X

The FBI's most wanted cybercriminals

For the past few years, the FBI has been keeping a separate list of the US' most wanted cybercriminals. Time to take a look at who's still on it -- in no particular order.
By Catalin Cimpanu, Contributor
Dridex mastermind
1 of 19 Image: FBI

Dridex mastermind

In December 2019, the US charged the mastermind behind the infamous Dridex malware, a Russian national named Maksim Victorovich Yakubets. He is the FBI's most wanted cybercriminal, with US authorities willing to pay up to $5 million for any information that may lead to his arrest.

Igor Turashev, one of the Dridex botnet administrators, was also charged, but for a minor role in the scheme.

Bogachev
2 of 19 Catalin Cimpanu/ZDNET

GameOver Zeus botnet mastermind

Evgeniy Mikhaylovich Bogachev, known as "Slavik" is a malware author who created and operated the GameOver Zeus banking trojan and adjacent botnet.

After he was charged in 2014 for the theft of over $100 million from GameOver Zeus victims, Bogachev is believed to have become a close collaborator of Russian intelligence agencies. The FBI is willing to pay up to $3 million for any information that may lead to his arrest.

Sandworm
3 of 19 Image: FBI

Sandworm

In October 2020, the DOJ charged six Russian nationals it believed were part of Sandworm, a group of military hackers who carried out destructive cyber-attacks on behalf of the Russian government.

The US said the hackers were responsible for developing and launching the NotPetya ransomware outbreak, the OlympicDestroyer destructive malware against the PyeongChang 2018 Winter Olympics hosts, the Macron Leaks attacks against the French government election in 2017, and the BlackEnergy and KillDisk attacks against Ukraine's power grid in 2015 and 2016.

DNC hackers
4 of 19 Catalin Cimpanu/ZDNET

DNC hackers

On July 13, 2018, US authorities finally charged a group of Russian hackers for the infamous DNC hacks of 2015 and 2016, an incident during which two Russian cyber-espionage units breached and stole data from the servers of the Democratic National Committee. This information was later released online as part of a political influence campaign to support Donald Trump's candidacy for the US Presidency.

Twelve Russian military officers were charged. They are believed to be part of either the APT28 (Fancy Bear) or APT29 (Cozy Bear) cyber-espionage groups.

Yahoo hackers
5 of 19 Catalin Cimpanu/ZDNET

Yahoo hackers

Back in March 2017, the US Department of Justice charged four hackers with breaching Yahoo in 2014 and stealing data on 500 million users.

One, named Karim Baratov, was arrested in Canada, and extradited to the US, where he eventually received a sentence of five years in prison.

The other three, including two officers of FSB intelligence officers, are still at large, believed to reside in Russia. Their names are Alexsey Belan, Dmitriy Aleksandrovich Dokuchayev, and Igor Suchin.

IRGC hackers
6 of 19 Catalin Cimpanu/ZDNET

IRGC hackers

In February 2019, the US charged four Iranian nationals for conspiring with a former US Air Force intelligence agent who defected to Iran in 2013. The group used intelligence provided by the US Air Force agent to launch phishing attacks over email and social media.

One of the four hackers, Behzad Mesri, had been previously charged in November 2017 with hacking HBO and leaking unreleased episodes and scripts for HBO TV series, including from HBO's primetime show Game of Thrones.

Anthem hacker
7 of 19 Catalin Cimpanu/ZDNET

Anthem hackers

Another highly sought-after hacker is Fujie Wang, the only member of a larger group of hackers who was identified by his real name and who participated in the Anthem hack of 2014.

Believed to be a member of a Chinese cyber-espionage unit, Wang is still at large in China. He was formally charged earlier this month.

APT41
8 of 19 Image: FBI

APT41

In September 2020, the US Department of Justice charged five hackers believed to be part of APT41, one of China's most active state-sponsored hacking crew.

According to charges, US officials said the group breached more than 100 companies across the world, along with two government networks. Their attacks focused on intelligence gathering, but the group also engaged in financially-motivated attacks during their personal time, attacking video game companies and stealing in-game currency, ransomware attacks, and running crypto-mining botnets.

SAE hackers
9 of 19 Catalin Cimpanu/ZDNET

Syrian Electronic Army hackers

In March 2016, the US charged three members of the Syrian Electronic Army hacker outfit. One was arrested and extradited to the US, but two are still at large, namely Ahmad Al Agha and Firas Dardar.

Lazarus Group member
10 of 19 Catalin Cimpanu/ZDNET

Lazarus Group member

In September 2018, US authorities charged Park Jin Hyok, a 34-year-old North Korean, with a litany of charges based on his membership in the Lazarus Group, a North Korean government-backed hacking unit.

He stands accused of participating in the WannaCry ransomware outbreak, the 2016 Bangladesh Central Bank cyber-heist, attempts at hacking US defense contractor Lockheed Martin in 2016, the 2014 Sony Pictures hack, breaches at US movie theatre chains AMC Theatres and Mammoth Screen in 2014, and a long string of attacks and successful hacks against cryptocurrency exchanges.

Zeus hackers
11 of 19 Catalin Cimpanu/ZDNET

Zeus gang

Charged way back in 2014, this group of hackers has operated the Zeus banking trojan. US authorities charged nine hackers, three of which are still at large.

Since their indictment, the source code of the Zeus trojan was leaked online, and has become the inspiration and codebase for tens of other banking trojan strains.

Mabna hackers
12 of 19 Catalin Cimpanu/ZDNET

Mabna hackers

Charged in March 2018, this group of Iranian state-sponsored hackers has been accused of hacking into the networks of 320 universities across the world.

The group was also known as Cobalt Dickens or Silent Librarian in the reports of various cybersecurity firms, and continued its hacking activities despite US charges.

Goznym gang
13 of 19 Catalin Cimpanu/ZDNET

Goznym gang

Following years of work, US and European authorities announced charges against seven hackers who worked on distributing the Goznym banking trojan. Two were arrested, while five are still on the run, believed to be in Russia.

APT10 hackers
14 of 19 Catalin Cimpanu/ZDNET

APT10 hackers

Another group of hackers on the payroll of a foreign government is the duo of Zhu Hua and Zhang Shilong. Believed to be part of a Chinese cyber-espionage group known as APT10, they were charged in December 2018 with hacking more than 45 US companies, US government agencies, and several managed service providers. Victims include IBM, HPE, and Visma.

SamSam crew
15 of 19 Catalin Cimpanu/ZDNET

SamSam crew

Another team of Iranian hackers is the one formed by 34-year old Faramarz Shahi Savandi and 27-year old Mohammad Mehdi Shah Mansouri -- collectively known as the operators of the SamSam ransomware.

Charged in November 2018, they are responsible for one of the most prolific ransomware strains around, which they used for attacks targeted at one organization at a time, a tactic they pioneered back in 2015, and which is now the most prevalent and successful type of ransomware attack today, also known as "big game hunting."

WADA hackers
16 of 19 Catalin Cimpanu/ZDNET

WADA hackers

In October 2018, US authorities charged seven Russian nationals believed to be members of the GRU military intelligence agency. US officials said the group engaged in a retaliatory action against several sports organizations after Russian athletes were banned from the Rio 2016 Summer Olympics on allegations of doping.

The seven, acting under the fake personas of Anonymous and the Fancy Bears hacking groups, breached the World Anti-Doping Agency (WADA), the United States Anti-Doping Agency (USADA), and other victim entities during the 2016 Summer Olympics and Paralympics and afterwards, stealing and then dumping sensitive records online as part of efforts to discredit the world's most famous athletes and anti-doping organizations.

Iran DDOS attackers
17 of 19 Catalin Cimpanu/ZDNET

Iran DDOS attackers

In early 2016, the US charged seven Iranian hackers for launching a series of coordinated DDoS attacks against US companies in the banking and financial sector. One of these attacks also hit a New York dam, putting US authorities on alert.

The DDoS attacks were retaliation from Iranian authorities after the Stuxnet attacks orchestrated by the US and Israel against Iran's nuclear program.

Epsilon hacker
18 of 19 Catalin Cimpanu/ZDNET

Epsilon hacker

Viet Quoc Nguyen is the last of the three hackers who breached email provider Epsilon in 2011. He was accused of stealing marketing data, including a list of over one billion email addresses. He was also a notorious spammer.

ArrowTech hackers
19 of 19 Catalin Cimpanu/ZDNET

ArrowTech hackers

In July 2017, US authorities charged two Iranian hackers named Mohammed Reza Rezakhah and Mohammed Saeed Ajily for the hack of ArrowTech, a supplier of military technology for the US army.

According to the indictment, the two hacked ArrowTech in 2016, from which they stole a software application named Projectile Rocket Ordnance Design and Analysis System (PRODAS), used in the design of bullets, missiles, and other military projectiles.

Related Galleries

Holiday wallpaper for your phone: Christmas, Hanukkah, New Year's, and winter scenes
Holiday lights in Central Park background

Related Galleries

Holiday wallpaper for your phone: Christmas, Hanukkah, New Year's, and winter scenes

21 Photos
Winter backgrounds for your next virtual meeting
Wooden lodge in pine forest with heavy snow reflection on Lake O'hara at Yoho national park

Related Galleries

Winter backgrounds for your next virtual meeting

21 Photos
Holiday backgrounds for Zoom: Christmas cheer, New Year's Eve, Hanukkah and winter scenes
3D Rendering Christmas interior

Related Galleries

Holiday backgrounds for Zoom: Christmas cheer, New Year's Eve, Hanukkah and winter scenes

21 Photos
Hyundai Ioniq 5 and Kia EV6: Electric vehicle extravaganza
img-8825

Related Galleries

Hyundai Ioniq 5 and Kia EV6: Electric vehicle extravaganza

26 Photos
A weekend with Google's Chrome OS Flex
img-9792-2

Related Galleries

A weekend with Google's Chrome OS Flex

22 Photos
Cybersecurity flaws, customer experiences, smartphone losses, and more: ZDNet's research roundup
shutterstock-1024665187.jpg

Related Galleries

Cybersecurity flaws, customer experiences, smartphone losses, and more: ZDNet's research roundup

8 Photos
Inside a fake $20 '16TB external M.2 SSD'
Full of promises!

Related Galleries

Inside a fake $20 '16TB external M.2 SSD'

8 Photos