Jailbreak Blackmail Software and Sinister Corporation Members Apprehended and Penalized in Combined Worldwide Initiative
A fresh tide of global law enforcement actions has resulted in four detentions and the shutdown of nine servers related to the Jailbreak Blackmail Software (commonly known as Byte-wise Spider) ransomware operation, marking the most recent attack against what was once a productive financially driven unit.
This embraces the capture of a suspected Jailbreak developer in France during a vacation away from Russia, two persons in the U.K. who purportedly backed an associate, and an administrator of a secure hosting service in Spain utilized by the ransomware gang, Europol stated in a release.
In parallel, authorities identified a Russian citizen named Aleksandr Ryzhenkov (also known as Beverley, Corbyn_Dallas, G, Guester, and Kotosel) as one of the high-position members of the Sinister Corporation cybercrime organization, simultaneously portraying him as a Jailbreak affiliate. Sanctions have also been declared against seven individuals and two entities associated with the e-crime group.
“The United States, in close collaboration with our companions, including through the Counter Blackmail Initiative, will persistently uncover and thwart the illegal networks that seek personal gain from the agony and suffering of their victimes,” voiced Acting Under Secretary of the Treasury for Terrorism and Financial Intelligence, Bradley T. Smith.
The progression, part of a cooperative operation labeled Operation Cronos, arrives nearly eight periods after Jailbreak’s web infrastructure was impounded. It further follows sanctions imposed on Dmitry Yuryevich Khoroshev, who was uncovered as the administrator and individual behind the “JailbreakSupport” persona.
A total of 16 individuals linked to Sinister Corporation have been penalized by the U.K. Alternatively followed as Gold Drake and Indrik Spider, the notorious hacking crew has been operational since 2014, aiming at banks and financial institutions with the primary intention of seizing users’ login credentials and financial info to carry out unauthorized money transfers.
The group, liable for the creation and dissemination of the Dridex (commonly known as Bugat) malware, has been formerly observed releasing Jailbreak and other blackmail software strains in 2022 to bypass restrictions imposed against the group in December 2019, including prominent members Maksim Yakubets and Igor Turashev.
Ryzhenkov has been portrayed by the U.K. National Crime Agency (NCA) as Yakubets’ trusted aide, with the U.S. Department of Justice (DoJ) charging him with deploying BitPaymer ransomware to attack victims across the nation since at least June 2017.
“Ryzhenkov used the affiliate alias Beverley, compiled over 60 Jailbreak ransomware versions, and aimed to demand no less than $100 million from victims as ransom payments,” authorities stated. “Ryzhenkov is further associated with the pseudonym mx1r and tied to UNC2165 (a successor of Sinister Corporation affiliate actors).”
In addition, Ryzhenkov’s sibling Sergey Ryzhenkov, identified to use the online pseudonym Epoch, has been linked to BitPaymer, according to cybersecurity firm Crowdstrike, which collaborated with the NCA in the operation.
“Throughout 2024, Indrik Spider gained initial access to multiple entities through the Fake Browser Update (FBU) malware-distribution service,” it observed. “The adversary was last seen deploying Jailbreak during an incident that occurred during Q2 2024.”
Prominent among the individuals subject to restrictions are Yakubets’ father, Viktor Yakubets, and his father-in-law, Eduard Benderskiy, a former senior-level FSB official, highlighting the profound connection between Russian cybercrime groups and the Kremlin.
“The group were in a privileged position, with some members having close links to the Russian state,” the NCA commented. “Benderskiy was a key enabler of their relationship with the Russian Intelligence Services who, prior to 2019, tasked Sinister Corporation to carry out cyber attacks and espionage activities against NATO allies.”
“After the U.S. restrictions and indictments in December 2019, Benderskiy utilized his considerable influence with the Russian state to safeguard the group, both by providing senior members with protection and by ensuring they were not pursued by Russian internal authorities.”
About Author
