For more than a decade, Vyacheslav Igorevich Penchukov, a Ukrainian who used the online hacker name “Tank,” managed to evade police. When the FBI and Ukrainian officials raided his Donetsk apartment in 2010, the place was deserted and Penchukov had disappeared. But the crime spree came to an abrupt halt in late 2022, when he traveled to Switzerland, was arrested and extradited to the United States.
Today, in a U.S. federal court in Lincoln, Nebraska, a judge sentenced Penchukov to two concurrent nine-year sentences after he pleaded guilty to two counts of conspiracy to engage in racketeering and conspiracy to commit wire fraud. U.S. District Judge John M. Gerrard also ordered Penchukov to pay more than $73 million, according to court records. The court also ordered three years of supervised release on each count and said they should run concurrently.
Both charges carried a maximum sentence of up to 20 years each. However, according to court documents, the U.S. government and Penchukov’s lawyers requested a less severe sentence after he signed a plea agreement in February. It is unclear what the terms of the plea agreement were. At the time, Documents showPenchukov could also have to pay up to $70 million. “I understand that, but I don’t have that amount of money,” he said in court earlier this year.
The US prosecution of Penchukov – who has been on the FBI’s “most wanted” list for more than a decade – is a rare blow against one of the best-connected leaders of a prolific cybercriminal gang of the 2010s. It also highlights the ongoing challenges facing Western law enforcement authorities when cracking down on Eastern European cybercriminals, particularly those based in Russia or Ukraine, which do not have extradition agreements with the US.
Before the sentencing, the Justice Department declined to comment on the case, and the FBI and Penchukov’s lawyers did not respond to WIRED’s requests for comment.
When the Ukrainian pleaded guilty in February—He had several charges dropped after signing the plea agreement— admitted to being one of the leaders of the Jabber Zeus hacking group, which started in 2009 and used the Zeus malware to infect computers and steal people’s bank account information. The group used the details to log into accounts, withdraw money and then send it to various money mules, stealing tens of millions from small American and European businesses.
“The defendant played a crucial role, a leadership role, in this scheme by directing and coordinating the exchange of stolen banking credentials and money mules,” prosecutors said. he said in court earlier this yearThey stole thousands of dollars from the victim companies, often emptying their accounts.
Penchukov, who was also a Well-known DJ in UkraineHe also admitted to playing a key role in orchestrating the IcedID malware (also known as Bokbot), which collected victims’ financial data and enabled the deployment of ransomware on the systems. He was involved from November 2018 through at least February 2021, authorities say. Investigators found that he maintained a spreadsheet detailing the $19.9 million in revenue IcedID earned in 2021.