I first meet Vyacheslav Penchukov, known in the underworld as Tank, in a Colorado prison visiting room. He appears with a wide grin, peeks around a pillar and winks. The smile is part of the package: charm and easy sociability helped him climb to the top of an international cybercrime scene and stay free for years.
Now 39 and serving time, Penchukov says he did not rise through technical genius alone but through relationships and charisma. Those connections kept him off the radar long enough to lead multiple criminal crews and amass thousands of victims. He spent nearly a decade on the FBI’s Most Wanted list and spoke at length across two days for a podcast series, describing how his networks operated, how hackers thought, and offering new leads about individuals still at large, including the alleged head of the sanctioned Russian group often referred to as Evil Corp.
His capture in 2022 came after more than 15 years on investigators’ lists during a dramatic raid in Switzerland. He recalls being pinned to the pavement with his kids watching and wrapped in a bag on the street. He calls the show of force excessive; the people who lost money to his schemes would disagree. Investigators attribute tens of millions of pounds in thefts to Penchukov and the groups he led or joined.
Penchukov’s early exploits were with a crew dubbed Jabber Zeus, named for their use of Zeus banking malware and Jabber chatrooms. They siphoned funds directly from business accounts, local authorities and charities. In the UK alone, more than 600 victims lost over four million pounds in roughly three months. Penchukov ran a small office in Donetsk with a few partners, including a man later sanctioned by the United States and accused of leading Evil Corp. By day they engineered thefts; by night Penchukov DJed under the name Slava Rich.
He was unmasked after law enforcement monitored his Jabber chats and learned personal details, including information about his daughter’s birth. An FBI operation called Trident Breach led to arrests across Ukraine and the UK, but Penchukov escaped following a tip-off and a high-speed getaway in an Audi S8. For a while he tried to go straight, setting up a coal trading business, but life on the FBI list, repeated extortion by officials and the chaos of the 2014 Russian invasion of Crimea — which destroyed his apartment in a missile strike — pushed him back toward crime as a fast way to raise money.
Penchukov’s career tracks the wider evolution of online crime. The early days focused on direct bank thefts; later years saw a shift to ransomware syndicates. Between 2018 and 2022 he acted as a top affiliate for ransomware families such as Maze, Egregor and Conti, and ran affiliates using the IcedID malware to infect computers and harvest credentials, creating access that was sold or rented to other criminals. He claims his teams infected over 150,000 computers and that the switch to ransomware significantly increased monthly profits.
He describes a herd mentality that swept parts of the criminal world after rumours of massive payouts, including a widely circulated story about a hospital paying a $20 million ransom. That story prompted dozens, if not hundreds, of actors to target US medical institutions, often with little regard for patient harm. Penchukov also says gang members sometimes referred to handlers in Russian security services. When asked if those criminal groups cooperated with state agencies he answered in the affirmative, suggesting some level of collusion.
Prosecutors link him to several high-impact attacks, among the most serious being a 2020 ransomware incident that hit a major medical center and disabled thousands of computers, caused tens of millions of dollars in losses and disrupted critical services for weeks. Penchukov denies personally carrying out that specific intrusion, saying he admitted involvement in some cases as part of plea negotiations. He is serving concurrent nine-year sentences and has been ordered to pay $54 million in restitution.
Life in Englewood Correctional Facility is a far cry from his Donetsk days. He studies languages, plays sports and keeps a Russian-English dictionary within reach. He makes jokes about not being smart enough because he is incarcerated, yet he also reflects on the paranoia and betrayal that define life in cybercrime. He says that trusting colleagues is risky: when arrests come, friends often turn into informants. Over time, success breeds complacency; the edge that kept operators safe and effective dulls.
Victims tell the human side of the story. Small businesses and charities lost sums that devastated day-to-day operations and morale. One family-run luggage shop in Albuquerque lost thousands in a single theft and watched the perpetrators enjoy a lifestyle of expensive cars and nights out. For those victims, seeing Penchukov’s earlier prosperity compounds the injury.
He expresses some remorse for attacks that hit vulnerable targets, citing a ransomware incident affecting a charity for disabled children as particularly regretful. For the most part, however, he speaks matter-of-factly about losses, often suggesting insurers or other mechanisms absorbed the blow and that such collateral damage was a cost of pursuing larger paydays.
His relationships with former associates are complicated. He says he kept his distance from a prominent colleague after that man was sanctioned in 2019. Despite public shunning and sanctions by agencies like the UK National Crime Agency, elements of the old networks endured. One alleged leader remains at large, reportedly sheltered in Russia with a multi-million-dollar US reward for information, a fact that makes capture unlikely while he remains outside jurisdictions that will extradite.
Penchukov’s story illustrates how gaps in banking security and uneven law enforcement responses allowed cybercrime to professionalize. What began as opportunistic bank theft evolved into organized ransomware empires, complete with affiliates, malware-as-a-service, and lucrative payouts that attracted ever-larger crowds of attackers. He credits networking and friendship for his rise and points to misplaced trust as the root of his downfall. He contends his sentences are overly harsh and says he hopes for early release; prosecutors and victims insist restitution and accountability are overdue.
When our time together ends, he smiles and admits he made mistakes. He appears more vexed by betrayal from peers and informants than by the real-world consequences of his gangs’ actions. The trail of drained accounts, crippled medical services and ruined small businesses remains a stark reminder of how criminal entrepreneurship, combined with weak defenses and huge potential rewards, can inflict lasting human damage.
