Alleged Jabber Zeus Coder 'MrICQ' in U.S. Custody

(krebsonsecurity.com)

167 points | by todsacerdoti 23 hours ago

8 comments

  • mikkupikku 21 hours ago
    Imagine having these sort of warrants hanging over your head and just casually deciding to do a little international traveling. Guys like this are constantly getting nabbed this way. I wonder if being a wanted man for so long has some sort of psychological effect that makes people take more risks to get it over with.
    • irjustin 19 hours ago
      I imagine the general assumption is that you don't realize that you've been ID'ed. That they traveled before and nothing happened so traveling again isn't a big deal because all the "tricks" they used to cover their tracks worked.
      • Gibbon1 12 hours ago
        Friend of mine has a story from 50 years ago. Guy he knew was dealing coke. Got spooked and stopped selling. Three years later he thought it'd all blown over. Set up a another deal and got popped.

        Another friend that worked IT at a slaughter house said one of the bikers that worked their said, the feds aren't good at figuring you out. But when they do they never stop watching you.

        • matwood 11 hours ago
          There’s knowing something and building a case to prove it in court. With drugs in particular the police tend want the higher up people so will watch the others for a long time.
    • manquer 16 hours ago
      I would imagine that is lot more likely that is just only the official story rather than what actually happens behind the scenes in these situations.

      In the background there could be deals with the countries protecting them or with the target directly or a existing deal they had is off now. It may even be unrelated, wasn't worth expending the diplomatic capital before, but they are a connection to someone else more important and so on.

      It could also be the targets were captured in a illegal way, no country wants to be diplomatically humiliated and the prosecuting one wouldn't want to disclose their covert ops capabilities.

      Announced News is more often only a Press Release, we shouldn't be taking them literally.

      • which 5 hours ago
        Relatedly about another member of the same group:

        > Penchukov’s political connections helped him evade prosecution by Ukrainian cybercrime investigators for many years. The late son of former Ukrainian President Victor Yanukovych (Victor Yanukovych Jr.) would serve as godfather to Tank’s daughter Miloslava... Sources briefed on the investigation into Penchukov said that in 2010 — at a time when the Security Service of Ukraine (SBU) was preparing to serve search warrants on Tank and his crew — Tank received a tip that the SBU was coming to raid his home.

        https://krebsonsecurity.com/2022/11/top-zeus-botnet-suspect-...

      • _zoltan_ 11 hours ago
        if you read the article it links to an Italian supreme court summary that apparently states he has lost his appeal to not get extradited, so after that it shouldn't have been a surprise that... he was extradited.
      • ribosometronome 13 hours ago
        >captured in a illegal way

        Tracked down in an illegal way? Sure, quite possibly. But he's going to get a trial. If he were kidnapped out of Italy by the CIA or something, it seems like it would be hard to keep that from coming out.

        • aswegs8 10 hours ago
          Why should the CIA need to kidnap someone from Italy if they can just provide info about the person to the Italian govt so he gets arrested and extradited?
          • serallak 5 hours ago
            Well about that ...

            https://en.wikipedia.org/wiki/Abu_Omar_case

            This is well know case of a "person of interest" kidnapped by the CIA in Milano, Italy. While the CIA was assisted by the Italian Intelligence, it was a completely illegal operation, without any due process or judiciary oversight.

          • Cthulhu_ 10 hours ago
            If the CIA is involved it wouldn't be any regular criminal, but e.g. an international spy, someone who may even be protected by Italy for ??? reasons.
            • hnbad 6 hours ago
              Sure but "not a regular criminal" is a much broader group than you make it out to be.

              Remember the CIA was also the primary actor involved in the US's overseas bombing attacks, especially outside active war zones. Sure, a lot of the bombings targeted "terrorists" but that designation is ultimately arbitrary - especially if we're talking about people being killed in bombings of civilian areas that usually came with a lot of collateral damage (especially if you don't use the assumption that anyone who may have been a teenage or adult male is an enemy combatant), a practice that we would identify as "terrorism" if carried out by any hostile regime.

              He doesn't seem to have big enough of a target on his back to justify outright exploding him but that doesn't mean he's considered a "regular criminal" or that the CIA wasn't involved.

              That said, Occam's razor suggests it didn't require CIA involvement to catch him - he may just have been careless and unlucky.

          • rasz 3 hours ago
            Because Italy has a history of siding with terrorists and letting them go

            https://en.wikipedia.org/wiki/Achille_Lauro_hijacking#Jurisd...

            "Following a deal made with Yasser Arafat with Giulio Andreotti[25] even before the Craxi government had made its final decision, Abbas and Badrakkan, wearing unidentified uniforms, had been put back on the EgyptAir 737 airliner."

          • stefantalpalaru 7 hours ago
            [dead]
        • manquer 5 hours ago
          I wasn't talking about this specific case.

          It was about general statement by the parent on how these criminals can be so be dumb, i was enumerating some of the different ways it can happen behind the scenes and still be annouced as a simple arrest at the airport etc.

    • slightwinder 3 hours ago
      There could be errors happening outside their control. Planes are sometimes rerouted to different countries for different reasons, but mainly weather-related. I've heard stories of travel agencies f**ing up travel planes because of wrong data, and people suing them because of unexcepted stops. Or the good old "they planned for Australia, but ended in Austria"-story. Happens far too often.. There are many targets where people confuse a city or country with a different target.
    • reisse 18 hours ago
      From the other point of view, the abundance of stories when the high-profile criminal was catched doing something stupid, and the relative absence of ones when the criminal was catched in some clever way may mean the law enforcement is doing their job poorly.
      • Polizeiposaune 18 hours ago
        Operation Flagship in 1985 was one of the clever ones -- US marshalls nabbed 101 wanted fugitives on a single day at a stadium, where they were expecting to receive two free tickets to an NFL game...

        https://en.wikipedia.org/wiki/Operation_Flagship

        • ghostpepper 15 hours ago
          This must have been the inspiration for the Simpsons bit where the police set up a sting by offering a free boat giveaway

          https://www.youtube.com/watch?v=YJKHw_CNYP4

          • technothrasher 8 hours ago
            I recall an old episode of "COPS" from years ago where they showed an ongoing sting they had where they called people with warrants and told them they'd won a big screen TV and to come down to the warehouse to get it.
        • letmetweakit 9 hours ago
          How do you invite the fugitives to such an event? If you know how to reach them you can probably arrest them no?
          • rtsil 4 hours ago
            > For the marshals, arresting fugitives while away from home was significantly safer as they are often caught unarmed and off-guard.
          • 4gotunameagain 8 hours ago
            The article mentions:

              ..mail invitations to the last known addresses of approximately 3,000 wanted persons.   
            
            It is presumably much more efficient and effective use of resources to try and gather them in the same place, than individually surveilling 3,000 houses.
        • BolexNOLA 17 hours ago
          > At least half of the 3,309 fugitives arrested in FIST VII were later released on bail

          Lmfao god bless America right?

          That reminds me of one of my favorite lines in one of my favorite movies, Thank You for Smoking. seriously if you are reading this and have not watched it, stop what you’re doing and go watch it right now.

          Nick Naylor’s (a tobacco lobbyist) son asks, “dad, why is America the greatest country in the world?” Nick is reading something, doesn’t look up and takes a slight beat to think about it, then just calmly responds, “our endless appeal system.”

          That movie is unbelievable. I know out of context that line just seems like edge lord nonsense, but Aaron Eckhardt (sp?) just sells it so hard.

          • toyg 8 hours ago
            > our endless appeal system

            Mr Naylor's clearly never got involved with Italian justice, where the average criminal trial takes 4 and a half years as it goes through 3 judgement levels (the first sentence alone is likely to take more than a year). By law, a "reasonable" process is expected to take up to 6 years.

            As far as I can see, most criminal cases in the US are completed in less than a year.

            • BolexNOLA 3 hours ago
              Yes and no. It reeeally depends on the nature/scale of the crime and the kind of defense they can mount (I.e. can they afford excellent lawyers/have deep pockets).
          • cwillu 14 hours ago
            I'm curious what you think “released on bail” means?
            • Aurornis 13 hours ago
              What’s confusing about it?

              Bail is typically only granted to those who are not deemed substantial flight risks. Capturing fugitives and then turning around and releasing them on bail is ironic.

            • jojobas 14 hours ago
              Released to the general population with monitoring measures often inadequate to prevent disappearance or guarantee court appearances.
            • BolexNOLA 5 hours ago
              That’s a really poorly obscured way of saying “you don’t know what that means.”

              I know what posting bail means. I don’t need to explain it to you to prove it. I was just chuckling about TYFS at the end of the day.

      • cbsmith 11 hours ago
        s/catched/caught/g
    • tobyjsullivan 20 hours ago
      Hypothetically, how would someone know there was a warrant out for their arrest in another country? That doesn’t seem like public information.

      I figure most cyber criminals assume they are untraceable until they get arrested.

      • flatiron 5 hours ago
        I got a speeding ticket in Colorado on a business trip and later moved clients and thought to myself “meh I just won’t pay it I won’t be back to Colorado any time soon” and I was stopping entering the country on a trip from the Caribbean for “outstanding warrants”. If I can get stopped for that they should know if they have real criminal charges to not play around.
      • monerozcash 11 hours ago
        In this particular case the person arrested had been very publicly indicted years ago and was most certainly aware.
      • mito88 19 hours ago
        interpol
        • cwillu 15 hours ago
          Is “interpol” public information?
          • monerozcash 11 hours ago
            There are many sellers on .ru language darknet forums offering Interpol and Schengen information system lookups. In many countries every single police officer has access to this, it's not very hard to corrupt one person when the only requirement is that they be any police officer.
          • int0x29 14 hours ago
            If you have friends in the FSB, yes.
    • chc4 20 hours ago
      The human brain is just really bad at evaluating risk, especially over long periods of time. A lot of people are wanted overseas for years or even decades without anything happening, which makes it hard to maintain the mindset of being at risk without falling back to "eh, I've been fine this long"; a lot of them do foreign travel anyway and get away with it, which makes it hard to not fall into "what's one more vacation to a extradition-friendly country".
    • dbancajas 16 hours ago
      How can you ID these guys if they get a new passport. Changed hairstyle and do some surgery to the face?
      • kevin_thibedeau 5 hours ago
        The US doesn't protect the data broker industry for nothing. Unless you go no contact with your entire past life, they'll connect the dots.
      • normie3000 16 hours ago
        Their name and date of birth?
        • Cthulhu_ 9 hours ago
          With enough contacts and corrupt government officials those can be changed.

          Of course, there's also biometrics - since 9/11 especially the US takes your photo and fingerprint when you try to enter the country. Only a matter of time before DNA is added (honestly surprised it's not a thing yet).

    • anonym29 20 hours ago
      Italian and Greek airports: the bane of otherwise untouchable slavic cybercriminals since 1994
    • pnw 20 hours ago
      When you're living in the Russian-occupied part of Ukraine (Donetsk), I can see why you might run that risk.
      • anonym29 20 hours ago
        This was a Ukranian national, not a Russian.
        • dragonwriter 20 hours ago
          Yes and the sealed indictment from 2012 was unsealed in 2014, the same year as the Russian invasion of Crimea and Eastern Ukraine, which was also the direct trigger for Ukraine switching from a non-aligned position to seeking very close cooperation from the US.

          I can very easily see how home in both the narrow regional and broad national sense could have become quite risky for a number of reasons for him from 2014 on.

        • hunterpayne 13 hours ago
          152mm artillery shells don't care what your passport says.
    • johnQdeveloper 18 hours ago
      > Sources close to the investigation say Yuriy Igorevich Rybtsov, a 41-year-old from the Russia-controlled city of Donetsk, Ukraine

      I don't think it was casual traveling but getting out of a wartorn country.

    • lofaszvanitt 13 hours ago
      Just look at the profile pics of these people and you'll get the answer. They like to show bling, have a perceived invulnerability shield around them, and like to spend the ill gotten gains.
  • nine_k 21 hours ago
    «The Jabber Zeus name is derived from the malware they used — a custom version of the ZeuS banking trojan — that stole banking login credentials and would send the group a Jabber instant message each time a new victim entered a one-time passcode at a financial institution website. The gang targeted mostly small to mid-sized businesses, and they were an early pioneer of so-called “man-in-the-browser” attacks, malware that can silently intercept any data that victims submit in a web-based form.»
  • Plankaluel 9 hours ago
    It's shocking how much pictures influence judgment: Without reading much, at first, I thought: Poor guy, maybe he got pulled into something, ...

    Then I saw the pictures of him in a leopard fur pajama and indoor sunglasses, and with his (an assumption on my side) trophy wife, and thought: "Naah, he probably deserves it"

    • Thorrez 9 hours ago
      Those 2 pictures were of a different hacker, not of MrICQ.
      • Plankaluel 9 hours ago
        See, that's why you should read the article, I guess :D So the influence is even worse than I thought ...
  • scoopr 20 hours ago
    There is a bbc podcast[0] about evilcorp

    [0] https://www.bbc.co.uk/programmes/w3ct89y8

    • dewey 6 hours ago
      The podcast includes the author of that blog post and is also linked in the article.

      > Both Baldwin and I were interviewed at length for a new weekly six-part podcast by the BBC that delves deep into the history of Evil Corp.

  • morkalork 19 hours ago
    The included photos are glorious
    • k33n 17 hours ago
      Straight out of the 2001 film Swordfish
    • WD-42 17 hours ago
      This is how I want to picture Russian hackers and they didn’t disappoint.
      • GoblinSlayer 4 hours ago
        Frankly they look like managers who never wrote code.
      • nullorempty 11 hours ago
        Ukranian, technically.
        • kreyenborgi 10 hours ago
          Some ukr, some rus

          > the author of the original Zeus Trojan — Evgeniy Mikhailovich Bogachev, a Russian man who has long been on the FBI’s “Most Wanted” list.

  • sharts 7 hours ago
    Why keep in custody instead of sending to front lines to fight for freedom?
    • jfengel 6 hours ago
      The US is uncharacteristically free of front lines at the moment. At least, external ones.
  • gethly 11 hours ago
    > arrested in Italy and is now in custody in the United States

    unpopular opinion, but what is the point of having borders, countries and legal systems if they are all connected into one global unit giving merely an illusion of separation to groups of people?

    • jfengel 6 hours ago
      They aren't that connected. It's a loose affiliation.

      Even then, it's only when they agree. If the Italians liked him he would likely have been protected.

      • gethly 5 hours ago
        Kim Dotcom would disagree about the loose affiliation...
    • hnbad 6 hours ago
      They aren't. The US is just in a unique position where its projected force in most of the world is sufficient to make other governments mostly do what they want without them having to even say it.

      Of course the US is also apparently trying to change that at the moment by speedrunning an era of self-humiliation and wiping out its economic influence and "soft power" over the mistaken belief that you can strong-arm international negotiations with military power alone in the Atomic Age.

    • dragonwriter 11 hours ago
      > unpopular opinion, but what is the point of having borders, countries and legal systems if they are all connected into one global unit giving merely an illusion of separation to groups of people?

      You didn't state an opinion (unpopular or otherwise), you asked a question.

      But the question is very much like asking why have defined property rights, property lines, fences, etc., when people still engage in voluntary trade and other interactions.