Alleged Jabber Zeus Coder 'MrICQ' in U.S. Custody

(krebsonsecurity.com)

166 points | by todsacerdoti 20 hours ago ago

68 comments

  • mikkupikku 18 hours ago

    Imagine having these sort of warrants hanging over your head and just casually deciding to do a little international traveling. Guys like this are constantly getting nabbed this way. I wonder if being a wanted man for so long has some sort of psychological effect that makes people take more risks to get it over with.

    • slightwinder an hour ago

      There could be errors happening outside their control. Planes are sometimes rerouted to different countries for different reasons, but mainly weather-related. I've heard stories of travel agencies f**ing up travel planes because of wrong data, and people suing them because of unexcepted stops. Or the good old "they planned for Australia, but ended in Austria"-story. Happens far too often.. There are many targets where people confuse a city or country with a different target.

    • irjustin 17 hours ago

      I imagine the general assumption is that you don't realize that you've been ID'ed. That they traveled before and nothing happened so traveling again isn't a big deal because all the "tricks" they used to cover their tracks worked.

      • Gibbon1 10 hours ago

        Friend of mine has a story from 50 years ago. Guy he knew was dealing coke. Got spooked and stopped selling. Three years later he thought it'd all blown over. Set up a another deal and got popped.

        Another friend that worked IT at a slaughter house said one of the bikers that worked their said, the feds aren't good at figuring you out. But when they do they never stop watching you.

        • matwood 9 hours ago

          There’s knowing something and building a case to prove it in court. With drugs in particular the police tend want the higher up people so will watch the others for a long time.

    • manquer 14 hours ago

      I would imagine that is lot more likely that is just only the official story rather than what actually happens behind the scenes in these situations.

      In the background there could be deals with the countries protecting them or with the target directly or a existing deal they had is off now. It may even be unrelated, wasn't worth expending the diplomatic capital before, but they are a connection to someone else more important and so on.

      It could also be the targets were captured in a illegal way, no country wants to be diplomatically humiliated and the prosecuting one wouldn't want to disclose their covert ops capabilities.

      Announced News is more often only a Press Release, we shouldn't be taking them literally.

      • which 3 hours ago

        Relatedly about another member of the same group:

        > Penchukov’s political connections helped him evade prosecution by Ukrainian cybercrime investigators for many years. The late son of former Ukrainian President Victor Yanukovych (Victor Yanukovych Jr.) would serve as godfather to Tank’s daughter Miloslava... Sources briefed on the investigation into Penchukov said that in 2010 — at a time when the Security Service of Ukraine (SBU) was preparing to serve search warrants on Tank and his crew — Tank received a tip that the SBU was coming to raid his home.

        https://krebsonsecurity.com/2022/11/top-zeus-botnet-suspect-...

      • _zoltan_ 9 hours ago

        if you read the article it links to an Italian supreme court summary that apparently states he has lost his appeal to not get extradited, so after that it shouldn't have been a surprise that... he was extradited.

      • ribosometronome 11 hours ago

        >captured in a illegal way

        Tracked down in an illegal way? Sure, quite possibly. But he's going to get a trial. If he were kidnapped out of Italy by the CIA or something, it seems like it would be hard to keep that from coming out.

        • aswegs8 8 hours ago

          Why should the CIA need to kidnap someone from Italy if they can just provide info about the person to the Italian govt so he gets arrested and extradited?

          • serallak 3 hours ago

            Well about that ...

            https://en.wikipedia.org/wiki/Abu_Omar_case

            This is well know case of a "person of interest" kidnapped by the CIA in Milano, Italy. While the CIA was assisted by the Italian Intelligence, it was a completely illegal operation, without any due process or judiciary oversight.

          • Cthulhu_ 7 hours ago

            If the CIA is involved it wouldn't be any regular criminal, but e.g. an international spy, someone who may even be protected by Italy for ??? reasons.

            • hnbad 4 hours ago

              Sure but "not a regular criminal" is a much broader group than you make it out to be.

              Remember the CIA was also the primary actor involved in the US's overseas bombing attacks, especially outside active war zones. Sure, a lot of the bombings targeted "terrorists" but that designation is ultimately arbitrary - especially if we're talking about people being killed in bombings of civilian areas that usually came with a lot of collateral damage (especially if you don't use the assumption that anyone who may have been a teenage or adult male is an enemy combatant), a practice that we would identify as "terrorism" if carried out by any hostile regime.

              He doesn't seem to have big enough of a target on his back to justify outright exploding him but that doesn't mean he's considered a "regular criminal" or that the CIA wasn't involved.

              That said, Occam's razor suggests it didn't require CIA involvement to catch him - he may just have been careless and unlucky.

          • rasz 34 minutes ago

            Because Italy has a history of siding with terrorists and letting them go

            https://en.wikipedia.org/wiki/Achille_Lauro_hijacking#Jurisd...

            "Following a deal made with Yasser Arafat with Giulio Andreotti[25] even before the Craxi government had made its final decision, Abbas and Badrakkan, wearing unidentified uniforms, had been put back on the EgyptAir 737 airliner."

        • manquer 2 hours ago

          I wasn't talking about this specific case.

          It was about general statement by the parent on how these criminals can be so be dumb, i was enumerating some of the different ways it can happen behind the scenes and still be annouced as a simple arrest at the airport etc.

    • reisse 16 hours ago

      From the other point of view, the abundance of stories when the high-profile criminal was catched doing something stupid, and the relative absence of ones when the criminal was catched in some clever way may mean the law enforcement is doing their job poorly.

      • Polizeiposaune 16 hours ago

        Operation Flagship in 1985 was one of the clever ones -- US marshalls nabbed 101 wanted fugitives on a single day at a stadium, where they were expecting to receive two free tickets to an NFL game...

        https://en.wikipedia.org/wiki/Operation_Flagship

        • ghostpepper 13 hours ago

          This must have been the inspiration for the Simpsons bit where the police set up a sting by offering a free boat giveaway

          https://www.youtube.com/watch?v=YJKHw_CNYP4

          • technothrasher 6 hours ago

            I recall an old episode of "COPS" from years ago where they showed an ongoing sting they had where they called people with warrants and told them they'd won a big screen TV and to come down to the warehouse to get it.

        • letmetweakit 7 hours ago

          How do you invite the fugitives to such an event? If you know how to reach them you can probably arrest them no?

          • rtsil 2 hours ago

            > For the marshals, arresting fugitives while away from home was significantly safer as they are often caught unarmed and off-guard.

          • 4gotunameagain 6 hours ago

            The article mentions:

              ..mail invitations to the last known addresses of approximately 3,000 wanted persons.   
            
            It is presumably much more efficient and effective use of resources to try and gather them in the same place, than individually surveilling 3,000 houses.
        • BolexNOLA 15 hours ago

          > At least half of the 3,309 fugitives arrested in FIST VII were later released on bail

          Lmfao god bless America right?

          That reminds me of one of my favorite lines in one of my favorite movies, Thank You for Smoking. seriously if you are reading this and have not watched it, stop what you’re doing and go watch it right now.

          Nick Naylor’s (a tobacco lobbyist) son asks, “dad, why is America the greatest country in the world?” Nick is reading something, doesn’t look up and takes a slight beat to think about it, then just calmly responds, “our endless appeal system.”

          That movie is unbelievable. I know out of context that line just seems like edge lord nonsense, but Aaron Eckhardt (sp?) just sells it so hard.

          • toyg 6 hours ago

            > our endless appeal system

            Mr Naylor's clearly never got involved with Italian justice, where the average criminal trial takes 4 and a half years as it goes through 3 judgement levels (the first sentence alone is likely to take more than a year). By law, a "reasonable" process is expected to take up to 6 years.

            As far as I can see, most criminal cases in the US are completed in less than a year.

            • BolexNOLA an hour ago

              Yes and no. It reeeally depends on the nature/scale of the crime and the kind of defense they can mount (I.e. can they afford excellent lawyers/have deep pockets).

          • cwillu 12 hours ago

            I'm curious what you think “released on bail” means?

            • Aurornis 11 hours ago

              What’s confusing about it?

              Bail is typically only granted to those who are not deemed substantial flight risks. Capturing fugitives and then turning around and releasing them on bail is ironic.

            • jojobas 12 hours ago

              Released to the general population with monitoring measures often inadequate to prevent disappearance or guarantee court appearances.

            • BolexNOLA 3 hours ago

              That’s a really poorly obscured way of saying “you don’t know what that means.”

              I know what posting bail means. I don’t need to explain it to you to prove it. I was just chuckling about TYFS at the end of the day.

      • cbsmith 9 hours ago

        s/catched/caught/g

    • tobyjsullivan 18 hours ago

      Hypothetically, how would someone know there was a warrant out for their arrest in another country? That doesn’t seem like public information.

      I figure most cyber criminals assume they are untraceable until they get arrested.

      • flatiron 3 hours ago

        I got a speeding ticket in Colorado on a business trip and later moved clients and thought to myself “meh I just won’t pay it I won’t be back to Colorado any time soon” and I was stopping entering the country on a trip from the Caribbean for “outstanding warrants”. If I can get stopped for that they should know if they have real criminal charges to not play around.

      • monerozcash 9 hours ago

        In this particular case the person arrested had been very publicly indicted years ago and was most certainly aware.

      • mito88 17 hours ago

        interpol

        • cwillu 12 hours ago

          Is “interpol” public information?

          • monerozcash 9 hours ago

            There are many sellers on .ru language darknet forums offering Interpol and Schengen information system lookups. In many countries every single police officer has access to this, it's not very hard to corrupt one person when the only requirement is that they be any police officer.

          • int0x29 12 hours ago

            If you have friends in the FSB, yes.

    • chc4 18 hours ago

      The human brain is just really bad at evaluating risk, especially over long periods of time. A lot of people are wanted overseas for years or even decades without anything happening, which makes it hard to maintain the mindset of being at risk without falling back to "eh, I've been fine this long"; a lot of them do foreign travel anyway and get away with it, which makes it hard to not fall into "what's one more vacation to a extradition-friendly country".

    • dbancajas 14 hours ago

      How can you ID these guys if they get a new passport. Changed hairstyle and do some surgery to the face?

      • kevin_thibedeau 3 hours ago

        The US doesn't protect the data broker industry for nothing. Unless you go no contact with your entire past life, they'll connect the dots.

      • normie3000 14 hours ago

        Their name and date of birth?

        • Cthulhu_ 7 hours ago

          With enough contacts and corrupt government officials those can be changed.

          Of course, there's also biometrics - since 9/11 especially the US takes your photo and fingerprint when you try to enter the country. Only a matter of time before DNA is added (honestly surprised it's not a thing yet).

    • anonym29 18 hours ago

      Italian and Greek airports: the bane of otherwise untouchable slavic cybercriminals since 1994

    • pnw 18 hours ago

      When you're living in the Russian-occupied part of Ukraine (Donetsk), I can see why you might run that risk.

      • anonym29 18 hours ago

        This was a Ukranian national, not a Russian.

        • dragonwriter 18 hours ago

          Yes and the sealed indictment from 2012 was unsealed in 2014, the same year as the Russian invasion of Crimea and Eastern Ukraine, which was also the direct trigger for Ukraine switching from a non-aligned position to seeking very close cooperation from the US.

          I can very easily see how home in both the narrow regional and broad national sense could have become quite risky for a number of reasons for him from 2014 on.

        • hunterpayne 11 hours ago

          152mm artillery shells don't care what your passport says.

    • johnQdeveloper 16 hours ago

      > Sources close to the investigation say Yuriy Igorevich Rybtsov, a 41-year-old from the Russia-controlled city of Donetsk, Ukraine

      I don't think it was casual traveling but getting out of a wartorn country.

    • lofaszvanitt 11 hours ago

      Just look at the profile pics of these people and you'll get the answer. They like to show bling, have a perceived invulnerability shield around them, and like to spend the ill gotten gains.

  • nine_k 19 hours ago

    «The Jabber Zeus name is derived from the malware they used — a custom version of the ZeuS banking trojan — that stole banking login credentials and would send the group a Jabber instant message each time a new victim entered a one-time passcode at a financial institution website. The gang targeted mostly small to mid-sized businesses, and they were an early pioneer of so-called “man-in-the-browser” attacks, malware that can silently intercept any data that victims submit in a web-based form.»

  • Plankaluel 7 hours ago

    It's shocking how much pictures influence judgment: Without reading much, at first, I thought: Poor guy, maybe he got pulled into something, ...

    Then I saw the pictures of him in a leopard fur pajama and indoor sunglasses, and with his (an assumption on my side) trophy wife, and thought: "Naah, he probably deserves it"

    • Thorrez 7 hours ago

      Those 2 pictures were of a different hacker, not of MrICQ.

      • Plankaluel 6 hours ago

        See, that's why you should read the article, I guess :D So the influence is even worse than I thought ...

  • scoopr 18 hours ago

    There is a bbc podcast[0] about evilcorp

    [0] https://www.bbc.co.uk/programmes/w3ct89y8

    • dewey 4 hours ago

      The podcast includes the author of that blog post and is also linked in the article.

      > Both Baldwin and I were interviewed at length for a new weekly six-part podcast by the BBC that delves deep into the history of Evil Corp.

  • morkalork 17 hours ago

    The included photos are glorious

    • k33n 14 hours ago

      Straight out of the 2001 film Swordfish

    • WD-42 15 hours ago

      This is how I want to picture Russian hackers and they didn’t disappoint.

      • GoblinSlayer 2 hours ago

        Frankly they look like managers who never wrote code.

      • nullorempty 8 hours ago

        Ukranian, technically.

        • kreyenborgi 8 hours ago

          Some ukr, some rus

          > the author of the original Zeus Trojan — Evgeniy Mikhailovich Bogachev, a Russian man who has long been on the FBI’s “Most Wanted” list.

  • sharts 5 hours ago

    Why keep in custody instead of sending to front lines to fight for freedom?

    • jfengel 4 hours ago

      The US is uncharacteristically free of front lines at the moment. At least, external ones.

  • gethly 9 hours ago

    > arrested in Italy and is now in custody in the United States

    unpopular opinion, but what is the point of having borders, countries and legal systems if they are all connected into one global unit giving merely an illusion of separation to groups of people?

    • jfengel 4 hours ago

      They aren't that connected. It's a loose affiliation.

      Even then, it's only when they agree. If the Italians liked him he would likely have been protected.

      • gethly 2 hours ago

        Kim Dotcom would disagree about the loose affiliation...

    • hnbad 3 hours ago

      They aren't. The US is just in a unique position where its projected force in most of the world is sufficient to make other governments mostly do what they want without them having to even say it.

      Of course the US is also apparently trying to change that at the moment by speedrunning an era of self-humiliation and wiping out its economic influence and "soft power" over the mistaken belief that you can strong-arm international negotiations with military power alone in the Atomic Age.

    • dragonwriter 8 hours ago

      > unpopular opinion, but what is the point of having borders, countries and legal systems if they are all connected into one global unit giving merely an illusion of separation to groups of people?

      You didn't state an opinion (unpopular or otherwise), you asked a question.

      But the question is very much like asking why have defined property rights, property lines, fences, etc., when people still engage in voluntary trade and other interactions.