Bonus: Cyber Hack - Evil Corp

0:00This BBC podcast is supported by ads outside the UK.

0:37Hi, documentary listeners. As you listen to the documentary, there's a brand new season of another BBC podcast we thought you might want to know about. It's the story of the theft of hundreds of millions of dollars. Investigators claim it was stolen by Russia's most wanted hackers. I'm Joe Tidy, the BBC's cyber correspondent. And I'm Sarah Rainsford, the BBC's Eastern and Southern Europe correspondent. And together we're presenting the brand new season of The Cyberhack Podcast from the BBC World Service. The new season's called Evilcore, and you're about to hear the first episode. If you like it and you want to hear more, it's the first episode of six.

1:17To listen to more, search Cyberhack wherever you get your BBC podcasts. Welcome to Cyberhack. Episodes are released weekly. wherever you get your podcasts. But if you're in the UK, you can listen to the latest episode a week early, first on BBC Sounds.

1:40You'd hear them before you ever saw them. Engines howling somewhere beyond the edge of Moscow. The first time I discovered the drag racers, early in my career covering Russia more than 20 years ago, it felt like I'd stepped onto the set of The Fast and the Furious. This was Moscow's underground street racing scene. A wild mix of people buzzing around in beat-up but beloved larders and other souped-up old cars. By day, they blended in. By night, they'd gather in secret locations, tear down hundreds of metres of tarmac before melting back into the city before sunrise. But there emerged another, more brazen kind of street racer in Moscow, the kind that doesn't wait until night.

2:29Ones who speed through the city under the sun, right under the nose of the police. They're Moscow's super rich, and they know no one will stop them. Not because they're fast, but because some say they're protected. One of them was thin with quiffed blonde hair, Maxime Yakubyets. But Maxime wasn't driving ladders. His ride of choice was a Lamborghini, wrapped in day-glow yellow and grey camouflage.

3:01Racing through Moscow, not for the thrills, but to show who owned the road, like nothing could touch him. Maxime wasn't afraid of being seen. In fact, he was easy to find. He and his crew regularly posted on social media. Videos of them racing through Moscow in an array of flashy cars, posing with stacks of cash, even playing with a pet lion cub.

3:30In 2017, Maxim had just turned 30 and he was about to get married again. But this wasn't some quiet second chance. It was held at an exclusive golf course north of Moscow. I walked it myself some years later with the manager, who told me the price of renting the course for a day was a cool quarter of a million dollars. For this wedding, there was no expense spared. Staff directed VIP guests to walk over the perfectly manicured turf to a giant pavilion decked out like an imperial palace. Its white facade was brilliant against a dark green forest backdrop. They climbed a wide set of steps to a veranda overlooking the course.

4:15Servers in black ties circulated under chandeliers. Inside, a spectacular ballroom, matching peony bouquets the size of trees. But that was only half of the story. After dinner, the lights dropped, dancers emerged, lasers flared and Russian pop icons took to the stage. This shrine to tradition transforming into a modern, dazzling dance floor.

4:45We called the wedding planner to find out more about this extravagant affair. They didn't want to talk. We tracked down others who worked at the wedding. We were told they'd signed NDAs, non-disclosure agreements. They couldn't talk either. But the wedding planner left dozens of images online. and if you flick through them, straight away you can spot there's something off. Look closely. There's the bride in her white strapless gown, looking thoughtfully into the sunlit distance. Here's one in black and white, classy. She's seated at a vanity table, the long train of her dress billowing behind her.

5:27Now she's gazing up at her groom on the darkened dance floor. Curiously, Maxime's face is harder to make out. A dramatic drone shot filmed directly above them shows the couple walking hand in hand through tall trees. A wide shot catches the groom in the distance as the lens focuses on the father of the bride. One from the side has Maxime's face in shadow as he and the bride sink a knife into a cake that's as tall as they are. Why so shy, Maxime? Perhaps there's a hint in the vanity license plate on his neon Lamborghini. War. That's Russian for thief. A joke, perhaps. Or a blatant admission. Maxime Yakovets of Moscow, Russia, has been indicted in Pittsburgh, Pennsylvania, for his alleged role as the leader of a cyber criminal gang.

6:24So perhaps that outlandish wedding is more than a celebration of love. Maybe it's a brazen display of stolen wealth. Maxime Jakubets is a true 21st century criminal who, with the stroke of a key and the click of a mouse, committed cybercrimes across the globe. He's earned his place on the FBI's list of the world's most wanted cybercriminals. So that might explain his newfound bashfulness. We're pleased to announce a reward of up to$5 million for information leading to the arrest and or conviction of Russian cybercriminal Maxim Yakovits. That's the kind of money they put up for war criminals and terrorists, even some of North Korea's hackers.

7:08And if you've listened to the Lazarus heist, you know what they're capable of. Yakovits and the members of his criminal network devised and implemented the kinds of criminal schemes so audacious and sophisticated that they would be difficult to imagine if they were not real. For years now, Maxim Yakubyets has evaded arrest. But he isn't just hard to catch, he's not meant to be caught. He's said to be living under the kind of protection that most criminals can only dream of. Protection, some say, that comes with strings attached. Though others tell a different story.

7:52I'm looking for Maxim Yakubets. I'm from the BBC. There is no Maxim Yakubets here. He hasn't been here for 15 years. I have to say my heart was thumping. As the BBC cyber correspondent, I've been trying to track down Maxim Yakubets for years. And in 2021, I traveled to Moscow in search of him, winding up at his dad's front door. Look, Maxim is not here. I'm his father. Victor Jakubiec, in the flesh. Yep. Green t-shirt, blue jeans, gold chain, gold ring, gold watch, bald head. How do you think your son has become so rich? Who said he was rich? How did he afford the$600 ,000 wedding? How much? Firstly, this is slightly exaggerated.

8:45Only slightly. It'd take the average Russian a lifetime, maybe more, to make anything like that kind of money. You seem very upset by the US and the UK's accusations. Of course I am upset. They created a problem for the family. For many people who know us, what was the purpose? But back then, you were only on the trail of Maxim. That's right. And meeting his father was the closest I got. But three years later, in October of 2024, there was a twist. The British government accused some of Maxime's own family, including his father. I was amazed. Victor, apparently part of the criminal empire too.

9:34And not just the father. Maxime's brother, cousins and his father-in-law were all implicated. Many of them were standing alongside Maxime at that Moscow wedding, in tuxedos. Big brother Artem, bald as his dad. To his left, cousin Kirill, short, with a beard and wavy hair. Cousin Dmitry, taller, with a little less facial hair. Those wedding photos now look less like a family album, more like a police line-up. They ran their operations out of the back of an Italian restaurant in Moscow, in the back room, just like you would see Tony Soprano do. They really viewed themselves as the new mafioso. These are the blood ties said to bind an alleged global hacking empire with thousands of victims around the world emptying bank accounts and upending lives.

10:25Crimes that live up to this criminal crew's chosen name, Evil Corp. When you look at the Evil Corp group, they were really one of the beginning godfathers, so to speak. I'm Joe Tidy, the BBC's cyber correspondent. I spend my time chasing the world's most dangerous hackers. And I'm Sarah Rainsford. I was Moscow correspondent for the BBC until I was expelled. They claimed I was a security threat. We've teamed up because if you want to understand cybercrime and you want to understand modern Russia, you need to understand evil court. They're not just part of cybercrime history. They are that history.

11:04accused of stealing hundreds of millions of dollars and working for the Russian state. Cybercrime, state power and a life lived beyond the law. This is Cyber Hack Season 3, Evil Call from the BBC World Service.

11:30Episode 1, Zeus.

11:4030 years ago, this screeching handshake was how you got online. Slow and clunky, but it still felt like the future. Lawrence Baldwin was a network engineer, working for a big American telecoms company. With this cumbersome connection process, the security risks he's tasked with managing at the time seemed minimal. His motto? What could possibly go wrong? But Lawrence begins to see the landscape shift as the new century rolls in and the broadband era begins. The world's becoming more connected and we all start spending more of our lives online. You'd install a firewall on your ADSL connection and it would light up like a Christmas tree in two seconds after connecting.

12:24And it's like, what the heck are these guys trying to do? Each light on his firewall, that Christmas tree, is a silent alarm. They're alerts that attackers are testing the digital locks trying to break in. But why? It really upset me that I would see this activity and have 10 years of network analysis experience. And I was like, I have no idea what the goal is even here. And that's what spawned the pressure on me to basically ultimately try to answer that question. Lawrence is seeing more than mischief. He's seeing the first signs of an emerging underworld. Criminals crawling beneath the surface of the internet, looking for opportunities to steal as much money as possible.

13:10And it hits a nerve. This is not just technical, it's personal. I get very triggered by injustice. Something in him needs to act. I set out with my primary mission, driving what I do to disrupt cybercriminals. So Lawrence quits his job and he starts a cyber security firm, MyNet Watchman. There's not a lot of people that would just like put all their life's focus on something without having any concept. I'm like, how am I going to pay the bills? Three decades on, Lawrence has morphed from network engineer to cyber security legend. He's been called a dark hero of the internet. He doesn't just prevent problems, he infiltrates criminal organisations.

13:59I actually, in a way, began thinking like a criminal. He almost never gives interviews. And he's never spoken publicly about his part in the hunt for Maxime Jakubiec. Until now.

14:15Summer, 2009. Lawrence is already the guy banks call when hackers strike. He's got the FBI on speed dial. And he's about to find out what happens when you mess with a god. He's on the trail of a group of cybercriminals using a bit of malware code named after the Greek god of thunder, Zeus.

14:46Malware is malicious software that hackers use to gain control of a computer. It's hidden behind those dodgy links we're always told to be suspicious of. And Lawrence has discovered they're using it to steal money from a string of victims across the US, stretching from coast to coast. An auto body shop in Georgia. A plastics company in Pennsylvania. A Native American tribe in Washington state. Even an order of Franciscan nuns in Chicago. Nuns? Nuns. Lawrence's intro to this investigation starts with a tip. A colleague's got hold of a sample of the Zeus code and he spots something. It looks like a reference to a server or central computer, which the criminals use to chat to each other.

15:32Within minutes, I start taking a look at what's going on. Sure enough, there is a server where messages are pinging back and forth, live. To get a closer look, Lawrence supplies a packet sniffer, a tool that network engineers use to monitor online traffic. You're the cyber correspondent. I'll let you explain packet sniffer. Well, if you think of a packet sniffer like a nosy postal worker, they read every letter that passes through the mail sorting facility. Whereas normal postal workers just see envelopes and addresses, a packet sniffer will be able to read everything, unless the letters are protected, written in some indecipherable code, for example.

16:11And to Lawrence's surprise, these hackers are pretty complacent. None of the messages he sees online are encrypted. So not only could I see this server, within minutes I could actually see the full transcript of all of the chat communications. That's when my Zeus nightmare began. As the criminals are talking, Lawrence is watching. It's as if he's stepped, invisible, into the backroom office of a cybercrime syndicate.

16:44Most of the messages he sees are in Russian. Lawrence doesn't speak Russian, but there are a few words and phrases he recognises. And he begins to make some sense of what's going on. Much of what he sees appears to be people talking back and forth. But they're also sharing lots of names and numbers. And then he sees reams of bank details. Lawrence feels his pulse rise. And then it was like, almost like a panic because I'm going to have to build something that ingests this data. and puts it into a format that I can triage it myself. Lawrence begins his triage operation, processing all this data that's flowing by in real time, not to mention some basic translation from Russian so that he can better understand it all.

17:34Soon the conversations he's tapped into start to make a lot more sense. Hey, I just did the fraudulent transaction. I've moved$200 ,000 out of the victim's bank account. And here's the victim's name. And then here is where I sent the money to. And there would be a laundry list of individuals' names and bank account numbers and dollar amounts, essentially documenting the details of the fraudulent transaction. Behind all the detail about victims' names, addresses, bank account numbers, There are real people losing real money. But the criminals are ghosts. Lawrence gets to know them only by their online handles.

18:21Two of the more prominent members of the group go by Aqua and Tank. Lawrence circles those two in red. You'd think, with all that info he already has, first-hand testimony of hackers stealing money, the likes of the FBI would love to know more. Think again. Initially, I didn't say anything because I knew it was pointless until I could much more understand the breadth and scope of this. Pointless? Well, here's why. At this point in time, I had already spent many years trying to be helpful with cybercrime cases. And I have to say, it was an incredibly frustrating experience. I would see a bad actor doing something and I'd throw something over the wall to law enforcement and say, hey, I'm seeing this.

19:15You might want to check it out. You know what would happen? 99 times out of 100, nothing. You hear the laugh, but it's rueful. Lawrence is the kind of person who needs to know what's going on. So he talks to his sources in law enforcement. What is going on here? Help me understand. And he learns a cold truth. Prosecuting cybercrime is really hard. It's massively labor intensive. It is extremely expensive. And the reality is, step one to be able to really even get a case going is that you have to know the extent of the fraud. And the aggregated loss has to be a staggering, obscene amount. Like, I'm not even talking millions, potentially tens of millions.

20:11Officially, he says, American authorities will take on cases where the losses are$50 ,000 or above. But$50 ,000 gets a piece of paper written on that then goes into a file somewhere, probably never to be seen again. The reality is only cases of tens of millions or even hundreds of millions are really ever going to get worked. It's not like the cops don't care. They're just massively overwhelmed. And maybe those hackers Lawrence is watching over, Aqua and Tank, are all too aware of that. Perhaps they know that as long as they keep their crimes on the more modest side, they'll be left well alone.

20:53In turn, making easy money. But that still leaves a deluge of victims.

21:02That gap between what the hackers can do and what law enforcement can handle is what provides the building blocks for an emerging criminal empire.

21:20Hi, this is Ankur Desai from the Global News Podcast. We're looking back at the life of and carrying tributes to the veteran American civil rights leader and two times presidential candidate Jesse Jackson, who's died at the age of 84. Join us to hear the day's top stories from BBC News delivered twice a day on weekdays, daily at weekends. Search for the Global News Podcast wherever you get your BBC podcasts from.

21:48If there was a big red button that would just demolish the internet, I would smash that button with my forehead. From the BBC, this is The Interface, the show that explores how tech is rewiring your week and your world. This isn't about quarterly earnings or about tech reviews. It's about what technology is actually doing to your work, your politics, your everyday life. and all the bizarre ways people are using the internet. Listen on BBC.com or wherever you get your podcasts.

22:24Every day, Lawrence Baldwin logs onto his window into the hacker's world, keeping tabs on the anonymous hackers he's come to know as Aqua and Tank. He watches on as hundreds of heists unfold in real time. And every day, he knows no one is coming to stop it, at least any time soon. It was very stressful. The victims are piling up, and Lawrence starts looking them up. He finds they're mostly made up of small businesses, which can't afford to lose a dime. He feels a duty to help them. I'm a small business myself, and I didn't want to see them get hurt. It put me in a situation where I felt a huge sense of obligation.

23:08to do anything and everything I could as quickly as I could to try to mitigate the fraud. So he makes a decision. If the cavalry isn't coming, he's going to have to ride solo.

23:26I was going to milk this intel for everything it had to disrupt what they were doing. And then in complete parallel to that, Use everything that I knew about the constraints that law enforcement had and do everything I could to make them successful. Step one, warn people. The obvious shortcut is to warn the banks directly that their clients are being robbed. The banks, in some cases, can put a stop on transfers. There's a dozen or more large banks in the US, but there's 18 ,000 small banks. There's no way he has time to put in that many calls.

24:34a word I'm saying, but you really need to get on the horn with your bank ASAP. Try as he might, Lawrence just couldn't keep up with all of Seuss's victims. Though some of them would hear the bad news directly from their banks. We got a call from the bank and said, are you aware that there's no funds in this account? Leslie Richards ran a family business, Libra's Luggage, in Albuquerque, New Mexico, with her husband, Frank. At Lieber's Luggage, we have thousands of business cases, great gift ideas... The shop represented a lifetime of work. Who started it? Was it your side of the family, Leslie?

25:15No, Frank's side of the family. Oh, Frank's side, right. And I think his family in Cleveland started the business in the 1930s. That's right. I started the business in 1978. It was based on a business that a family member in Cleveland, Ohio was running that led me to believe I could be successful doing the same in Albuquerque. Then in 2009, after more than three decades in business, Leslie and Frank were told everything they'd worked for had gone. What the, huh, excuse me, how did that happen? You know, just disbelief and horror, because we had no idea what had happened. And the bank clearly didn't have any idea what had happened.