US gains custody of suspected Jabber Zeus gang coder

Yuriy Igorevich Rybtsov, a Ukrainian national from Russian-occupied Donetsk who allegedly helped operate the Jabber Zeus cybercrime group, is now in U.S. custody after his arrest in Italy and extradition to Nebraska, according to KrebsOnSecurity.

Rybtsov, known online as MrICQ, allegedly conspired with the hacking group and used a modified version of the Zeus banking trojan to steal online banking credentials. The group targeted small and mid-sized businesses and laundered stolen funds through money mules in the UK, U.S. and Ukraine. Prosecutors say Rybtsov handled alerts from newly compromised victims and helped launder the groups profits through electronic exchanges.

Italian records show Rybtsov lost his final appeal against extradition in April 2025 and arrived in the U.S. on October 9 under an FBI warrant. Data reviewed by investigators linked him to an address shared with Vyacheslav "Tank" Penchukov, the group's leader who was sentenced last year to 18 years in prison. Authorities say Jabber Zeus worked closely with Russian hackers Maksim "Aqua" Yakubets and Evgeniy Bogachev.