Maksim Yakubets

Most of the men in this project are protected by an arrangement. They stay home, they stay useful, and the state that could hand them to the West decides it would rather not. Maksim Yakubets is protected by something older and harder to break than an arrangement. He is protected by blood on one side and by marriage on the other. He built a criminal enterprise and staffed it with his own family, then married into the Russian security services, the side that makes sure the enterprise can never be punished. He is the seam where the two families meet, and the seam is the whole story.

His name is Maksim Viktorovich Yakubets. Online, through the years that built the empire, he was aqua. He was born on May 20, 1987, in Polonne, a small town in western Ukraine, and he holds Russian citizenship and has spent his adult life in Moscow. Confirmed Three governments name him the founder and leader of Evil Corp, assessed as the most prolific cybercrime enterprise yet assembled, and the United States has placed a $5 million reward on him, the largest it had ever offered for a cybercriminal at the time it was set. Confirmed He has never been arrested, and nothing of his has ever been frozen or seized. Confirmed What keeps him beyond reach is not that he hides well. It is who he is related to.

A family enterprise

Evil Corp was never a loose federation of strangers meeting on forums, which is how most organized cybercrime works. Britain’s National Crime Agency (NCA) describes it as a family-centred operation run out of Moscow, closer in shape to a traditional crime family than to a hacking crew. Confirmed reporting Its core was literally kin: Yakubets ran it alongside his father, Viktor Yakubets, his brother Artem, and his cousins Kirill and Dmitry Slobodskoy. Confirmed reporting The NCA’s telling has Yakubets bringing them into the business as he built it; what set the family on that road in the first place is not established, and the agency’s own line reaches only as far as a statement that Viktor carried significant historical ties to money laundering. Credible reporting

The family’s real product was not code. It was clean money. The NCA’s blunt assessment is that what made the group so dangerous was arguably not its malware but its skill at turning stolen bank credentials into spendable cash, through mule networks, cryptocurrency desks, front companies and lawyers, run with a professionalism most technically gifted criminals never reach. Confirmed reporting Keeping that competence inside the family solved the single hardest problem in organized crime, which is trust. Analyst inference

One part of Viktor’s story is documented rather than characterized. When the BBC came looking for the family in 2021, he stood in front of the cameras and insisted his son was innocent, that he had not even been questioned, that there was no evidence against him. Credible reporting Three years later, the same governments his son had robbed sanctioned Viktor by name for laundering the group’s proceeds. Confirmed The man who said he knew nothing was designated for moving the money.

The family he married into

In the summer of 2017, Yakubets married Alyona Eduardovna Benderskaya at a country club north of Moscow, in a celebration the NCA later priced above $330,000. Confirmed reporting The number is not the point of it. The surname is. Her father is Eduard Benderskiy, and to understand what Yakubets married into you have to understand what Benderskiy did before he became a businessman. Confirmed reporting

Benderskiy is a former senior officer of the Federal Security Service (FSB) and its Vympel unit, one of the most secretive special-operations formations in the Russian security services, historically built for sabotage, kidnapping, and killing beyond Russia's borders. Confirmed reporting He left the uniform in the 1990s and reinvented himself as a private businessman, but he never left the network: he chairs a charitable fund for Vympel veterans, which keeps him wired into a standing roster of former special-operations officers and able to broker access to it. Confirmed reporting Independent investigators at Bellingcat concluded that this access has been put to lethal use, placing Benderskiy in the preparation of the 2019 daylight assassination of a Chechen-Georgian dissident in Berlin and in phone contact with the FSB gunman in the days before the killing. Credible reporting

So when the United Kingdom, United States, and Australia moved against the family together in October 2024, they did not treat Benderskiy as a father-in-law who looked the other way. They named him the key enabler of Evil Corp's relationship with the Russian state, the man who, after the 2019 sanctions landed, used his standing to give the group physical protection and to ensure that Russia's own authorities never came for them. Confirmed reporting The wedding was not only a wedding. It was a merger, and the thing being merged was a criminal enterprise into the apparatus of a state.

The roof has a balance sheet

Here the profile can add something the public case has mostly left in the margins, and it is where the leverage sits. Benderskiy is not a retired officer coasting on a pension and a reputation. He runs a cluster of live companies, and the arresting thing about them is what they do for a living: they defend precisely the kind of target his son-in-law breaks into. Credible reporting

One of his firms, trading as Simplity and registered under the Vympel name, sells penetration testing and "white-hat" hacking to Russian banks, telecom operators, and government ministries. Credible reporting Another, a data-center and cloud business called Oxygen, is reported to host eight of the thirteen banks the Russian state itself designates as systemically important, and it carries an FSB cryptography license granted in 2021. Credible reporting A third, a Soviet-era defense institute he took over financially, builds satellite-communications equipment marketed as a domestic answer to Starlink, along with electronics for aviation missiles. Credible reporting By earlier accounts he has also run physical security for Russian oil facilities in Iraq. Credible reporting

Read the two families as one system and they close a loop. One side breaks Western networks for money; the other side is paid to secure Russian networks for the state, and holds the licenses, the bank contracts, and the clearances that come with being trusted to do it. Analyst inference The protection around Yakubets is not a favour handed in from outside the system. It is inside the system, on the books, drawing revenue. Analyst inference

Tasked, not just tolerated

With most of the protected, the state relationship has to be read from an absence, from the arrests that never come and the assets that are never touched. With Yakubets the West has said it out loud. Analyst inference The US Treasury stated in 2019 that Yakubets did more than steal, that he provided direct assistance to the Russian government's cyber efforts, had been working for the FSB since 2017, and by April 2018 was pursuing a security clearance to handle classified material, tasked with acquiring protected documents by cyber means. Confirmed reporting The NCA went further in 2024, describing a bond that ran well past the ordinary trade of protection and payoffs, and stating that before 2019 Russian intelligence tasked Evil Corp to conduct attacks and espionage against NATO allies, with Yakubets himself running the liaison across the FSB, the SVR, and the GRU, Russia's three main intelligence services. Confirmed reporting

That distinction is worth marking against the rest of this series. For the common ancestor, Bogachev, the state tasking is an inference the evidence supports but no government has ever asserted; for Yakubets it is the published assessment of two states, written into a sanctions designation and a national white paper. Analyst inference It is not an adjudicated court finding, and this project will not call it one, but it is the strongest on-record claim of active state tasking anywhere in The Protected. Analyst inference

A second roof: the prosecutor’s son

The marriage explains the security cover. It does not explain the money doors that opened next, and those trace to a different family. On paper Yakubets held a job at the National Engineering Corporation, in Russian the Natsionalnaya Inzhiniringovaya Korporatsiya, or NIK, a St. Petersburg construction and engineering firm. The US Treasury states it plainly: Yakubets “used his employment at NIK as cover for his ongoing criminal activities linked to Evil Corp.” Confirmed reporting

The interest is in who owns the cover. NIK was established by Igor Chayka and his associate Aleksei Troshin, and Igor Chayka is the younger son of Yuriy Chayka, the man who ran Russia’s entire prosecution service as Prosecutor General from 2006 to 2020. Confirmed reporting The firm is not clean in its own right: Treasury sanctioned NIK, together with Chayka and Troshin, in October 2022, in a separate action against Kremlin influence operations in Moldova. Confirmed So the company that handed the leader of Evil Corp a cover salary was itself a sanctioned instrument of the Russian state, built by the family whose name is a byword for prosecutorial impunity. The 2015 Navalny investigation into the Chayka clan put that reputation on the record, tracing the family’s fortune to the father’s office; the organized-crime end of that story attaches to the elder brother rather than to Igor, but the shape of it is the point. Credible reporting

Then the doors the cover opened. In 2019, by Treasury’s account, Benderskiy hosted a meeting between Yakubets and Herman Gref, the chief executive of Sberbank and the most powerful banker in Russia, to discuss business contracts with NIK. Confirmed reporting The same year, Benderskiy used his connections to arrange a deal involving Yakubets and Dmitry Kozak, one of the most senior officials in Putin’s administration, a venture the participants believed would earn tens of millions of dollars a month. Confirmed reporting Both Gref and Kozak now sit under Western sanctions in their own right. Confirmed Read those facts slowly. A man carrying a $5 million American bounty was walked by his father-in-law into the office of the head of Russia’s largest bank, and into a business deal with a senior figure in the Kremlin, and the state that could have arrested him let him take the meetings. Analyst inference

This is the second roof, and it is a different thing from the first. The Benderskiy marriage bought security-service cover: protection at home and a line into the FSB. The Chayka connection bought political and commercial cover: a legitimate-looking employer, a sanctioned one at that, and an introduction to the very top of the Russian economy. Analyst inference The construction front was not even new to him. Around 2013 Yakubets and his brother Artem had co-owned a small Moscow building company of their own, so the costume was familiar long before NIK offered a grander one. Credible reporting

The man

Set the two families aside and the man himself is a study in control and its limits. Inside the business he was a compartmentalizer, careful to let no member of the group see the whole of it, and the NCA reports that he kept the details of his work secret even from his wife. Confirmed reporting Read that narrowly. Keeping the operational specifics from Alyona is a different thing from her being ignorant of what he was, and the idea that the daughter of the Vympel officer shielding the group believed her husband sold software does not survive the visible fortune and the $5 million bounty on the man she married. Analyst inference The likelier truth is that both families understood the arrangement exactly. The one person he trusted with the whole of it was his deputy, Aleksandr Ryzhenkov, a partnership formed around 2013 that outlasted every disruption thrown at it since. Confirmed reporting

His control had a limit, and the limit is how the world got his name. Years before the wedding, in the Jabber Zeus period around 2009 and 2010, Yakubets had a first wife and an infant son born in 2009. Confirmed reporting He was also careless in the way that would define the case against him, using the same email address for his criminal work that he used to order a baby stroller delivered to his home, an overlap that helped investigators tie the handle aqua to a real man at a real address. Confirmed reporting The most secretive operator in the room was pinned down by a nursery delivery, and that is the contradiction that actually matters about him: not flash against discretion, but discipline shot through with human seams. Analyst inference

By the peak years the display was total, and it read as something other than vanity. He drove a customized Lamborghini through Moscow on plates that spell the Russian word for thief, kept big-cat cubs, and took spa weeks that ran to roughly a million rubles. Credible reporting A man does not drive a car marked thief past the police of the country he lives in unless he has measured, correctly, that the police are no threat to him. Analyst inference Vyacheslav Penchukov, a former associate now in a US prison, recalled socializing with Yakubets in expensive Moscow restaurants and being struck by one detail above the rest: the bodyguards. Credible reporting A cyber-thief who travels with bodyguards is not hiding from the state. He is standing underneath it.

One image holds both halves of him at once. In the circulated video of his own wedding, the most lavish day of a lavish life, the bride is shown plainly to the camera and the groom never is; he appears only from behind, his face turned away in every frame, at the center of the event and absent from its record in the same instant. Confirmed reporting Present everywhere, held by nothing. It is the instinct that has kept him free, and the same instinct a stroller delivery briefly defeated a decade before.

The money: visible and untouchable

The figures are enormous and the response to them has been close to nothing. The NCA assesses that Evil Corp extorted at least $300 million from victims worldwide, and a single ransom paid to one of the group's later strains reached $40 million, a record at the time it was paid. Confirmed reporting Set against that is a $5 million reward that has gone uncollected for years, a shelf of indictments no one has been able to serve, and not one asset ever seized. Confirmed

What is distinctive about Yakubets is where the money lives. It is not parked mainly with a relative or buried offshore, as with others in this series. The laundering is the family’s own competence, run in-house, the thing the group was arguably better at than the hacking itself. Analyst inference To reach the money you have to reach the family, and the family sits behind the roof. That is why the fortune is still his, and why he has never seen the inside of a cell. Analyst inference

What we do not know

A profile this size should be honest about its edges. Yakubets's current operational role is unconfirmed; whether he still runs day-to-day operations, backs them financially, or has stepped into an elder-statesman role while Ryzhenkov deploys other crews' ransomware as an affiliate is not established by any official source. Analyst inference The precise scope and present status of the FSB tasking after the 2019 exposure is likewise not public, asserted in outline by two governments but not detailed. Analyst inference How far the 2019 NIK dealings with Gref and Kozak actually went, and whether the venture they expected to earn tens of millions a month ever materialized, is not documented beyond Treasury’s summary. Analyst inference

None of those gaps changes the shape of what is settled. Yakubets is the case where the two halves of this ecosystem, the criminal and the state, are not partners who happened to find each other but relatives who were always going to be. He built the fortune and staffed it with his own blood, married into the security state that shields him, and drew his cover pay from the family that once ran its prosecutions, and those overlapping roofs are what no indictment has come close to lifting. That is why he is in this section, and it is why he is free.