‘Zeus Malware’ Leader Sentenced to 18 Years and to Pay Over $73 Million

• Zeus malware gang leader known as Tank was sentenced to 18 years in prison.
• Vyacheslav Igorevich Penchukov was also ordered to pay over $73 million in damages.
• The individual also admitted to being part of the IcedID malware operations for the past years.

Ukrainian Vyacheslav Igorevich Penchukov, also known as Tank, was sentenced to two consecutive 9-year sentences and ordered to pay over $73 million in restitution and forfeited funds on July 11 after being on the FBI's “most wanted” list for over a decade. 

The individual pleaded guilty to two charges of conspiracy to participate in racketeering and to commit wire fraud in relation to the Zeus malware group at a US federal court in Nebraska. These charges carried a maximum sentence of up to 20 years each, but Penchukov signed a plea agreement in February, which got him a reduced sentence.

Penchukov, also a well-known DJ in Ukraine, admitted to being one of the Jabber Zeus hacking group leaders starting in 2009 (which later morphed into Gameover Zeus), for which he “directed and coordinated the exchange of stolen banking credentials and money mules,” and having a key role in organizing the IcedID malware (aka Bokbot) between November 2018 and February 2021.

The U.S. prosecution of Penchukov is a rare victory against this powerful cybercrime gang that appeared online in 2006, using keyloggers to steal banking details and money mules to cash out the funds – especially since Russia and Ukraine do not have extradition agreements with the U.S.

Identifying Zeus members, including Penchukov, was possible by the FBI analyzing their Jabber chat messages from a seized US-based server in 2010. His Donetsk apartment was raided soon after, and even though Operation Trident Breach caught over 50 individuals, Tank was nowhere to be found.

Penchukov was first publicly named in a February 2012 Zeus-related indictment. In 2015, he changed his name to Vyacheslav Igoravich Andreev. At the end of 2022, he traveled to Switzerland and was arrested, then extradited to the U.S.

The Zeus cybercriminal group has been linked to two FBI-wanted Russians, Evgeniy Bogachev and Maksim Yakubets. The US government offers rewards of $3 million and $5 million, respectively.