuals, thought to be located in Russia and Ukraine, are wanted for their involvement in a wide-ranging racketeering enterprise and scheme that installed, without authorization, malicious software known as “Zeus” on victims’ computers. The malicious software was used to capture bank account numbers, passwords, personal identification numbers, and other information necessary to log into online banking accounts.
These subjects were then able to coordinate unauthorized transfers of funds from victims’ accounts.
These individuals were charged by a federal grand jury in the District of Nebraska in August of 2012 with Conspiracy to Participate in Racketeering Activity; Bank Fraud; Conspiracy to Violate the Computer Fraud and Abuse Act; Conspiracy to Violate the Identity Theft and Assumption Deterrence Act; and Aggravated Identity Theft.
#10 - IRANIAN MABNA HACKERS
Mabna hackers
Charged in March 2018, this group of Iranian state-sponsored hackers has been accused of hacking into the networks of 320 universities across the world.
The group was also known as Cobalt Dickens or Silent Librarian in the reports of various cybersecurity firms, and continued its hacking activities despite US charges.
#11 - Goznym Banking Trojan
Goznym gang
Following years of work, US and European authorities announced charges against seven hackers who worked on distributing the Goznym banking trojan. Two were arrested, while five are still on the run, believed to be in Russia.
#12 - Zhu Hua and Zhang Shilong
APT10 hackers
Another group of hackers on the payroll of a foreign government is the duo of Zhu Hua and Zhang Shilong. Believed to be part of a Chinese cyber-espionage group known as APT10, they were charged in December 2018 with hacking more than 45 US companies, US government agencies, and several managed service providers. Victims include IBM, HPE, and Visma.
#13 - Faramarz Shahi Savandi and Mohammad Mehdi Shah Mansouri
SamSam crew
Another team of Iranian hackers is the one formed by 34-year old Faramarz Shahi Savandi and 27-year old Mohammad Mehdi Shah Mansouri -- collectively known as the operators of the SamSam ransomware.
Charged in November 2018, they are responsible for one of the most prolific ransomware strains around, which they used for attacks targeted at one organization at a time, a tactic they pioneered back in 2015, and which is now the most prevalent and successful type of ransomware attack today, also known as "big game hunting."
#14 - WADA Hackers
WADA hackers
In October 2018, US authorities charged seven Russian nationals believed to be members of the GRU military intelligence agency. US officials said the group engaged in a retaliatory action against several sports organizations after Russian athletes were banned from the Rio 2016 Summer Olympics on allegations of doping.
The seven, acting under the fake personas of Anonymous and the Fancy Bears hacking groups, breached the World Anti-Doping Agency (WADA), the United States Anti-Doping Agency (USADA), and other victim entities during the 2016 Summer Olympics and Paralympics and afterwards, stealing and then dumping sensitive records online as part of efforts to discredit the world's most famous athletes and anti-doping organizations.
#15 - Iran DDOS attackers
Iran DDOS attackers
In early 2016, the US charged seven Iranian hackers for launching a series of coordinated DDoS attacks against US companies in the banking and financial sector. One of these attacks also hit a New York dam, putting US authorities on alert.
The DDoS attacks were retaliation from Iranian authorities after the Stuxnet attacks orchestrated by the US and Israel against Iran's nuclear program.
On January 21, 2016, a grand jury in the Southern District of New York indicted seven Iranian nationals for their involvement in conspiracies to conduct a coordinated campaign of distributed denial of service (“DDoS”) attacks against the United States financial sector and other United States companies from 2011 through 2013. Each defendant was a manager or employee of ITSecTeam or Mersad, private security computer companies based in the Islamic Republic of Iran that performed work on behalf of the Iranian Government, including the Islamic Revolutionary Guard Corps.
#16 - Viet Quoc Nguyen
Epsilon hacker
Viet Quoc Nguyen is the last of the three hackers who breached email provider Epsilon in 2011. He was accused of stealing marketing data, including a list of over one billion email addresses. He was also a notorious spammer.
#17 - Mohammed Reza Rezakhah and Mohammed Saeed Ajily
ArrowTech hackers
In July 2017, US authorities charged two Iranian hackers named Mohammed Reza Rezakhah and Mohammed Saeed Ajily for the hack of ArrowTech, a supplier of military technology for the US army.
According to the indictment, the two hacked ArrowTech in 2016, from which they stole a software application named Projectile Rocket Ordnance Design and Analysis System (PRODAS), used in the design of bullets, missiles, and other military projectiles.
Comments