U.S., British Authorities Publicly Link Ex-FSB Officer To Notorious Russian Ransomware Group
By Mike Eckel, Mark Krutov and Sergei Dobrynin (Eckel is a Fletcher alum and Senior News Correspondent)
U.S. and British authorities for the first time publicly linked an ex-Russian special forces officer to one of the world’s most notorious ransomware groups, adding further evidence of ties, formal and informal, between Russian intelligence agencies and criminal groups.
Eduard Bendersky, who served in the elite Vympel unit of the Federal Security Service, had been identified as early as 2019 as the father-in-law of Maksim Yakubets, the alleged founder of Evil Corp, whose malware has been used around the world to lock out corporate computer systems in exchange for ransom.
Yakubets married Bendersky’s daughter Alyona at a lavish wedding ceremony on Moscow’s outskirts in 2017, according to photographs and videos discovered by RFE/RL.
In a criminal indictment unsealed in December 2019 against Yakubets, the U.S. Justice Department alleged that he provided “direct assistance to the Russian government’s malicious cyber efforts, highlighting the Russian government’s enlistment of cybercriminals for its own malicious purposes.”
But neither U.S. nor British officials, who have also hit Yakubets and Evil Corp. with financial sanctions, provided details of Yakubets’ links to the Russian government.
On October 1, however, the U.S. Treasury Department and Britain’s National Crime Agency publicly confirmed Bendersky as Yakubets’ father-in-law, calling him a “key enabler of Evil Corp.”
“Bendersky leveraged his status and contacts to facilitate Evil Corp’s developing relationships with officials of the Russian intelligence services. After the December 2019 sanctions and indictments against Evil Corp and Maksim, Bendersky used his extensive influence to protect the group,” the Treasury Department said.
After the December 2019 sanctions and indictments against Evil Corp and Maksim, Maksim sought out Bendersky’s guidance. Bendersky used his extensive influence to protect the group, including his son-in-law, both by providing senior members with security and by ensuring they were not pursued by Russian internal authorities,” the department alleged.
Bendersky also, according to the Treasury, was also instrumental in brokering a business deal between Yakubets and Dmitry Kozak, a longtime aide of President Vladimir Putin, as well as German Gref, the current CEO of state banking giant Sberbank.
The National Crime Agency announced parallel sanctions against Bendersky, Yakubets, and more than a dozen other individuals it said were linked to Evil Corp.
Bendersky has made no public comment on the allegations, and could not be located for comment by RFE/RL. Yakubets, who previously had a visible presence on social media, showcasing his love for racing expensive sports cars, has all but disappeared from public view since the 2019 indictment.
The department also alleged that Yakubets’ father, Viktor, helped provide technical equipment to his son, helping to facilitate the spread of the ransomware.
The Treasury announcement detailed other alleged links between Yakubets and prominent Russian government insiders. Yakubets, the department alleged, uses his employment at a Russian company to cover his work with Evil Corp. The company, called the National Engineering Corporation, was founded by the son of former Prosecutor-General Yury Chaika.
Relatedly, the U.S. Justice Department unsealed an indictment, first issued in March 2023, charging a Russian man named Aleksandr Ryzhenkov with conspiracy for his work with Evil Corp. Ryzhenkov, officials said, was “a long-term associate and second-in-command” for Yakubets. Ryzhenkov, the National Crime Agency said in its statement, was responsible for a affiliated bit of ransomware called LockBit.
Bendersky has also been linked to the 2019 killing in Berlin of former Chechen field commander Zelimkhan Khangoshvili, according to reporting by the open-source investigative group Bellingcat. An FSB agent named Vadim Krasikov was convicted of killing Khangoshvili, and served several years in a German prison before being released in August as part of a large prisoner swap with the West.
According to Bellingcat, Bendersky directly supervised the preparation for the killing.
(This post is republished from RFERL.)