Inside the FBI's Cyber Most Wanted list
Million-dollar rewards, Lamborghinis with stolen-money plates, and suspects who may never be arrested. Who is on the FBI's Cyber's Most Wanted list, and why the list still works.
The FBI has a “Ten Most Wanted Fugitives” list that most people know from movies. Fewer people know it also keeps a list just for hackers: Cyber’s Most Wanted. Reading it is like reading the credits of every big cybercrime story of the last fifteen years.
I go through it now and then, not because I expect to meet anyone on it, but because every name is a lesson in how real attacks are built.
The banking-malware godfather
Evgeniy Bogachev is probably the most famous face on the list. US authorities say he ran GameOver Zeus, a network of infected computers used to steal banking credentials, and helped spread CryptoLocker, one of the early ransomware hits. Losses were estimated at more than $100 million.
The US offered up to $3 million for information leading to his arrest, at the time one of the biggest rewards ever for a cyber suspect. He is believed to live in Russia, and he has never been arrested.
The guy with the “thief” plate
Maksim Yakubets is accused of leading Evil Corp, the group behind the Dridex banking malware. When the US charged him in 2019, it offered up to $5 million for information about him.
What made the story famous were the videos: a customised Lamborghini, reportedly with a number plate reading “thief” in Russian. Cybercrime as a lifestyle brand. The charges and sanctions made that lifestyle a lot harder to spend.
The state hacker
Park Jin Hyok is different. He is not a freelancer. The US Justice Department charged him in 2018 as a programmer working for a North Korean government front company. The indictment ties him to the Sony Pictures hack, the Bangladesh Bank heist and WannaCry. In other words, to Lazarus Group.
He will almost certainly never stand in a US courtroom. So why bother charging him?
The ransomware bosses
The modern list is full of ransomware names. Mikhail Matveev was charged in 2023 over attacks using LockBit, Babuk and Hive, with a reward of up to $10 million. Dmitry Khoroshev, named as the leader of LockBit in 2024, carries the same reward. I covered how police got inside his operation in Operation Cronos.
Why the list works anyway
It is easy to laugh at a “most wanted” list where most people live out of reach. But I think it works, in three quiet ways.
Travel becomes a gamble. An indictment follows you forever. Roman Seleznev, a Russian carder, was arrested in the Maldives in 2014 while on holiday, flown to the US and later sentenced to 27 years. Every beach trip is now a risk calculation.
Money gets frozen. Charges often come with sanctions. Exchanges, banks and partners stop touching your wallets. Stolen money is only useful if you can spend it.
Trust breaks. Cybercrime runs on reputation. Once a leader is unmasked, affiliates start to wonder what else the police know, and who is talking.
What I take from it as a builder
None of these people broke into systems with movie magic. Banking trojans stole saved passwords. Ransomware crews bought access from other criminals. A state team sent convincing emails. The defences are still the unglamorous ones: MFA everywhere, patched systems, least privilege and backups you have actually tested.
The honest summary
The Cyber’s Most Wanted list is less a list of geniuses and more a list of business models. Each name represents a way of turning weak security into money. Close those gaps, and you are simply not worth their time.
FAQ
What is the FBI Cyber's Most Wanted list?
It is a public list on fbi.gov of people the FBI has charged with major cybercrimes, such as running banking malware, ransomware operations or state-sponsored hacking. Many entries include rewards for information leading to an arrest.
Who are the most famous people on the FBI cyber most wanted list?
Well-known entries include Evgeniy Bogachev, linked to GameOver Zeus with a reward of up to $3 million; Maksim Yakubets of Evil Corp with up to $5 million; and North Korean programmer Park Jin Hyok, charged over the Sony hack, the Bangladesh Bank heist and WannaCry.
Do hackers on the FBI list ever get caught?
Sometimes, usually when they travel. For example, Russian hacker Roman Seleznev was arrested in the Maldives in 2014 and later sentenced to 27 years in a US prison.