Forest Global Training Partners

Cyber Risks · Krebs on Security

Alleged Jabber Zeus Coder ‘MrICQ’ in U.S. Custody

Summary: Yuriy Igorevich Rybtsov, a 41-year-old from Donetsk indicted in 2012 as 'John Doe #3' and known online as 'MrICQ,' was arrested in Italy and arrived in Nebraska on October 9 under an FBI arrest warrant, after losing a final extradition appeal in April 2025. The Nebraska indictment identifies him as a developer for 'Jabber Zeus,' a group using a custom ZeuS banking trojan whose 'Leprechaun' component sent him a Jabber message each time a victim entered a one-time passcode, and whose 'backconnect' feature relayed account takeovers through the victim's own infected PC and IP address.

Why it matters: The gang leader, Vyacheslav 'Tank' Penchukov, was sentenced last year to 18 years and ordered to pay more than $73 million in restitution, while the alleged Zeus author Evgeniy Bogachev remains on the FBI's Most Wanted list with a standing $3 million reward - the money moved through payroll accounts at small and mid-sized businesses, and the crew was already inside those accounts before most victims were told.

Read the original at Krebs on Security ↗

Topics
Malware
Related