Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

Vyacheslav Igorevich Penchukov, a Ukrainian national known as “Tank,” was sentenced in Nebraska in July 2024 to nine years in federal prison and three years of supervised release for his role in the Zeus and IcedID malware operations. Contemporaneous reports by SecurityWeek and Recorded Future News put the restitution and forfeiture order at approximately $70 million to $73 million.

Who is “Tank”?

“Tank” is the alias of Vyacheslav Igorevich Penchukov, also known as Vyacheslav Igoravich Andreev. U.S. authorities described him as a leader or co-leader in two malware schemes: the Zeus enterprise, which stole banking credentials, and the later IcedID (also called Bokbot) operation, which stole information and supplied access for other malware.

Penchukov was arrested in Switzerland in 2022 and extradited to the United States in 2023. Before his arrest, he had spent nearly a decade as a fugitive on the FBI Cyber Most Wanted list.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What did Zeus and IcedID do?

Operation What the malware did Documented impact
Zeus The U.S. Department of Justice says the enterprise began in May 2009 and infected thousands of business computers. Zeus captured bank-account details, passwords, PINs and related credentials. Conspirators impersonated account holders to authorize transfers, then used money mules to move proceeds overseas. The scheme caused millions of dollars in losses, according to the DOJ.
IcedID/Bokbot From at least November 2018 through February 2021, Penchukov helped lead a conspiracy involving IcedID. The DOJ says it collected and transmitted personal and banking information and provided access for other malware, including ransomware. The DOJ linked the access chain to a ransomware attack on the University of Vermont Medical Center, which caused more than $30 million in loss and disrupted critical patient services for over two weeks.

How did the hospital attack affect patients?

The University of Vermont Medical Center incident illustrates how stolen information and malware access can lead to harm beyond financial fraud. The DOJ said the ransomware attack left the hospital unable to provide many critical patient services for more than two weeks and created a risk of death or serious bodily injury. Its stated loss figure for that incident was more than $30 million.

The DOJ’s account connects IcedID to the attack through its role in providing access for other malware. That does not mean IcedID itself was the ransomware: the department described it as an information-stealing and access-providing malware operation.

What was Penchukov sentenced for?

Penchukov pleaded guilty to one RICO conspiracy count tied to the Zeus enterprise and one wire-fraud conspiracy count tied to the IcedID/Bokbot operation. In July 2024, he received a nine-year federal prison sentence followed by three years of supervised release. SecurityWeek and Recorded Future News reported a combined restitution and forfeiture amount in the approximate range of $70 million to $73 million; those reports differ on the total.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

How was he brought to the United States?

The case crossed national borders: Penchukov was arrested in Switzerland in 2022 and extradited to the United States in 2023, where the prosecution proceeded in Nebraska. His arrest ended a nearly decade-long period as an FBI Cyber Most Wanted fugitive. The case demonstrates that an operator’s location outside the United States did not prevent U.S. authorities from pursuing prosecution, though this outcome does not guarantee extradition in every case.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.