Evil Corp: 4. The insider

Pipsy podcast on suurin jälkeen. Aloita ilmainen kokeilu Shopify piste komsi vuos tolla. Available now on the documentary from the BBC World Service. We meet Alan as he grapples with his father Harry Hath complicated history as a Holocaust survivor and boxer. Harry's story reveals the cost of survival, a legacy shaped by trauma, rage and the loss of faith that followed him long after the war ended. Listen now by searching for the documentary wherever you get your BBC podcasts. Welcome to CyberHack. Episodes are released weekly wherever you get your podcasts. But if you're in the UK, you can listen to the latest episode or week early, first on BBC Sounds. Okay, ready? This call is from a federal prison. You may begin speaking now. Hello. Hello. Hello. How are you? I'm good, I'm good. What do I call you? You can call me Slava. Slava. That's how my friend called me. Slava, right? I wouldn't say we're friends. This is the first time we've spoken. In fact, it's the first time he's spoken to any reporter. Till now, he's just been tanked. The elusive Jabezouk Kingpin. His identity has always been slippery. Born Vitchislav Kensju Koff in Ukraine in 1986, at 29, he made the FBI's most wanted list and changed his surname to Andriyv. Today at 39, he's prison of 46154 510. 15 years after slipping through the FBI's fingers in Donetsk, he's now serving time in a federal prison in Colorado. Things could be better, but I hope next maybe a couple of months this part of my story life will be over. Do people know that you're a convicted hacker? A few of them, yes, but majority doesn't care. So you haven't had any trouble in that prison? Yeah, yeah, exactly. I'm not the trouble maker. I don't think his thousands of victims who saw their bank accounts drained would agree. Tanks in prison after he confessed to being involved in malware schemes that stole tens of millions of dollars. In more than 10 years covering cybercrime, I've never spoken directly to such a senior criminal. I see no, no very big deal with visiting me here. You just need to make one call to a responsible person from the staff. And your documents get in a pool and you can come visit me any day during the weekend or federal holidays. He wanted a visitor. We wanted some answers. How did he get started? Who is he working with? And how exactly did he get caught? To find out, I filled in the paperwork and flew out to Colorado because Viasislav Penschikov, aka Tank, isn't just any cyber criminal. He's the man who can fill in the missing pieces of a story that I've been chasing for years. The hunt for the alleged boss of evil core. Tank says he knows him, worked with him, hung out with his family, even helped him rise to the top. This is CyberHack Season 3 Evil Core from the BBC World Service. I'm Joe Tidy. And I'm Sarah Rainsford. Episode 4, The Insider. Just outside the correctional facility where Slava is being held. I can see the Rocky Mountains in the background. There's a very tall pole with American flag. The actual correctional facility or prison is a really low-rise building, vast, a big one. There's watchtowers I can see where presumably there will be guards watching me right now. And then there's a metal fence that you can see through all the way around with Barb Wyatt. And we're about to go in. We're about to meet Sava for the first time. It's going to be very interesting. We headed to the US to meet Tank face to face, because his phone time is limited and we had a lot of questions. Unfortunately, the prison doesn't allow any kind of recording devices, which isn't great for making a podcast. So Joe and our producer had to go back to basics, taking in just pens and notepads. They talked to Tank for six hours over two days. What you're about to hear is a summary of that conversation based on their notes, reconstructed with an actor. The visitor's room in the Englewood correctional facility is bright and clean, with rows of plastic chairs bolted to the floor and a number of vending machines humming along the back wall. There are washrooms and even a kid's play zone. This is a low security prison and the room is empty when we arrive. We grab seats at the only table in the corner just off the entrance. A few moments pass, then we hear the click and the door opens. A head pops around the corner. The face immediately breaks into a wide smile and offers a cheeky wink. It's Tank. You're in a good mood? Yeah, for a lot of people being arrested is the end of life. But it's not like that for me. Sure the first two months after my arrest was a nightmare, but as soon as you understand you can change your situation, everything changes. I'm using this time to get as much benefit for myself. Tank looks well. He says he's been working out. He's muscular and his lightly tan skin looks healthy. He says he's cut out sugar and is learning to play tennis. He tells me he's also been exercising his mind as well. His top priority is to master English. When he was arrested in 2022, it was only basic. Now speaking to us, he is fluent, though he does keep a well-thumbed Russian to English dictionary by his side. He's also taking French lessons and he's completed the equivalent of a US high school diploma. It took him a month. You must be smart. Not smart enough. I'm in prison. He's quick with the jokes, but his crimes are serious. In 2024, Tank pleaded guilty to involvement in two conspiracies, almost a decade apart. The Jabba Zeus hacks of 2009 to 2010 and a ransomware campaign that ran from 2018 to 21. He was facing up to 40 years in prison. Last July, a judge sentenced him to nine years. That's the public story, but I wanted the private one. I've spent years investigating how young men get pulled into cybercrime. To understand how Vyacheslav Penschikov became Tank the criminal, we need to go back to his teenage years, growing up in Ukraine. I had a comfortable childhood. The family language was Russian, but I spoke Ukrainian too. I was 13 when my dad brought home our first computer. It was a simple Pentium 2 machine. This was 1999, less than a decade after Ukraine gained independence from the Soviet Union. Back then, internet access was limited and expensive, so Tank clearly came from a fairly well-to-do family. When I finally did get a dial-up connection, I spent hours online. When the first phone bill came through, it was huge. It was a scandal. Money seems to have been important for Tank, even from the beginning. Almost right away on that simple computer, he started learning web languages such as HTML. Before long, he was building websites for legitimate businesses. It was a very exclusive service. There weren't many Russian or Ukrainian web companies, so I could make money. Good, mate? Yeah, but it wasn't enough. Tank began to spend more time online, hanging out in forums. He started learning tips on how to cheat in his favourite video games, like FIFA 99 and Counter Strike. Then, he began picking up cheats for the real world. We set up fake websites selling fake goods. Then, you stolen credit card details to buy those products from ourselves. The credit card companies would pay out like it was a real sale. This is a twist on carding, a staple of the early days of cybercrime. It was a popular trick. Did you ever feel guilty? We didn't think about consequences. We wanted freedom, independence from our families. What were you buying? Be your own. could close, expensive shoes, and outshove the money at school, what teenager doesn't like to brag a bit. By the early 2000s, cybercrime was professionalizing. Tank is one of an estimated 6,000 cyber criminals who joined CARDA Planet, a marketplace that emerged at the turn of the millennium. It was a place to trade stolen data and hacking services, all highly illegal. The US authorities called it a premier criminal online bazaar. It was a boom time. CARDA Planet offered loads of opportunities. It was a major platform with guys who shared the same goal. You could learn how to do more scams, conduct fishing campaigns, and learn how to run new malware. I was impressed with all the ways to make more money. Soon, Tank says he was stealing tens of thousands of dollars a month. Even now that's a lot of money, and back then it was a fortune. Tank began to stand out. At 18, he brought his first car, a grey Subaru WRX. It was the fanciest car of any teenager in the city. So what did your parents say when you showed up with a car? I was using their ignorance of the internet to explain things. Did you lie? I wasn't a hundred percent honest. Tank says he felt superior to the other kids with cars. He knows they hadn't earned them. Their parents had handed them everything. Except Tank hadn't earned anything either. He was stealing. CARDA Planet shut down in 2004. Its founders feared the police were closing in. After that, many of the criminal forums went private. If he wanted in, someone had to vouch for you. By now, Tank was an established cyber criminal. He had no trouble getting in. And that's where he noticed a new piece of malware on the digital black market with an ancient name. Zeus. Yeah, that's Zeus. It was a new era. It was a bull. Zeus was malware for hire, and Tank saw its potential immediately. Online banking was exploding and so were the chances to steal money. But some banks were fighting back with two factor authentication. Customers first had to supply a username and a password, then a one-time code. A tricky problem for a criminal, but not for malware, named after a god. Zeus solved this problem by going inside the victim's browser and waiting for the perfect moment. When the victim tried logging into their bank, Zeus grabbed the username and password. Then, when the bank asked for that one-time code, victims would type it in, thinking everything was normal. But Zeus intercepted that code before the bank ever saw it. It went straight to the criminals who could log in from their own machine and drain the accounts. Tank loved the idea and began building a crew around Zeus. I became a VIP client of Zeus. I was paying top money for access and service. The service was horrible, but the code was great. Do you consider yourself a hacker? I have deep computer knowledge, but I'm not a hacker. I'm a financial guy and a manager. Really? For regular people, I am a hacker. But I don't have hacker skills. I was using vulnerabilities in the banking system. So Tank never actually wrote Zeus code? No, but this is actually quite common in cybercrime. No hacker I've spoken to likes to say they're a hacker. They really play down their technical skills. Probably because so few of them actually write the code. With Zeus, it was another hacker called Lucky12345. But Tank was instrumental in improving it. He found a flaw. Those one-time passwords that banks send out, they expire quickly. So criminals needed to be on their computers at the same moment the victims were. That meant a lot of sitting and waiting. My goal was to make money and make the amount bigger. I was always looking for ways to improve the money making process. If only there was a way to know precisely when a victim was trying to log in. And then it hits him. Jabba. Jabba. The messaging system that was popular at the time. Using Jabba was my idea. I asked the Zeus author to write it into the code for us to use exclusively. Now he'd get pinged every time someone tried to log in. And so Jabba Zeus was born. Tank turns to the forum to find the specialists he'll need to run Jabba Zeus. Someone to handle the fishing campaign. Someone else to organize money mules in the US. Those people who'd wire the money across Eastern Europe and Russia. And then someone to get the money from there back to him in Dunyetsk. We had an office in the center of Dunyetsk. It wasn't the force floor. Who were you working with? Friends, partners from before. There were four of us. I was the head of the office. And what did the office look like? Nothing special. There was a meeting room. There was coffee as you come in. It was quite bare. I remember I bought myself a comfortable chair. What kind of hours were you keeping at that time? We worked from about 2pm until midnight. The odd hours overlap with the workday in the United States when victims were on their computers. Soon, Tank and his crew were raking in money. British and American authorities say they stole millions. But Tank says the FBI wildly exaggerated how much they actually stole. He wouldn't give us a precise figure for how much he took. But he did say that that's it's peak. He personally was making around $200,000 a month. Where's the money now? Well, he says he doesn't have anything like the $54 million the court has ordered him to pay in restitution. I asked if he brought property or anything with long-term value or had cash hidden away. He just leaned back in his seat and gestured as if he was throwing money out to his pockets. I was changing cars like changing clothes. How many did you have? At one point I had six. All expansive German ones. Did you ever worry about your victims? There was always this view that all the stolen money was being repaid by insurance. I was never aware that they weren't getting their money back. Very convenient. Did he ever even check? No, and I pressed him on this. And reminded him he stole from small family businesses, small town treasurers, even charities. I didn't always know who the victims were. I was really ashamed when I found out about that. It sounds like he never gave them a second thought, even a first thought. No, though his wife wasn't happy with what he was doing. He got married in December 2008, had his baby in 2009. Remember, he bragged about it in the jabbage hat. And the FBI placed the first two victims around that same time, the summer of 2009. Correct. And Tang says even as Zeus was taking off, he was already thinking of quitting. My wife is my equal. She knew what I was doing, but she knew I wasn't a hardened criminal. I wasn't selling drugs or killing people. He was cleaning people out. Did she want you to quit? Of course. Interesting. Tang talked about this in the online chat transcript we got hold of. This one section where he vents about clicking, which I'm pretty sure is slang for cybercrime. He curses a lot. So what I'll give you is something of a sanitized translation. He says, "Suka, nie ušto i psorokliat klatsapri djotse." Which is, will I really still have to be clicking away at 40? Then he goes on. I hope I'm done with this by 25. Other aspect is pretty purple. No, there are yellows. I am so sick of all this clicking. He was 23 at the time, already tired of living on the wrong side of the law. Yeah, and the person he's chatting with seems to agree. Kajštji norum čovieks tremitsa kaboliam ja nije legalu. Every normal person wants to move towards something more or less legal. More or less legal. There's the dream. Not legal, just less illegal. But wanting out didn't make him safe. Success brought riches. But also suspicion and mistrust. Paranoia is the constant friend of all cyber criminals. But you know what? Sometimes they are out to get you. And in 2010, people were onto tank and they were closing in. That was one of the big questions I had going into the prison, 15 years later. How did he escape the FBI that night in Donetsk? Olen Schennen-Maldenado. The police and the police are taking the blame on the police. The police were trying to find out the truth of the police. They were trying to find out the truth of the police. All the police were trying to find out the truth of the police. kuten varaston suunnittelu ovat kätävästi dashboardissa. Aloita ilmainen kokeilu Shopify piste komsivustolla. M下去ahtaa olla v пуongan muista ja tiistä peru käyttö YOltuön кошin. T best� blankiina jääЧто院 tuli mukavaa avantu不用. On n кош Präsidentin tuoulut palsi, vokan miserableisde, ja supava oli 36. 2010 tuli - ilman hän. Täällä on näitä 8 000 km peru käyttöä, joten hän on näitä tämän tämän tämän, kun on jälkeen jälkeen. Tän ei ole koko. Tän on koko. Tän on koko. Tän on, että jälkeen on jälkeen. Tän on koko. Tän on noin, että he ovat koko. Tän on tämän, mitä jälkeen. Katsotaan sedaan, että menee metin? Se on koko koko koko koko. Täällä on koko koko koko, että sedaan koko. Täällä koko koko, että sedaan koko. Tän ei sen, että sedaan koko. Obrane, prezidentan, ukraine. Viktor Jynnen Kovic, From Danyesk. The new president's son, Victor Jr., was a member of parliament and also tanks best friend, bordering on family. Jim Craig from the FBI knew all about this. One of his good friends was Jacobovic's son, who was actually Godfather, to tank's daughter when she was born. So that's a pretty heavy connection when you're talking about the former president of Ukraine. So he had friends in pretty high places? He had friends in very high places. Tank told me about his best friend. He was five years older than me and we really got along. It was a great friendship. So Tank was connected. That's not necessarily a get out of jail card, but in Ukraine at that time, it could be helpful. I pressed Tank for more about what he knew about the FBI raids. I'd been planning for a raid for a while and that summer, I knew something could happen. I'd received a message saying you should be aware they have your name. So I had a million dollars in cash in safety deposit boxes around town. Because I knew if Ukrainian police found it in my home, I would never get it back. A million dollars in cash. I thought he said he didn't save much money. Last episode, we heard how someone called Goose-thick had told him in the Jabba chat that he was being watched. So did he know any details like the date and the time of a raid? He says not. I asked him several times. Did someone in the Ukrainian authorities specifically warn of the raid? The answer was always no. But the chat transcripts do show he had an inside connection. No, our cops just did a bad job. It was the arrest in the UK from two days earlier. That's the arrest of Mr. Pizza and Mr. Toi. And the arrest of that side of the operation in London. I had a call from the UK telling me it had happened. So immediately we started raising devices and clearing stuff out of our homes. Remember, Jim Craig had been in Danyetsk at that very time ready to go. But the Ukrainians kept telling him "We're not ready. We're not ready. We're not ready." Finally, they were ready. But Tank wasn't. There is thinking you're ready for something. And then there is the thing itself. That night I went out to play football. Afterwards my parents called me saying the cops were raiding their home. This matches what Jim told us. They went to Tank's parents first and then to his apartment. Then my wife called. "Where are you?" I told her and she came to meet me. We got into my car. It was an Audi S8 with a 500 horsepower lumber guinea engine. Sounds fast. I was driving us to a friend's apartment. I told her this will all be over very soon. Then I noticed the car with its flashing light on behind us. I told my wife Luke we have some cops. The cops are behind him when the light in front of him turns red. He stops. But then. I pushed the gas pedal. It gave me a chance to test the full capability of my car. I lost them from my vision very soon. Tank and his wife race away. "Where is your baby when all this was happening?" With my mother-in-law. So where did you go? Danieck is not a big city. I had a lot of connections. I left the Audi in a friend's garage and went to stay with another friend. I laid low for a couple of weeks. Every day I was smoking on the balcony, pacing, looking out for people. Eventually, Tank just went home. And here's the crazy thing. About 50 agents of the Ukrainian security services had been involved in Operation Trident Breach. The raids coordinated by Jim Craig. After they were done and the FBI agents left, Tank says the authorities never really bothered him again. Like none of it had even happened. There was no indictment from a prosecutor. There were no victims in Ukraine. I had the presumption of incidents. So Tank insists no one tips him off directly about the raid. Do you believe him? While parts of his story match the facts as the British and American authorities have them, the British did execute their raids two days ahead of the Ukrainians. That certainly could have put Tank on alert. Still, Tank had plenty of contacts in Donjetsk, including a best friend who was an MP and whose father was the president. We don't know whether that helped, but some investigators, including Jim Craig, have speculated. Absolutely, you know he's pretty much untouchable because of his connections with Yanukovic. There are allegations against Yanukovic himself on there. Yeah, after he was driven from power in 2014, protesters and journalists overround his vast estate and they found almost obscene opulence. There were golden bathrooms. There was even a zoo. There's a report from Transparency International alleges Yanukovic stole as much as $37 billion in state funds. And he's still under EU sanctions. He's in Russia these days and he says all the charges are political. As for the president's son, Victor Jr., the godfather to Tank's daughter, he died in 2015. He was driving his car on a frozen lake when it fell through the ice, unable to undo his seatbelt, he'd round. While the police raids in Ukraine may not have brought Viasislev Penshikov, aka Tank, to justice, they did seemingly scare him straight, at least for a while. As far as Tank was concerned, the Jabezoukru was done. But British and American officials say one member wasn't through with cybercrime. In fact, he was just getting started. The man or authorities have seen trading messages with Tank, about business, their babies and more. The man only known as Aqua. The one FBI agent Jim Craig thinks is running money meals from Moscow. Tank says Aqua first approached him before the Jabezoukru stays in one of those private criminal forums. When I met him, he was at the beginning of his cybercrime journey. He was looking for the best ways to develop his skills. He was looking for his niche. Tank helped him find it. When he was assembling the Jabezoukru, he called on Aqua to be his cash-out man. in Eastern Europe. He was just trying to money mules for me. Was he a good business partner? I would say neutral. He was not stealing from me. Aqua made sure the money mules in the West were sending to banks across Russia and Eastern Europe would get to tank in Danyask, minus his cut of course. Together they were stealing a lot of money, so Aqua had a lot of work to do. Tank says Aqua set up his own office in Moscow, like him. And as the money flowed in, he too brought his own fleet of luxury cars. Sound familiar? We had loads in common. We were about the same age, we both had babies, we got along like a house on fire. Were you friends? Yes. Now I distinguish between work and friends. But if you're in the crime world, they're really anal friends. Like then, there was no distinction. In the autumn of 2009, tank flies to Moscow to hang out with Aqua for the first time. Till now, they've only known each other online. I spent about two days there. He met me at the airport. He was a skinny guy and he had bodyguards with him. I actually wondered if he brought them just to show off for me. I actually think he was trying to show off quite a bit. He was spending so much money beyond even what we were making and his car had a flashing light on top. I think he means a megalca. That's the blue light that police and politicians have and other people with money and connections. Over two days, tank and Aqua hang out. They hit Moscow's finest restaurants and clubs. Aqua's big brother drifts in and out of the picture too. Aqua goes back home to Danyetsk, but of course the two are in constant contact electronically. We know the FBI are able to see those conversations. In one chat, tank writes, "I don't talk on the telephone from work, but I can give you my personal phone number." Aqua replies, "Just send it to my email." "Did you receive it?" "I'll check now." Big mistake. As well Russian authorities didn't join the raids in 2009, they didn't entirely ignore Aqua either. They traced the email and unveiled his real identity. According to the FBI, Russian investigators found messages to Aqua and an order for a baby carriage caught out by online shopping again. The order lists an address in Moscow and a phone number. The Russians monitor that number and find out it belongs to… Maxine Jakobjets. The same name we first heard in episode one. Maxine Jakobets of Moscow, Russia, has been indicted in Pittsburgh, Pennsylvania for his alleged role as the leader of a cyber criminal gang who with the stroke of a key in the click of a mouse committed cyber crimes across the globe. He's earned his place on the FBI's list of the world's most wanted cyber criminals. Maxine has never traveled to the United States to answer those charges. The FBI identified him because of an email I sent him. His wife also used the email address to buy a pram. "Do you feel bad for being the one who helped out him?" "No. It's part of crime. You need to deal with the consequences." A single email helped to finally put Maxine Jakobets on the FBI's radar. But Tank says it didn't stop him. In fact, it was just the beginning. He had a taste for easy money. He wasn't a hacker, but he had management skills. He finally found his role as the leader of a cyber group. Next time on CyberHack Evil Call, the rise of Maxine Jakobets and the downfall of Tank. This has been Episode 4 of 6 of Season 3 of CyberHack Evil Call from the BBC World Service. We'd like as many people as possible to hear our stories, so please leave a rating and a review and do tell others about CyberHack. It really does help. To ensure you never miss an episode of CyberHack, follow or subscribe so you get every episode automatically. CyberHack Evil Call is a BBC long-form audio production for the BBC World Service. It's presented by me, Joe Tidy and me, Sarah Rainsard. Thanks for listening. We meet Alan as he grapples with his father Harry Hath's complicated history as a Holocaust survivor and boxer. Harry's story reveals the cost of survival. A legacy shaped by trauma, rage and the loss of faith that followed him long after the war ended. Listen now by searching for the documentary, wherever you get to your BBC podcasts.