Evil Corp: 3. Agents on the doorstep

Pibisi podcast on suomalaiset jälkeen. Peksi on suomalaiset jälkeen. - I joined as view academy on 17. - I spent 5 years in that academy. - Mikaila Sakali, or Misha, joined Ukraine's SPU Security Service straight out of high school. - Oh, yeah! - In Ukraine, there are service academies military academies that you can join. - By 24, his computer tech skills were clear. So when the FBI came to town with evidence of Ukrainian hackers stealing millions of dollars in the US - So basically financial fraud. - It was Misha who got the job of combing through their data. And mapping who was who in Ukraine. - First time I guess I heard about the case was sometime in spring 2010. - The FBI shared chat logs from inside the hackers own network. The Java server we've heard so much about. - A bunch of criminals discussing malware and deployment of that malware. - And Misha's stunned by the criminal's professionalism. - Like literally the criminal enterprise was all the roles. There was leadership. There was the malware team. There was a QA team. There was kind of a health desk. - A health desk? - Yeah, they're stealing all this money with the help of that malicious software Zeus. And we all know there's always glitches with any IT system. So these guys created their own IT health desk. - So all those roles were in relation to me that the criminal organization was a legal business. Now it's very established thing for criminals. But back then it was pretty new to me. - The Jabezouk crew was one of the first two professionalized cybercrime in this way. Today all serious hacker outfits do this. But Jabezouk really are the OGs. - We already know that gang extends beyond Ukraine to the UK and Russia. We also know the chat was about more than work. Talk of babies, toys and pizzas. It's what helped investigators trace them in the first place. - There was a lot of personal discussions. It was apparent that they actually knew each other in real life. That they spent time together, had fun together. - Misha zeroes in on tank, the apparent leader. - Tank was actually pretty well known in the nightlife in his city in Don Esk. He was kind of a DJ. - Tank played under the name DJ Slava Rich. - A photo from that era shows him in a club. Headphones slung around his neck, loud, floral shirt under a pinstripe waistcoat, topped with a sharp, trubby hat and oversized shades. - Beside him, dressed almost identically is another DJ. He agreed to talk to us as long as we don't use his name. - When you're working this scene for a long time, you start to see the difference between people who are really into music and those who just want to party. They don't really care about the music. You get what I mean. - So which category was he in? - He was more into the music. We just met at a club. He came up to talk about music. He was more interested in the music itself and the DJing process like, "How does it work? What is it?" "Where do you buy music? How do you produce it? How do you make tracks? How do you perform?" Those were the kinds of things he was curious about. - This DJ said tank didn't talk much about life outside the clubs, but he wasn't a sport. - Yeah, and he did boxing and played football. He wasn't very tall. He wasn't a glitch or a Tyson. He was short but solidly built. Stokki, we say, is beaty. Compact, strong. - It's great to actually spend time with him. It's great to actually speak to someone who knew him so often these cyber criminals are just hiding behind aliases. You never actually found out who they are. - Yeah, it definitely brings them to life. But it does seem that tank could never have given up his day job for the clubs. - I wouldn't say he was super popular. He never bragged, never tried to stand out. He was a clown guy. He was pretty well read, interesting, and knew a lot of things. He was always learning something. He'd read up on things. He was really into it. - Misha from Ukraine's SPU Security Service got a similar read on tank from the chats. He's a thinker. - My impression was that he was pretty smart in what he did. He was organizing all those people with that criminal goal. I guess he was pretty effective managers as well. Can you how to have fun and how to work if I can say work? - Work hard, play hard. Keep the mix tight and the cops off beat. But for how much longer? This is CyberHack, season three, evil core from the BBC World Service. I'm Sarah Rainsford, and I'm Joe Tidy. Episode three, agents on the doorstep. In June 2010, almost a year after the first Jabezu-svittims came forward. And around when Rookie FBI agent Jim Craig was downing vodka at the dacha, trying to set up an international sting operation, Ukrainian SPU investigator Misha Sakali, is also monitoring the Jabezu-svittims chat when he sees something that makes his blood run cold. - That part I remember pretty clearly because it was indeed probably the most shocking revelation out of all those chats. I've got that chat in front of me in Russian, and it's never been published before. Till now, only the criminals themselves and a few investigators have seen this. The chat is between Tank and a handle called Gooslik. They exchange greetings. Gooslik says, "Darava, Davnoa, Nieri, Daelis. Avshyemza, kaktabidus, fordit." That means, high, long time no see, we only talk when there's trouble. He puts a little half smiley at the end, but there is trouble. Gooslik has a warning. Lichens still vashy, all stunned over the night. They've identified you. - There is a guy who knows everything about you. He works with SPU in this case, works with Americans, and they know your real names. They know your handles. They know you are in the next, so be careful. - Wow. So, how does Tank respond? He's basically fuming, and he's baffled how someone has managed to identify him when he uses a nickname. He swears a lot. Then comes some friendly advice. - Make sure to sanitize your apartment, get rid of any information, never-dense in your places, and so camera as no-whose behind the door when somebody knocks on your door. Finally, Gooslik says, "Joppurislabliat njennužna", which to put it a little more politely means we need to be on our toes now. - Tank takes it seriously. He shares the warning with the group. They change aliases, but they keep using the Jabba server. For a while, then they stop. The server goes silent. The window on the criminals' world that's been open almost a year has now shut. Your thoroughfares are flying blind. Meanwhile, Misha sounds the alarm within the SBU. We have a mole. The hackers have an insider, and they know we're on to them. The response? - Basically, that manager just said that, "Yeah, I'll take a look." And then was it. So, I never heard of any kind of follow-up to that. We did write to the Ukrainian embassy in London to see if there was any knowledge of a mole in Operation Trident breach, but they never applied. That said, this was 15 years ago, a different era in Ukraine with a different government. - Word of the leak gets back to the FBI, too. Now, the criminals know the cops are onto them. - And the cops know the criminals know. - But do the criminals know that the cops know that they know? We don't know. - We do know this. - Rookie FBI special agent Jim Craig is back in Ukraine, boarding a train east to Donetsk. He wants to visit Tank personally. - The last time Jim Craig was in Ukraine, it was all handshakes and five-star dining. He spent an extraordinary day at the dacha of the head of the SBU, with agents from Russia's security system. service to the FSB and the Dutch high-tech crime unit. They'd all come together with one goal to take down the jabbers use crew. Three months later, Jim's back to execute the plan and to make arrests. He's hopeful, excited for the case, but also for the experience. First passenger train ride ever in my life. So it was unique. Ukrainian trains to be fair are pretty special. They haven't changed in decades. The carriages aligned with these cozy compartments or coupes. There's four bunks in each one and there's this little table with a cloth. And the Proudnitsa, there's this attendant who's usually a woman and she brings you glasses of tea and metal holders that clink on the table as a train rolls on. Very classy. It was very classy. Like I had to see a lot between heave and done yetsk. I clearly remember just kind of standing there, stirring out the window, looking over the countryside and at one point we went by a village where there was two young girls were getting water from a well. There's no electricity. I just remember thinking at that time, wow, I really haven't seen much of the world. It's 2010 in we still have individuals who don't have electricity or running water. All night, Jim lay restless on his bunk. While his FBI colleagues snored through the night, Jim was thinking about the victims back home. Hundreds, thousands of small businesses and lives ruined millions of dollars stolen, funneled through networks in the UK, Russia and beyond. The money all heading to his destination, Donetsk. Executing a very large cyber operation that can weigh heavily and you want everything to go right. This is my case, but there's a lot of people involved from all over the world. So you want things to be successful. So I don't know that would have slept anyway. Donetsk, the end of the line and the beginning of a reckoning. Someone's luck is about to run out. Jim in Donetsk is just one player in what's become an international operation. Across Europe, police forces are lining up for coordinated strikes on the Javasuz crew. It was big. It was a huge operation. There was a lot to put together because you're, you know, talking all the operations in Russia in Moscow and St. Petersburg. And then we had a Kiev Donetsk in Ukraine. In the Netherlands, we had the Heitek Rims unit who was helping us monitor communications during that time. That's not all. The FBI are planning to swoop on money meals in New York and the British police are in on it too. So many moving parts. In London, Detective Sergeant Simon Williams is running covert surveillance on the UK suspects. We've already heard how we track down the gang's local boss, Mr. Pizza. Now he's juggling a whole cast of suspects. And one of his money mules is on the verge of blowing the whole operation. I was Ops Controller. So my role in that is to be the decision maker around what the surveillance activity for the day looks like. One day, Simon tells his team to follow a man who'd been seen driving Mr. Pizza around. He comes out his front door. He gets into his car and he drives off the Woolwich Magistrates Court, which was a bit bizarre. We weren't expecting that. The suspect parts his blue Volvo outside the courthouse in Southeast London and heads inside a plane close office of Folism in. Moments later, the suspect is in front of a judge and found guilty of drink driving. Whilst he's in court, he's told, right, your band do not drive surrender your driving license and you're going to get a fine. He came straight out of court, ignored all of that, went round the corner to the back of the court, jumped in his car and drove off to the pub. And guess who he meets in the pub? Some of his fellow money mules. This is a delicate moment for Simon. Multiple suspects are hanging out together. He's pretty sure that they'll go from the pub to an ATM and withdraw stolen money to send back to Ukraine. What an opportunity to catch them in the act. But. You've got somebody that is by now banned from driving, who has also gone down the pub and continued to drink, by the way. There's obviously huge risk there. So what do they do? The man's been banned for drink driving and has completely ignored the court. What do you think gets behind the wheel and gets into an accident or worse, kills someone? Simon has seconds to decide. Hi, this is Oliver Conway from the Global News Podcast. We have the latest on the escalating conflict between the US and Iran as both nations step up their threats. For that and the rest of the day's main story search for the Global News Podcast, wherever you get your BBC podcasts. In a pub in Southeast London, Detective Simon Williams of London's Metropolitan Police is on the brink of a breakthrough in his case against the Jabba Zeus crew. But one suspect has handed him a dangerous dilemma. We had to be very careful about just how much he drunk whilst he was in the pub. And, you know, make pretty on the spot tactical decisions as to whether we needed our uniform colleagues to come and detain him for disqualified driving. But the decision was made to condone a bit of disqualified driving just so that we didn't compromise the whole investigation and show our hand in terms of what we knew he was up to. But before he has too much, the suspect leaves the pub with Simon's detectives on his tail. He drove a short distance after coming out of the pub and went to a cash point and started withdrawing funds. Officers note the date and time. They can now work with the bank to trace the account. Simon can breathe again. The gamble to hold off on arresting him has paid off. We'd have lost the opportunity to build up evidence. Not just about him but of the wider group in terms of the money that had been transferred into his account that day and tracking that back to ultimately Koola Barber and the other people in the Jabba Zeus crew. That last name, Koola Barber, we know him as Mr. Toy. He's the guy who asked Mr. Pizza to buy his son a Thomas the Tank Engine model. Mr. Toy is Mr. Pizza's boss. He's based in Ukraine, but he is known to visit the UK sometimes. And when he books a ticket to visit the UK in September 2010, he unknowingly sets a number of wheels in motion. Simon's been tracking Mr. Toy and his wife, Mrs. Toy, who appears to be a moneymule. We already knew what their passport details looked like and it's possible to put them on a sort of watch list. So as soon as we kind of know that they've made a booking to come to the UK, we'd have been made aware of that. Now the clock is ticking. Where are they going to stay? Do we have the opportunity to probe their hotel room if they're picking up a car at the airport? Do we have an opportunity to put a tracker on it to put audio and video in it? The resources Simon's willing to throw at tracking Mr. Toy, tell you what a big fish he is. And when Mr. and Mrs. Toy finally land in the UK, they go straight to visit their friend in East London. They're met by Mr. Pizza, who takes them back to his place in Chingford, where Simon's team are already watching the front door. The time is ripe for an arrest, but Simon needs to be sure everything is lined up. If they're going to nap, Jabba Zeus is UK crew. Coordinating, you know, 20 arrests, 28 house searches, it's a massive undertaking. 28 addresses. Imagine the pressure. You have to go through the door at a similar time, otherwise, you know, the jungle drums would beat and they would know it's up and not go home. This is a big moment for the British cops. But those 28 addresses are just one front in a much wider war on the Jabba Zeus crew. Now add you crane, add Russia, add the need for every door to go down at the same moment. That's the job Jim Craig is facing in Danyatsk and his clock's ticking too. Jim steps from his train full of nervous energy. He wants to get straight to the hotel, freshen up and get to work. The plan is for the raids to happen almost right away. But while Jim and his FBI colleagues have spent months gathering the testimony of victims and all the online intel to drive this case, it's the Ukrainian who are calling the shots on the ground. And when he arrives at his hotel, Ukrainians have a message. We're not ready. A day passes, same message. We're not ready. And again, we're not ready. Not a lot of details forthcoming as to why, so we waited. Jim and his fellow FBI agents speculate what might be going on. But ultimately, they're left in the dark. Days roll by. We're not ready. What were you doing on this time? (LAUGHS) Touring done yet. Every day we took a different walking route to kind of look around. They even got a tour of a new football stadium. The whole city was being spruced up for the 2012 Euros. It was absolutely beautiful. It was very interesting. We got very much an inside look at the operations of the maintenance of the grass, all the customized lighting that was on the ground. kept the grass so perfectly maintained and growing and it was an amazing tour and then just, you know, sometimes we just have meetings between ourselves as far as what to expect when we do get the opportunity just to move forward with. So lots of sitting around in restaurants and in hotels, waiting and twiddling a thumbs? Yes, unfortunately. This goes on for more than a week. I were not ready. He must have been dying inside. Back in London, no one's twiddling their thumbs. Detective Sergeant Simon Williams is getting ready to kick indoors. He's consulted with the FBI and everyone's agreed. With so many suspects in their sights, they can't wait anymore. He's briefing the rapid entry teams. The officers in helmets and body armor, carrying battering rams and shields. They're the ones who usually go up against the most dangerous criminals. And they're a bit puzzled. Why are they needed to take down a bunch of cyborrux? Why do you need us? If you've got a dangerous dog, no. Firearms, it's just we'll need to go and get a load of other kit if it's a firearm. No, not a firearm. Okay, so you've got a dangerous offender in there that's slightly armed with what a knife, you know, what's going on? Why do you need us? No, we need you to go in and make sure someone doesn't close their laptop. Really? Oh, that's interesting. And it kind of is all that muscle, all that kit just to stop someone from folding shut a laptop. But Simon wants them in quickly because once a laptop's closed, cracking the security code is almost impossible. The whole operation relies on the element of surprise. Just before dawn on September 28, 2010, it's a go. British police hit all 28 addresses and make 19 arrests, 15 men and four women, all are from Eastern Europe. Among them are the local ring leaders, Mr. Pizza, Mr. and Mrs. Toy. Oh, and that man who'd already been convicted for drink driving. Officers also seize stacks of evidence. Some of the premises they were, you know, a complete enough of fraud factory. There are phones and laptops and a paper trail of fake bank accounts. If you are opening that volume of bank accounts at scale, you have to be a little bit regimented in your approach otherwise you can get caught out. Simon remembers seeing folders filled with files, listing the details of scores of fake identities. Within each sleeve, it was very organized, very regimented. You had the fake identity document used to open the account. You had the current account bank statements, you had a credit card account, card and statements and you had literally everything per identity, per bank account, or very neatly organized in these sleeves. Now he realizes just how sophisticated this criminal operation is. There was one particular individual's photograph that got used in multiple fake identity documents used to open bank accounts in the UK. And the fakes were totally convincing. I've looked at some of these, I've had them right in front of me and I'm like, I have no idea whether this is genuine or not. But Simon's on a high. The raids have been a success. The UK ring leaders at the Jabba Zeus crew, Mr. Toy and Mr. Pizza are now in custody. Their organization taken out from under them. That said, they're not offering any help tracing those up the chain in Ukraine. They'd refused to really go into details about any other of their co-conspirators, they'd refused to talk to us. Simon's raids deliver arrests, but not many answers. The gang's UK players are keeping their secrets. So now there's even more riding on the team in Donetsk. Two days after the raids in Britain, the Ukrainians are finally ready. There are some 50 SBU officers, as well as tactical units, preparing to raid eight addresses. The FBI's Jim Craig rides along. It was very late at night, it was super dark, which of course I had a little bit of concern about former marine, so I usually don't get too concerned about things anymore, but again, I'm in a very unfamiliar territory by myself in a suit, unarmed of course. There's been no intelligence that the suspects are dangerous, but police in Britain did find a couple of guns in their raids. In Donetsk, Jim is outside one of the suspect's homes. In a big van, with an SBU rapid entry team, heavily armed. Seats were all ripped out, and these guys with automatic weapons, smoking cigarettes and a swat suit. And I'm by myself and it's super dark, and I can't speak. I look at Ukrainian, so I can't communicate and just hanging out with them, waiting for the time where they can go in. Finally, the Ukrainians stop out their cigarettes and make their move. Jim follows them in once they say it's safe. When you make entry on a search warrant, usually the mood is very uneasy, there's different types of excitement within the individuals who obviously are making entry into their home. Even trained operators like Jim Craig can't know how people will react when agents crash through their front door. It could be fear or anger. Either way, there's usually some kind of excitement. There was very little excitement. In fact, his wife was speaking with the SBU-swat individuals laughing in the kitchen. And the suspect himself was sitting on the edge of his couch and like his underwear and like a smoking jacket, like a velvet robe or something he had designs on it, if I remember right. One of the SBU officers from Keith, he spoke English, he said, "I want you to show him your badge. I want him to know that the FBI, the United States is here in Donetsk and I want him to see that." Jim pulls out his badge and tells the suspect why he's there. It's an international sting against the Jabba's use crew. The suspect, a man named Petrovich, doesn't flinch. "It had no effect. That's when things kind of started to settle in between the laughing in the kitchen and Petrovich not being concerned at all." I was like, "Yeah, this something's not right." This is only one of eight addresses on the night's list of raids. Elsewhere, officers are getting ready to reel in the big fish. The man they think is in charge of the global operation, Vyashislav Pentchikov, aka Tank. First, the SBU head to Tank's parents' home, the SWAT team go in, and again, the mood is relaxed. They're just chatting with Tank's parents. Tank is nowhere to be seen. "And then after that, we did make our way towards Tank's apartment. We were told to wait in the car, so we were in the car for quite some time and they finally came out open the door and said, "All right, you guys can come in." And we get to the door, the door opens and I say, "There's nobody's been in this place for a long time." Nothing was out of order. There was no mess. The bed was perfect, like a hotel. It's perfectly flat. It's very tight. The TV's not on. You could tell that they've been gone a while. The place was cleaned and Tank was nowhere to be found. And it's in this moment after months of planning and coordinating and hoping, the penny finally drops. "Oh, jeez, I see what we're going here. Obviously, they've all been tipped off." The disappointment doesn't end there. Tank has got away. It seems he has friends in useful places, but there's still his partner in crime, Aqua. So the FBI turned to the Russians. After all, they had agreed to play their own part in this series of international raids that's co-named Operation Trident Breach. "Hey, where are we at? Are we going? We've executed Trident Breach down and done yet, and in the Netherlands too. So where are you?" And it was just darkness. They just would give you nothing at all. Even the people you've been drinking vodka were around that table. "Yes, even those four individuals that came and sat with us at the opera and joy to drink and I gentleman's chat and then over to the dacha and still after all that nothing." Frustration, anger, shame. Jim's left with a toxic mix of emotions. "He takes stock. Yes, the main suspect in Russia, Aqua, remains untouched." But 16 months after the case opened, the Jabezuz crew is disrupted. Jim's seized a huge amount of new data in Danyetsk. Dozens of money mules have been arrested in New York. Key Lieutenant's are in custody in the UK. The group's boss, Tank, is on the run. "It's progress. Where did Tank go? How did the man who played as DJ Slava Rich slip away?" "Well, I asked him, 'Hello, how are you?' I'm good, I'm good." DJ Slava Rich, Tank, head of the Jabezuz crew, one of the world's most wanted hackers. "What do I call you?" "You can call me Slava. Slava." "The ZF got my friend called me." That's next time on CyberHack. This has been Episode 3 of Season 3 of CyberHack Evil Corps from the BBC World Service. We would like as many people as possible to hear our stories, so please leave a rating and a review and do tell others about CyberHack. It really does help. If you haven't already, don't forget to check out the two previous seasons of CyberHack. The story of the Lazarus Heist. It's a story that begins in Hollywood and ends for now with the biggest heist in the history of crypto. Investigators blame North Korea and say the money's being used to finance its nuclear weapons and missile development programs. Pyongyang denies involvement. Cyberhack Ibu Khor is a BBC long-form audio production for the BBC World Service. It's presented by me, Joe Tidy. And me, Sarah Reinsard.