Cyber Hack · BBC World Service

Evil Corp: 3. Agents on the doorstep

November 3, 2025·30 min·2 clips

Just before dawn on September 28th, 2010, British police hit 28 addresses and make 19 arrests.

1. CyberHack’s season 3 episode “Agents on the Doorstep” tracks the Jabba Zeus crew across Ukraine, the UK, the Netherlands, Russia, and New York. 2. Sarah Rainsford and Joe Tidy present the episode, while Mikhailo Sakhali, called Misha, and FBI Special Agent Jim Craig drive the investigation. 3. The episode asks how investigators closed in on the cybercrime group before the police raids began. 4. Misha joined Ukraine’s SBU straight out of high school at age 17 and spent five years in the academy before his computer skills put him on the case. 5. The FBI sent Misha chat logs from the hackers’ Jabba server, and he saw roles like leadership, malware, QA, cash-out, and a help desk. 6. The chats also included personal talk about babies, toys, and pizzas, which helped investigators identify the people behind the handles. 7. Misha focuses on Tank, later identified as Vyacheslav Penchukov, who was known in Donetsk nightlife as DJ Slava Rich. 8. A DJ who knew Tank describes him as more interested in music than partying and says he asked detailed questions about mixing tracks and producing music. 9. The same witness says Tank boxed, played football, and was short but solidly built. 10. Misha’s impression from the chats is that Tank was smart, organized, and effective at managing people. 11. A later chat warning from Guslik tells the group that SBU and Americans know their real names, handles, and Donetsk location. 12. Tank reacts angrily and is told to sanitize his apartment, remove incriminating evidence, install cameras, and watch the door. 13. After that warning, the group changes aliases but keeps using the Jabba server for a while before it goes silent. 14. Jim Craig returns to Ukraine by train to Donetsk, thinking about hundreds and thousands of ruined small businesses and millions of dollars stolen through networks in the UK, Russia, and beyond. 15. In London, Detective Sergeant Simon Williams runs covert surveillance on Mr Pizza, a money mule, and watches him leave Woolwich Magistrates Court after a drink-driving conviction. 16. Simon holds off arresting him as he goes to a pub with other money mules and then to a cash point, because the team wants evidence on the wider network. 17. Simon later tracks Mr Toy and Mrs Toy, who travel to the UK and become part of a planned coordinated set of 28 searches and arrests. 18. When British police finally move on September 28th, 2010, they seize fake bank-account files, phones, laptops, and a paper trail that shows the operation was highly regimented. 19. The episode’s tone mixes procedural detail with field reporting, including train travel, nightclub memories, surveillance work, and late-night raids. 20. Listeners who like international cybercrime investigations and police coordination will get the most from it, while listeners wanting a self-contained ending may skip it.

As heard by us

A cybercrime story built from hacker chat logs, named roles, and the careful work of mapping how the scheme operated.

The episode does a solid job of turning hacker chat logs into something legible: names, roles, and the shape of a criminal machine. Mikhailo Sakhali, or Misha, gives it a human center as the SBU analyst who works through the FBI's data and maps who was who in Ukraine.

Read the full review in PlayNext →

Why you'd press play

Follow a cybercrime case as Ukrainian investigators map the hackers' hierarchy while the FBI closes in.

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from Cyber Hack