Loading story…
Ukrainian national Yuriy Igorevich Rybtsov, known online as 'MrICQ', was extradited from Italy to the United States to face cybercrime charges related to his alleged role as a developer and operator within the Jabber Zeus cybercrime group. Rybtsov, who was arrested in Italy and lost his final appeal against extradition in April 2025, arrived in Nebraska under an FBI warrant and is now awaiting trial. Investigators allege that Rybtsov helped operate the Jabber Zeus group by handling real-time alerts of newly compromised victims and laundering stolen funds through electronic exchanges, with connections to other prominent group members including Vyacheslav "Tank" Penchukov, Maksim "Aqua" Yakubets, and Evgeniy Bogachev.
The Jabber Zeus group used a modified version of the Zeus banking trojan, featuring a real-time Jabber alert system called Leprechaun, to steal online banking credentials from small and mid-sized businesses. The group captured sensitive data such as account numbers and one-time passwords, enabling them to make fraudulent transfers to U.S. bank accounts controlled by money mules. Authorities report that the group laundered millions of dollars through networks in the UK, U.S., and Ukraine, and that Rybtsov played a key role in both technical operations and financial laundering activities.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
U.S. authorities gained custody of a suspect identified as a developer for the Jabber Zeus cybercrime gang after he was extradited from Italy. Multiple reports on November 3, 2025 described the individual, also referred to as 'MrICQ,' as a suspected coder tied to the group.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Vyacheslav Igorevich Penchukov, a Ukrainian national known as **"Tank"** and **"Father,"** pleaded guilty in the United States to **RICO conspiracy** and **wire fraud conspiracy** for his role in long-running cybercrime schemes tied to the **Zeus** and **IcedID** malware operations. U.S. authorities said Penchukov helped lead groups that infected thousands of computers, stole tens of millions of dollars from businesses, and used banking trojans, phishing, man-in-the-browser tactics, and money mule networks to drain victim accounts. Prosecutors also said the malware activity enabled follow-on intrusions, including ransomware deployment, and reporting has linked Penchukov to the **Maze** and **Egregor** ecosystems. Penchukov was arrested in Switzerland in 2022 after years of allegedly evading law enforcement in Ukraine, then extradited to the United States in 2023. His case connects to a broader international campaign against the Zeus cybercrime infrastructure, including earlier U.S.-led action against the **Gameover Zeus** botnet and **CryptoLocker** ransomware, as well as prosecutions of bulletproof hosting operators that supported malware families such as **Zeus**, **SpyEye**, and **Citadel**. The guilty plea marks a significant step in a multinational effort to dismantle the criminal services, hosting networks, and operators behind major banking malware and ransomware activity.
Aug 15, 2026
Aleksei Olegovich Volkov, a Russian national, pleaded guilty in the United States to charges related to his role as an initial access broker (IAB) for the Yanluowang ransomware group. Volkov provided access to at least seven U.S. organizations between July 2021 and November 2022, enabling the deployment of ransomware that resulted in ransom demands ranging from $300,000 to $15 million. He received a percentage of the ransom payments, including $94,259 from a $500,000 ransom and $162,220 from a $1 million ransom, and was ordered to pay nearly $9.2 million in restitution to affected organizations. Volkov's activities were uncovered through digital forensics, including chat logs, cryptocurrency records, and social media accounts, and he was extradited to the U.S. after being apprehended in Rome. The indictment and plea agreement detail Volkov's collaboration with co-conspirators, his use of aliases such as "chubaka.kor," and his involvement in negotiating ransom payments and providing network credentials to the Yanluowang group. The attacks affected a range of U.S. businesses, including engineering firms, banks, and telecommunications providers, with some victims able to restore from backups and avoid ransom payments. Volkov faces up to 53 years in prison for charges including access device fraud, aggravated identity theft, and conspiracy to commit money laundering and computer fraud.
Jun 29, 2026
U.S. prosecutors charged Russian national **Denis Nikolayevich Obrezko** with conspiracy to commit unauthorized computer access for allegedly providing infrastructure used by the Kremlin-linked espionage group **Void Blizzard**, also tracked as **Laundry Bear**. After his transfer from Thailand to Boston, Obrezko appeared in federal court over accusations that he bought a virtual private server and internet domains through cryptocurrency transactions that enabled intrusions against U.S. and foreign targets. Thai authorities arrested him in Phuket during a joint operation with the FBI and seized laptops, mobile phones, and cryptocurrency wallets. An unsealed FBI affidavit says investigators confirmed compromises at **11 U.S. companies** between June and July 2024, while assessing that the real number of victims is likely higher. Authorities and researchers said Void Blizzard has targeted government, defense, transportation, media, healthcare, educational institutions, NGOs, critical infrastructure, and organizations across Europe, North America, NATO countries, and Ukraine, using stolen credentials, session tokens, VPNs, and U.S.-based proxy services to evade detection. The group has also been linked to spear-phishing with typosquatted Microsoft-themed domains such as `miscrsosoft[.]com` and `micsrosoftonline[.]com`, and to theft of Dutch police staff contact information.
Jun 29, 2026