A Ukrainian national believed to be a developer for the infamous Jabber Zeus cybercrime group has been reportedly extradited from Italy to the US.
The man, Yuriy Igorevich Rybtsov, 41, of Donetsk, is allegedly the Jabber Zeus developer MrICQ, who was mentioned in a 2012 indictment charging eight other suspected members of the cybercrime group, investigative journalist Brian Krebs reports.
Mainly targeting small to mid-sized businesses, the hacking group used the Zeus banking trojan to steal the victims’ credentials.
The gang’s name is derived from its use of Jabber to receive alerts in the form of instant messaging when the victims used one-time passcodes on banking websites.
According to the indictment, the Jabber Zeus “crew” used the banking trojan to capture bank account numbers, passwords, PIN numbers, and other sensitive information.
Then, they used the stolen information and social engineering to make fraudulent transfers to US bank accounts controlled by money mules.
The money mules withdrew the funds or transferred them to overseas bank accounts controlled by co-conspirators. As part of the conspiracy, the group stole millions from victims’ banking accounts.
According to the indictment, the group’s activities defrauded Bank of America, First Federal Savings Bank, First National Bank of Omaha, Key Bank, Salisbury Bank & Trust, Union Bank and Trust, and United Bankshares Corporation.
Rybtsov, Krebs notes, is mentioned in the indictment as John Doe #3, aka MrICQ. He is accused of handling notifications of newly compromised organizations and of laundering the illegal proceeds from the scheme.
Rybtsov allegedly fought the extradition to the US in Italian courts, but lost a final appeal in April 2025. He is currently in custody under an arrest warrant from the FBI.
Vyacheslav Penchukov, the leader of Jabber Zeus in Ukraine, was arrested in 2022 and was sentenced in the US last year to 18 years in prison. He was also ordered to pay over $73 million in restitution.
Other members of Jabber Zeus, such as Maksim Yakubets, later formed Evil Corp, which is known for using the Dridex trojan in attacks, and then transitioning to ransomware, a report from UK’s National Crime Agency shows.
Related: Developer Who Hacked Former Employer’s Systems Sentenced to Prison
Related: RapperBot Botnet Disrupted, American Administrator Indicted
Related: Scattered Spider Hacker Sentenced to Prison
Related: Two Scattered Spider Suspects Arrested in UK; One Charged in US
