Tank: inside the mind of one of the world’s most wanted hackers

For more than fifteen years, Vyacheslav Penchukov – known in the digital underworld as Tank– was one of the most enigmatic and sought-after figures in international cybercrime. Charismatic, unpredictable, and astonishingly sociable, Penchukov did not stand out for exceptional technical skill, but rather for an innate ability to gain trust and build networks of collaborators. From Englewood prison in Colorado, where he is serving two nine-year sentences, he has given his first extensive interview, revealing unprecedented details about the operations, alliances, and mindset of the cyber gangs that have sown global chaos for two decades.

The story of Penchukov begins far from the Rocky Mountains that surround Englewood. In Donetsk (Ukraine), teenage hacking began by looking for tricks for video games such as FIFA 99 or Counter-Strike. Over time, this informal learning led him to head Jabber Zeus, a group that, in the late 2000s, used the sophisticated malware Zeusto infiltrate bank accounts of companies, municipalities, and NGOs. In just three months, more than 600 British victims lost over £4 million.

Tank was then a twenty-five-year-old man living among luxury German cars, late-night DJ sessions, and a secret office where he and his team stole money during six or seven-hour shifts. As explained, at that time cybercrime was easy money: unprotected banks, overwhelmed police, and a digital world that was poorly prepared.

But the party ended when the FBI intercepted their conversations on Jabber and discovered their identity from a banal detail: the birth of their daughter. An international operation, Trident Breach, resulted in multiple arrests, but Tank escaped thanks to a tip-off and the speed of his Audi S8 with a Lamborghini engine. After hiding for a while, he tried to reform himself by managing a coal business. However, the constant bribery of Ukrainian officials and the impact of the war in the Donbass pushed him back into criminal activity.

Starting in 2018, Penchukov returned with more strength, now immersed in the ransomware ecosystem, a business much more lucrative than traditional bank robbery. He was part of well-known groups such as Maze, Egregor, Conti, or IcedID, specialising in infecting corporate systems, extorting companies, and even hospitals. In his opinion, the profits could reach $200,000 per month, although there were rumours of million-dollar ransoms circulating within the criminal forums.

The hacker community, as explained, operates on a herd mentality: when a group achieves an exceptional haul, hundreds of imitators launch similar attacks without considering the human consequences. And for many of these offenders, victims are just numbers, and the damages are matters covered by insurance.

One of the most controversial aspects of his testimony is the natural confirmation that several ransomware groups maintained regular contacts with Russian security services, including the FSB. This hypothesis had already been pointed out by multiple Western agencies, but Tank describes these connections as common practice.

He also speaks of his former relationship with Maksim Yakubets, alleged leader ofEvil Corpoand subject of a $5 million bounty. They were friends, going out together in Moscow, and Yakubets, apparently obsessed with showing off his wealth, was surrounded by bodyguards. But when Yakubets was arrested in 2019, the cybercrime community turned its back on him. Penchukov claims that he himself avoided it out of fear of being related to it.

The capture of Penchukov in 2022 was worthy of a film: an operation in Switzerland with snipers on the rooftops, hooded agents, and his children as unwitting witnesses. He still considers that the operation was excessive, but the thousands of victims who have lost savings, jobs, or stability would likely disagree.

In Englewood, Tank spends his days studying languages, playing sports, and obtaining secondary school qualifications. In the final stretch of his confession, Penchukov admits that his downfall came from the very collaborators with whom he had shared fortune and risk. In cybercrime, he says, you can’t have friends. Everyone distrusted everyone; many, when they were arrested, became informants. Paranoia is the only constant in the criminal world.

Now, as he awaits a possible sentence reduction and faces a restitution order of $54 million, Tank looks back with a mix of pride, nostalgia, and justification. He speaks of the past with an almost romantic tone, like a distant adventure. But the traces of his legacy—ruined businesses, paralysed hospitals, affected families—still live on.

_____

Aquest apunt en català / Esta entrada en español / Post en français

A new report from Europol explores the use of robotics and unmanned systems in the fight against crime

Europol has recently published the Unmanned future(s): The impact of robotics and unmanned systems on law enforcement. The report, prepared by the Europol Innovation Lab, provides an in-depth analysis of how unmanned systems could change society, crime, and law enforcement, and examines the challenges and opportunities they present.

The report highlights the rapid advancement and integration of unmanned systems in various sectors, including law enforcement. As these technologies become more sophisticated and widespread, they offer new opportunities for law enforcement operations and operational support. However, they also introduce new threats to security, such as misuse by criminal and terrorist groups, and regulatory challenges that law enforcement must address to ensure public safety and maintain trust.

One chapter of the report highlights the role of war as a driver of innovation in unmanned systems. Recent conflicts, such as the ongoing Russian war of aggression against Ukraine, have been a catalyst in the development and deployment of advanced unmanned systems. The lessons learned from these conflicts are invaluable for law enforcement in Europe as they prepare for the future operational environment.

Unmanned systems are becoming increasingly useful, affordable, and widely available, with applications in both the public and private sectors. Police forces across Europe are expanding the adoption of these systems, including drones and robots, to improve situational awareness, enhance safety, and broaden operational reach. These systems are used for a range of tasks such as surveillance, crime scene mapping, search and rescue operations, and explosive ordnance disposal, among others. Converging technologies present a significant opportunity for advancing the capabilities of unmanned systems.

The report highlights significant technical limitations and regulatory gaps that hinder the effective use of unmanned systems in law enforcement. Problems such as limited autonomy, dependence on industrial suppliers, and the lack of clear guidelines for autonomous operations pose significant challenges.

Criminal and terrorist groups are rapidly adopting unmanned systems for illicit activities. The report warns of the potential for these systems to be used for criminal surveillance, smuggling, and even attacks. The growing accessibility and versatility of drones, in particular, present serious security issues.

Public trust is crucial for the legitimacy of law enforcement capabilities. The report emphasises the need for transparency, accountability, and public participation in the deployment of unmanned systems. Current regulations, despite advancing, still have loopholes, especially when it comes to addressing non-compliant or criminal use.

The future of law enforcement will require police action in a three-dimensional space, as unmanned systems operate in the air and on the ground, as well as on and under water. This change will require new strategies, technologies, and training for the agencies responsible for law enforcement.

The report provides a set of recommendations for European law enforcement agencies, including the development of a strategic direction, the establishment of a competency hub, and the integration of unmanned systems into existing information systems. It also calls for investments in training, education, and initiatives to promote public trust.

_____

Aquest apunt en català / Esta entrada en español / Post en français

What do zombies and drug prevention have in common?

When we think of drug prevention, it is unlikely that images of zombies walking down the streets come to mind. But in Dover, New Hampshire, U.S., this surprising combination has become a powerful educational tool. And it is just one of the many initiatives of Dover Youth to Youth (Y2Y), a pioneering programme led by youth working to reduce substance use in their community.

How did Dover Youth to Youth come about?

The project started in 1992, driven by the Dover Police Department, with a small group of eleven secondary school students. The objective was clear: to give a voice to young people and make them an active part of the solution to the problems of substance use and abuse.

Today, Y2Y is a vibrant organisation of more than 70 students aged between 11 and 18, distributed across several action teams. Students join for many reasons: interest in activism, personal experiences, or simply out of a desire to create positive change.

Y2Y activities are varied and very dynamic. Weekly, the teams meet to train and develop projects in four areas:

  • Education: Presentations in schools, workshops on medication safety, and community talks.
  • Community awareness: Creative campaigns and public events.
  • Public policy: Young people have contributed to the passage of eight municipal ordinances and three state laws.
  • Media: They have created more than 200 radio announcements and educational videos.

Among its most popular projects is The Zombie Project, a campaign that highlights the importance of participating in the DEA’s Drug Take Back Day. Days before the event, young people dress up as zombies to inform the public about the risks of keeping unnecessary medications at home. Their motto is direct and effective: ‘If you think zombies are scary, you better take a look inside your medicine cabinet’.

In 2013, Dover Youth to Youth was recognised as an evidence-based programme in New Hampshire. This distinction allowed them to expand their influence by providing training and resources to youth groups across the United States. One of its most important projects is the One Voice Youth Empowerment Toolkit, a comprehensive set of tools and guides for other communities to replicate its successful model.

The dramatic increase in fentanyl-related deaths has driven Y2Y to create new campaigns tailored to the current reality. In 2024, they launched Dealer is Not a Doctor, focused on the risks of counterfeit pills that mimic real medications but contain fentanyl in potentially lethal doses.

With the support of DEA agents and a large youth mobilisation, the campaign has included demonstrations, distribution of informational materials, and a strong media presence. The message is clear: Do not take any medication that has not been prescribed by a doctor. A ‘dealer’ is not a doctor and does not care for your health.

The main message of Dover Youth to Youth is that young people have the power to transform their community. Whether disguised as zombies, speaking in front of the town hall, or creating multimedia content, these students demonstrate that prevention is more effective when led by the young people themselves.

For any youth group that wants to start a similar project, Y2Y recommends not to reinvent the wheel: there are tools, national campaigns, and resources prepared to be used. What is important is to have passion, commitment, and the desire to create real change.

_____

Aquest apunt en català / Esta entrada en español / Post en français

Season’s greetings and Happy New Year

Thank you everyone for your cooperation. We return on January 12th. Happy Holidays!

_____

Aquest apunt en català / Esta entrada en español / Post en français

Mistaken prison releases in England and Wales: symptom of a system close to breaking point

Between April and October of this year 2025, 91 prisoners were mistakenly released in England and Wales, according to recent data from the British Ministry of Justice. The figures come at a time when the UK government is facing severe pressure following several high-profile cases that have shaken public confidence in the prison system.

This is not an isolated incident: the trend in recent years is clearly upward. In the twelve months running up to last March, 262 inmates were released by mistake, an increase of 128% over the previous year. An alarm signal that points to a deep structural problem.

The Justice Secretary, David Lammy, has openly acknowledged that the British prison system is in a horrendous state. In their view, the 25% reduction in prison staff between 2010 and 2017 has left facilities without sufficient expertise or resources to manage such sensitive processes as releases.

Lammy argues that radical reform is needed and that only technology can prevent mistakes in the future. For this reason, the government has announced several measures:

  • Creation of a team of data scientists to analyse historical errors.
  • Investment of up to £10 million in new AI tools to reduce human error and replace outdated paper-based systems.
  • A hotline to verify outstanding court orders prior to releases.
  • Simplification of release policies to standardise procedures.

In addition, the government has pushed for an independent review, which is expected to present results next February.

The crisis has opened a new political front. The shadow justice secretary, Robert Jenrick, has accused the Labour government of generating confusion with its early release programme, created to relieve prison overcrowding. This system allows certain prisoners to be released after serving 40% of their sentence, instead of the usual 50%.

Jenrick believes that Lammy’s management is an absolute farce and that public safety is in jeopardy. In his opinion, the minister has lost control of the system and has been reluctant to publish the data.

Lammy maintains that the early release programme was inevitable because the Conservatives did not expand their prison capacity when they governed. Among the most troubling details, Lammy confirmed that three of the prisoners released by mistake are still at large:

  • One initially arrested for not turning himself in to the police, released in December 2024.
  • A prisoner for drug offences, released in August 2024.
  • A perpetrator of aggravated burglary, released in June 2025.

One of them is foreign; the other two are British. In addition, authorities are investigating a possible fourth recent case, from 3rd November.

The situation has been intensified by recent cases that have filled headlines such as:

  • Two prisoners mistakenly released in less than a week from Wandsworth Prison, who were eventually captured.
  • The wrongful release of Hadush Kebatu, a migrant who had arrived in the UK on a dinghy and sexually assaulted a 14-year-old girl while living in an asylum hotel. The case sparked protests throughout the country.

Kebatu was eventually deported, but the reputational damage had already been done.

The growth of release errors in British prisons is not just a statistic: it is the sign of a system close to breaking point. Lack of personnel, accumulated pressure, outdated processes and lack of coordination between institutions are problems that cannot be ignored.

Reform, therefore, is not optional: it is essential. And the future of the British prison system will depend, to a large extent, on whether the government is able to implement the announced measures and regain the confidence of an increasingly sceptical public.

_____

Aquest apunt en català / Esta entrada en español / Post en français

Heavy blow to antiquities trafficking: 35 arrests in Bulgaria in a macro European operation

Last November 2025 marked a turning point in the fight against the illegal trafficking of works of art and cultural goods in Europe. During an action day coordinated by the Bulgarian authorities, with the support of Europol and the participation of agents from up to six countries, an extensive criminal network dedicated to the looting and illicit trade of Greco-Roman and Thracian antiquities was dismantled.

This operation is the result of years of research and international cooperation and puts the spotlight on a phenomenon that has a major impact on European and world cultural heritage.

It all started in 2020, when a house raid in Bulgaria culminated in the seizure of 7,000 priceless cultural assets. The lack of reliable documentation and the large number of objects set off all the alarms: it was, in all probability, one of the largest sets of looted antiquities discovered in the country.

Among these objects were:

  • masks and antique jewellery,
  • military equipment,
  • ceremonial vases and cups,
  • unique pieces dating back to 2000 BC.

Since then, the collection has been kept in custody at the Bulgarian National History Museum, while a far-reaching investigation progressed that has ultimately revealed a highly organised cross-border criminal network.

The action day was as impressive as it was meaningful:

  • 35 arrests in Bulgaria.
  • 131 searches in several countries (Bulgaria, Albania, France, Germany and Greece).
  • More than 3,000 goods seized, including gold and silver coins.
  • Total estimated value: more than 100 million euros.
  • In addition, works of art, weapons, documents, electronic equipment, gold and more than 50,000 euros in cash were seized.

The main High Value Target (HVT) of the investigation is suspected of financing illegal excavations in Bulgaria and other Balkan countries. The mechanism was clear: groups of local looters excavated archaeological sites to order, and intermediaries laundered the pieces through the international art market.

The case highlights a reality well known to investigators: the art market is a fertile ground for criminal activities. The demand for unique objects and the difficulty of verifying their provenance facilitate the entry of illegally looted artefacts.

The Balkans and Italy, rich in Greco-Roman archaeological heritage, have been the target of antiquities trafficking networks for decades. And this problem is not local: pieces from conflict zones such as Syria or Iraq are often mixed in.

Since 2024, a Europol task force has been instrumental in connecting dots, linking suspects and identifying devices scattered across several countries. This model of cooperation – combining analytics, information sharing and joint actions – is more necessary today than ever.

The dismantling of the network is an important victory but also a reminder: the protection of cultural heritage requires constant vigilance and coordinated global efforts.

_____

Aquest apunt en català / Esta entrada en español / Post en français

The world at a crossroads: how illicit economies threaten global order

The world is at a turning point. Illicit economies —from drug trafficking to cybercrime to counterfeiting— are growing and adapting at a speed that challenges governments, institutions and communities. Far from being a marginal phenomenon, organised crime has become a force that erodes democracy, jeopardises state sovereignty and threatens international peace and security.

In this context, the Global Organized Crime Index becomes much more than a measurement tool: it is a mirror that reflects deep trends within states and the international system. And its third edition allows us, for the first time, to follow the evolution of these phenomena over five years.

Data from this year’s edition show key changes in the global criminal economy. One of them is the unstoppable rise of synthetic drugs and cocaine, which are increasingly dominating the markets. This growth responds to criminal actors capable of quickly adapting to:

  • changing consumer tastes,
  • technological improvements in production,
  • and more interconnected traffic networks than ever before.

The Index detects an accelerated increase in non-violent forms of crime, such as:

  • financial crimes,
  • fraud and digital scams,
  • cyber-dependent crimes.

These activities, increasingly integrated into transnational financial and digital systems, do not require violence to cause enormous damage. Companies, governments and citizens end up paying the price.

Another example is counterfeiting, which is growing everywhere, fuelled by inflation, labour instability and trade tensions. When incomes fall, demand for counterfeit products tends to increase.

The Index also reveals that state-linked criminal actors remain the most prevalent. However, it is the foreign actors who are experiencing the most pronounced overall growth. This confirms that organised crime is more mobile, flexible and transnational than ever.

In addition, the private sector —whether willingly or through negligence— has a growing role as a facilitator of crime, especially in areas such as logistics, finance or technology.

Although many criminal markets are expanding, states’ resilience scores have stagnated. A clear example is international cooperation: traditionally a strength but now weakened by a more polarised global system and a retreat from multilateralism.

This is an alarming sign, especially on the 25th anniversary of the United Nations Convention against Transnational Organized Crime.

Despite this complex picture, the data also offer a message of hope. The Index demonstrates that strengthening key elements of resilience can:

  • reduce the influence of criminal actors,
  • transform entire communities,
  • and lead societies onto more positive paths.

The Index is not only a diagnosis: it is a tool for solutions. It points out vulnerabilities, but also shows avenues for reform, institutional strengthening and civil society empowerment.

In short, the Index provides a shared evidence base for governments, policy makers, NGOs and international actors to turn knowledge into policy and urgency into action. At a time when organised crime is evolving faster than ever, such a global and comparative view is essential to guide future decisions.

_____

Aquest apunt en català / Esta entrada en español / Post en français

Today is bank holiday in Catalonia.

We don’t publish any post. See you on Wednesday.

_____

Aquest apunt en català / Esta entrada en español / Post en français

Europol and partner countries combat online radicalisation on gaming platforms

Europol supported eight countries in identifying and eliminating racist and xenophobic propaganda shared on gaming platforms. The referral action day, involving Denmark, Finland, Germany, Luxembourg, the Netherlands, Portugal, Spain and the United Kingdom, led to the referral of thousands of URLs leading to dangerous and illegal online material.

Carried out on 13 November 2025, this operational action by the European Union Internet Referral Unit (EU IRU) involved the referral of thousands of URLs leading to dangerous and illegal online material. This includes about 5,408 links to jihadist content, 1,070 links to violent right-wing extremist and terrorist content, and 105 links to racist and xenophobic content.

This joint action highlights the complexity of addressing terrorist, racist and xenophobic online content on gaming and gaming-adjacent platforms. The processes of creation and dissemination are layered and often involve multiple platforms. For example, content can be recorded within an online game (or its chat function), altered with violent extremist jargon, suggestive emojis, chants or music and then disseminated on a conventional social media platform.

During the weeks leading up to the action day, the participating experts examined various platforms widely used by youngsters and adults. Users of these gaming and streaming platforms may encounter a variety of dangerous and violent content.

For example, perpetrators recreate terrorist attacks, school shootings or execution scenes in a 3D game, edit the video with chants or suggestive emojis and disseminate it on various commonly used social media platforms for an even wider reach. Other gaming-related platforms intended for game streaming are misused to recruit minors into various violent extremist and terrorist groups or to livestream actual attacks and even suicides.

The target content during the referral action day was found on various types of platforms. Some allow players to broadcast their gameplay in real time and interact with their community via live chat, while others add on-demand videos. Illegal content was also identified on community platforms intended to facilitate the exchange of tips, news and discussions about video games. Lastly, there are hybrid or specialised platforms that combine streaming, community functions and game purchase options. Many accounts on these platforms may not be immediately recognisable as being linked to problematic content, while some even feature usernames and profile pictures with references to infamous terrorists.

EU IRU’s prevention activities are centred around three key areas: monitoring and analysis of online terrorist content, referrals and public-private partnerships. The forthcoming Transparency Report highlights activities carried out in these areas in 2024 and summarises the Unit’s efforts to reduce public access to terrorist content online. In addition, the report describes the activities of the EU IRU in support of the implementation of the Regulation on addressing the dissemination of terrorist content online.

This action day came about as a result of law enforcement authorities across Europe observing that a variety of gaming and gaming-adjacent platforms were being misused as venues for radicalising and disseminating terrorist content online. This abuse is also reflected in various investigations supported by Europol’s European Counter-Terrorism Centre. Prior to this action day, Europol experts organised several operational meetings and facilitated the exchange of operational information and best practices among the participating countries.

_____

Aquest apunt en català / Esta entrada en español / Post en français

Operations against synthetic drugs in Central and Eastern Europe

In early November 2025, Europol welcomed 191 experts from 51 countries to its headquarters in the Hague for the latest edition of the Annual Drug Conference. The discussions focused on emerging trends in the production and trafficking of synthetic drugs, the challenges posed by cocaine trafficking, and strategies to strengthen international cooperation in the fight against these threats. Participants also explored innovative methods to dismantle the criminal networks involved in drug trafficking.

The trade in illicit drugs continues to be a significant threat to the internal security of the EU. In particular, synthetic drugs are very dynamic, with changing routes and a variety of criminal actors. They are produced on a large scale in the EU, both for local markets and for export abroad.

Given the seriousness of the matter, Europol has made the fight against synthetic drug trafficking a top priority. In this context, the agency has provided support to two major operations in recent weeks targeting the entire supply chain:

1.- Criminal network dismantled in Central and Eastern Europe

On 11 November 2025, law enforcement agencies dismantled an international criminal network supplying key precursors used to produce methamphetamine and operating across Europe. Authorities in Bulgaria, Czechia, Hungary, Romania and Moldova, with the support of Europol, participated in the investigation. Eurojust set up and funded the joint investigation team between the Czech, Romanian and Moldovan authorities, which enabled them to track the flow of illicit substances and communications and gather evidence for the prosecution of the criminal group.

The action day involved:

  • 16 arrests (1 in Bulgaria, 11 in Czechia, 2 in Hungary and 2 in Moldova).
  • 18 searches (3 in Czechia, 2 in Hungary, 1 in Romania and 12 in Moldova).
  • 3 clandestine drug laboratories dismantled in Hungary and Moldova.
  • Seizure of synthetic drugs and chemical materials for producing methamphetamine, including more than 5 kg of methamphetamine, 40 kg of pills containing ephedrine, 50 litres of toluene, 0.5 kg of phosphorus, 280 kg of caustic soda, and 70 kg of chemical production waste.
  • Seizure of two vehicles used to transport drugs.
  • Seizure of electronic devices and cash.

The suspects were involved in all stages of the drug production chain: they imported chemicals, produced synthetic drugs, and smuggled them in the luggage of aeroplanes and in hidden compartments of vehicles to avoid detection by authorities.

2.- In addition, in an unprecedented operation in the EU, the authorities seized more than 40 tonnes of precursors intended for the production of MDMA, amphetamine and methamphetamine in Hungary and Germany. The investigation lasted two years, and the most recent action took place on 4 and 5 November 2025, resulting in:

  • 4 arrests
  • 8 property searches
  • Synthetic drugs seized
  • Seized precursors and chemicals
  • Vehicles, jewellery and electronic devices seized
  • €67,000 in cash seized

The investigation revealed that the precursors were shipped from China to the ports of Hamburg and Rotterdam. There, they were collected by members of the criminal network and sent to Hungary for further distribution. The perpetrators operated in many European countries and had the capacity to supply large quantities of chemicals, enabling large-scale drug production.

The criminal network targeted by this operation was linked to several shipments of precursor chemicals seized between 2023 and 2025. During this period, the authorities intercepted almost 32 tonnes of precursors in Hungary and more than 10 tonnes in Germany.

_____

Aquest apunt en català / Esta entrada en español / Post en français