U.K. and U.S. Sanction 11 Members of the Russian Cybercrime Organization TrickBot -

Post Views: 469

On Thursday, the governments of the United Kingdom and the United States imposed sanctions on 11 persons who are accused of being affiliated with the well-known TrickBot cybercrime syndicate based in Russia.

According to the U.S. Treasury Department, Russia has historically served as a refuge for cybercriminals, such as the TrickBot gang. The department further asserts that this group is connected to Russian intelligence agencies and has specifically directed its activities toward the U.S. Government and American corporations, especially healthcare institutions.

The individuals subject to the sanctions are those occupying administrative, managerial, developmental, and coding roles who are suspected of having rendered tangible support to the operations in question. The individuals’ identities and responsibilities are outlined as follows:

Andrey Zhuykov, also known as Adam, Defender, and Dif, holds the position of senior administrator.
Maksim Sergeevich Galochkin, also known by his aliases Bentley, Crypt, Manuel, Max17, and Volhvb, is actively engaged in the field of software development and testing.
Maksim Rudenskiy, also known as Binman, Buza, and Silver, assumes the role of team head for the group of coders.
Mikhail Tsarev, also known as Alexander Grachev, Frances, Ivanov Mixail, Mango, Misha Krutysha, Nikita Andreevich Tsarev, and Super Misha, is involved in the fields of human resources and finance.
The acquisition of the TrickBot infrastructure by Dmitry Putilin, also known as Grad and Staff.
Maksim Khaliullin, often known as Kagas, serves as the Human Resources Manager.
Sergey Loguntsov, also known as Begemot, Begemot_Sun, and Zulas, is a software developer.
Vadym Valiakhmetov, also known by his aliases Mentos, Vasm, and Weldon, is a software developer.
Artem Kurov, often known as Naned, is a software developer.
Mikhail Chernov, also known as Bullet and m2686, is a member of the internal utilities group.
Alexander Mozhaev, also known by the aliases Green and Rocco, is a member of the team tasked with overseeing various administrative responsibilities.

According to recent findings by Nisos, a threat intelligence firm, it has been ascertained that Galochkin underwent a name change from Maksim Sergeevich Sipkin. Additionally, it has been determined that he currently has a substantial amount of financial debt as of the year 2022.

According to the U.K. government, the aforementioned persons, who are all citizens of Russia, conducted their activities beyond the jurisdiction of conventional law enforcement and concealed their identities through the use of online aliases and pseudonyms. The act of eliminating the anonymity of these individuals has the potential to compromise the integrity of their identities and the criminal enterprises they are associated with, so posing a significant threat to the security of the United Kingdom.

The occurrence signifies the second instance within a span of seven months in which the two governments have imposed comparable sanctions on numerous Russian individuals due to their association with the TrickBot, Ryuk, and Conti cybercrime networks.

Additionally, it aligns with the disclosure of unsealed indictments targeting nine defendants involved in the TrickBot malware and Conti ransomware operations, encompassing seven of the recently sanctioned people.

Dmitriy Pleshevskiy, an individual subjected to sanctions in February 2023, has subsequently refuted any association with the TrickBot gang. He claims to have utilized the internet pseudonym “Iseldor” for undertaking unspecified programming assignments on a freelance basis.

Pleshevskiy was described by WIRED as stating that while he did not perceive these jobs as unlawful, it is plausible that his participation in these attacks may have contributed to their illegality. This revelation came after an extensive investigation conducted over several months by WIRED, which exposed Galochkin as a significant figure inside the TrickBot network.

To date, there have been apprehensions and indictments of two other developers associated with TrickBot in the United States. In June 2023, Alla Witte, a Latvian citizen, entered a guilty plea on the charge of conspiracy to commit computer fraud and subsequently received a sentence of 32 months. Vladimir Dunaev, a Russian individual, is presently in detainment and awaiting legal proceedings.

TrickBot, an offshoot of the Dyre banking trojan, initially emerged in 2016 with comparable characteristics. However, it has now transformed into a versatile and modular malware suite, enabling malicious actors to distribute subsequent payloads, including ransomware.

The e-crime gang, which successfully evaded a takedown operation in 2020, was assimilated into the Conti ransomware cartel in early 2022. As indicated by the aforementioned responsibilities, the group operated in a manner resembling a legitimate organization, complete with a professional management framework.

Conti was officially dissolved in May 2023, subsequent to a series of leaks that occurred two months prior, providing an unparalleled understanding of the group’s operations. These leaks were instigated by Conti’s endorsement of Russia during its conflict with Ukraine.

Two separate instances of anonymous data dumps, known as ContiLeaks and TrickLeaks, emerged in close succession at the beginning of March 2022. These dumps led to the internet publication of substantial amounts of data pertaining to the internal communications and infrastructure of the respective entities. The already established account known as TrickBotLeaks, which was initially launched on the X platform (formerly known as Twitter), was promptly suspended.

According to Cyjax’s report in July 2022, the cache of TrickBot data comprises over 250,000 messages encompassing more than 2,500 IP addresses, approximately 500 potential crypto wallet addresses, and a multitude of websites and email addresses.

Based on data provided by the U.K. National Crime Agency (NCA), it has been approximated that the aforementioned gang has managed to extract a minimum of $180 million from victims on a global scale. Moreover, within the U.K., this group has targeted 149 victims and extorted at least £27 million from them.

Despite persistent attempts to disrupt Russian cybercriminal activities through the implementation of sanctions and legal charges, the threat actors persist and flourish while operating.

About The Author:

Yogesh Naager is a content marketer who specializes in the cybersecurity and B2B space. Besides writing for the News4Hackers blog, he’s also written for brands including CollegeDunia, Utsav Fashion, and NASSCOM. Naager entered the field of content in an unusual way. He began his career as an insurance sales executive, where he developed an interest in simplifying difficult concepts. He also combines this interest with a love of narrative, which makes him a good writer in the cybersecurity field. In the bottom line, he frequently writes for Craw Security.