FBI-Wanted Leader of the Notorious Zeus Botnet Gang Arrested in Geneva

A Ukrainian national who has been wanted by the U.S for over a
decade has been arrested by Swiss authorities for his role in a
notorious cybercriminal ring that stole millions of dollars from
victims’ bank accounts using malware called Zeus.

Vyacheslav Igorevich Penchukov, who went by online pseu­do­nyms
“tank” and “father,” is said to have been involved in the
day-to-day operations of the group. He was apprehended on October
23, 2022, and is pending extradition to the U.S.

Details of the arrest were first reported^[1]
by independent security journalist Brian Krebs.

Penchukov, along with Ivan Viktorovich Klepikov (aka “petrovich”
and “nowhere”) and Alexey Dmitrievich Bron (aka “thehead”), was
first charged^[2]
in the District of Nebraska in August 2012.

According to court documents released by the U.S. Depart of
Justice (DoJ) in 2014, Penchukov and eight other members of the
cybercriminal group infected^[3]
“thousands of business computers” with Zeus^[4], which is capable of
stealing passwords, account numbers, and other information relevant
to log into online banking accounts.

These captured credentials were then used to siphon funds from
the accounts, with the DoJ calling^[5]
the Jabber Zeus gang a “wide-ranging racketeering enterprise.”

The Zeus banking trojan is believed to have been authored by an
anonymous individual who is only known by the handle lucky12345, a
WIRED report^[6]
from 2017 said, describing Penchukov as a well-known local DJ with
a penchant for high-end BMWs and Porsches.

More importantly, machines infected by the “endlessly adaptable”
malware could be folded into a botnet whose power can be harnessed
to carry out distributed denial-of-service (DDoS) attacks.

A successor to Zeus, known as Gameover Zeus^[7]
and which functioned as a peer-to-peer botnet^[8], was temporarily
disrupted in 2014 as part of an international law enforcement
operation codenamed Tovar^[9].

All the defendants have been accused of conspiracy to
participate in racketeering activity, conspiracy to commit computer
fraud and identity theft, aggravated identity theft, and multiple
counts of bank fraud.

Two of his co-conspirators, Yevhen Kulibaba (aka “jonni”) and
Yuriy Konovalenko (aka “jtk0”), pleaded guilty in November 2014
after being extradited from the U.K.^[10] and were sentenced to
two years and 10 months of incarceration on May 28, 2015.