EvilCorp is an international cybercrime network that uses malicious software to steal money from victims' bank accounts and to mount ransomware attacks. In the past decade, Evil Corp has stolen more than $100 million from hundreds of banks worldwide. Many consider Evil Corp to be the world's largest, most harmful hacking group.
Law enforcement has been pursuing Evil Corp for years with limited success. Although the U.S. government sanctioned 17 members of the group and indicted its leaders in December 2019, no arrests followed, and the group remains active as of this writing. The Department of Justice has reported that attacks related to Evil Corp are still occurring.
Evil Corp has developed multiple types of malware, including Dridex, which uses a combination of techniques to automate the theft of users' banking credentials. Dridex sometimes goes by the name Cridex or Bugat, and the terms are used interchangeably.
Dridex is distributed using massive phishing email campaigns that send millions of messages per day. Targets receive seemingly legitimate emails with an infected link in the body of the message. If the user clicks the link, Dridex is installed on the machine.
From there, the malware infiltrates the web browser, where it can generate fake bank login pages. Users enter their confidential information into the fake website, and Dridex records what they type using a keylogger. It then sends the credentials to a remote Evil Corp server, giving hackers account access and enabling them to steal money.
The money is sent to Evil Corp indirectly through a network of money mules -- people who receive stolen money and transfer it to the attacker. This makes it harder for law enforcement to follow the money back to Evil Corp.
More recent modifications to Dridex also allow it to deliver ransomware, which renders a target system unusable until the user sends ransom money to the attacker -- a cybercrime model that has exploded in popularity in recent years. Later versions of Dridex also include features for handling cryptocurrency.
Recently, according to cybersecurity firm Mandiant, Evil Corp seems to have embraced the use of third-party ransomware-as-a-service software such as LockBit, possibly to hide its involvement in various attacks and evade U.S. sanctions.
High scalability and adaptability distinguish Evil Corp as a uniquely influential threat to global cybersecurity. This is partially thanks to the organization's alleged leader, Moscow native Maksim Yakubets.
Yakubets has been involved with Evil Corp since it started using the Zeus banking Trojan in the early 2000s; Zeus is considered the predecessor to Dridex. During this time, Yakubets was responsible for managing the network of money mules used to launder the stolen funds from Zeus attacks.
For example, according to court documents, Yakubets offered one U.K. resident access to Dridex in exchange for $100,000 upfront, plus 50% of revenue or a minimum of $50,000 per week. The resident would perform exploits on Evil Corp's behalf, and Yakubets would provide the malware and technical support.
Because Yakubets and Turashev are Russian citizens, however, the U.S. has not been able to arrest them as of this writing. Instead, the U.S. government has offered a $5 million reward for information leading to Yakubets' arrest. The hope is that the money will sway someone -- maybe even the Russian government -- to turn him in.
Indicting the alleged cybercriminals is arguably useful even if there is a slim chance of their arrests. The indictment exposes them and makes anonymity and international travel much more difficult. It also raises awareness about the potential for future attacks.
As previously mentioned, the Russian Evil Corp group takes its name from the television show Mr. Robot. In the show, a multinational corporation known as Evil Corp owns most of the world's industry. The show's protagonist is a hacker who aims to breach the company and wrest some power from it.
A Google search for Evil Corp will return a mixture of results referring to the real group and the fictional show. It is possible that the real-life hacking group chose the name in part because it would be more difficult to find information on it, helping minimize its online presence.
It's also worth noting that Google, at one point, adopted the motto "Don't be evil" to demonstrate an interest in corporate social responsibility and acknowledge the general public consensus that large corporations are inherently evil. Various news sources have cited companies such as Walmart and Monsanto as the quintessential "evil corporations." And a Japanese committee of journalists issues an annual award to what it deems the "most evil corporation" of the year.
Republican Rep. Paul Ryan was among those piling on when President Barack Obama came under fire several years ago for reading some of his daily intelligence briefings, rather than receiving them in-person.
Yet now, as President-elect Donald Trump refuses daily intelligence briefings, questions U.S. spy agency conclusions about Russia interfering in the 2016 presidential election, praises Russian President Vladimir Putin and appears to side with WikiLeaks founder Julian Assange, Ryan and other Republicans have Trump's back. Far from strongly defending the U.S. intelligence community, they're siding with the new leader of their party, even when he makes comments or takes stances that would seem anathema to the GOP.
It's a remarkable turnabout for a political party that cheered President Ronald Reagan's hard-line stance against the "evil empire" of the Soviet Union, unfailingly supports the military and joined with European allies in blistering Putin after Russia's annexation of Crimea in 2014.
"Well, they don't always get everything right. We've seen that clearly," Ryan said. "But I do have faith that our men and women in our intelligence community are doing an incredible job, sacrificing for our country. But there's always room for improvement."
Earlier Thursday, in an interview with WTAQ radio in Wisconsin, Ryan passed up the chance to distance himself from Trump's elevation of Assange in a tweet earlier this week, when Trump cited Assange's claim that Russia had not been the source of Democratic Party documents that WikiLeaks revealed.
Instead, even while criticizing Assange, Ryan defended Trump, saying that what the president-elect is "rightfully concerned about is partisans are trying to use the Russian hacking incident to ... call into question the legitimacy of his victory."
During a hearing Thursday with intelligence agency officials on the alleged Russian election meddling, Republicans on the panel largely avoided making comments that would contradict Trump's well-publicized skepticism that Russia had anything to do with hacking Democratic emails. The exceptions were McCain and Graham.
Republican Sen. Tom Cotton of Arkansas even appeared to try to build the case for Trump, ticking off several Trump proposals, from increasing defense spending to accelerating nuclear weapons modernization, to challenge the notion that Putin would favor Trump over Hillary Clinton.
"The notion that the soon elected leader of this country would put Julian Assange on a pedestal compared to the men and women of the intelligence community and the military ... no matter whether you're a Republican or a Democrat, there should be howls," McCaskill said. "And mark my word, if the roles were reversed, there would be howls from the Republican side."
In most cases, Republicans haven't actually embraced Trump's stances, they've just declined to call him out on them, noted Gary Schmitt, a resident scholar at the American Enterprise Institute who worked as a Democratic Hill staffer before serving as executive director on the Foreign Intelligence Advisory Board during Reagan's second term.
"It's a normal situation in which the nominal head of your party, you don't want him to be undercut," Schmitt said. "But my view is if it looks like the substance is clearly on the side of the intelligence community, you're not doing anybody any favors by protecting him."
3a8082e126