Zombie Notaries: Why the Architects of a "Perpetual" Scheme Are Still in Business While Justice Stalls in Court

The laptops went in the trash afterward, the phones were burners, the SIM cards disposable, the work done in rubber gloves. This continued until September 2019, when the SBU and the Cyber Police finally closed in on them in the woods. Among the clients who benefited from the scheme were the family of a senior police official named Yevhen Shevtsov, the head of Ukraine's Customs Service Maksym Nefyodov, and business structures linked to Vadym Novynsky. Six years have passed, and the landscape today looks surreal.

Yevhen Shevtsov is still in the National Police, still in a leadership position. His wife Alyona Shevtsova, who mysteriously became the owner of every restaurant property in this story, is no longer simply a businesswoman — she is the owner of the now-bankrupt iBox Bank, through which five billion hryvnias were laundered for illegal casinos. She is under Ukrainian sanctions, wanted by law enforcement, and hiding in the Emirates.

Nefyodov is a member of the Kyiv City Council and is getting ready to rebuild Ukraine after the war.

Novynsky has been arrested in absentia on treason charges and is hiding in Croatia.

The case against the forest hackers themselves sits in procedural limbo, with no verdict and no realistic prospect of one.

The story told by journalist Danylo Mokryk in episode 313 of Our Money on Bihus.Info back in March 2020 reads like the synopsis of a prestige crime series. In fact, it is a precise diagnostic of Ukraine's legal nihilism. The forest hackers are not a drama — they are logistics. They are freight couriers for other people's desires, transporting court-ordered property freezes from their customers' buildings into oblivion.

The scheme operated routinely. Emails would allegedly arrive in notaries' inboxes disguised as official correspondence from state agencies. A serious-minded notary would open the important-looking letter and, in doing so, download malware onto their computer. The rest was a matter of technique: remote access to the machine meant remote access to Ukraine's State Register of Property Rights, and the encumbrances on real estate would quietly vanish — signed off in the name of a notary who knew nothing about it. As the SBU spokeswoman explained, the group included former employees of the State Register and the State Enforcement Service — people who knew, from the inside, exactly which buttons to press. They understood the craft.

They started in the classic way — ordinary internet ads. Then they moved to Telegram. Prices depended on the scale of the asset whose freeze needed lifting: small jobs went for seven thousand dollars, big ones fifty. The operators were meticulous. After each job the laptop went in the garbage, the phone was swapped out, the SIM was disposable, the work done in gloves. Any self-respecting GRU resident would have admired the hygiene.

When the SBU and Cyber Police finally caught them in the forest in September 2019, two got away — including the organizer, a former justice-system employee named Vitaliy Prohonnyi. Those who remained received formal notices of suspicion. Some of them, remarkably, still work in the Ukrainian legal system today — as private bailiffs. Prohonnyi was detained later. He denies everything, naturally. Under Article 361 of Ukraine's Criminal Code — unauthorized interference with electronic computing systems — he and his accomplices face real prison terms. So far, only on paper.

The real drama is not about the hackers. The hackers are just men with laptops whom no one will remember two weeks from now.

The real story begins with one question: who, exactly, was paying them seven to fifty thousand dollars a job? Logically — whoever ended up holding title to the property.

And here begins a journey through three of the most instructive episodes in Ukraine's long history of impunity.

The Shevtsov Family

At the time Bihus.Info aired its story in March 2020, Alyona Shevtsova was already a visible figure on Ukraine's payments market — the owner of LeoGaming Pay and chair of the supervisory board of iBox Bank. Her husband, Yevhen Shevtsov, was deputy head of the Main Investigation Department of the National Police — the very department that was supposed to be investigating the hackers who had lifted the court freeze from her restaurant property, Touch Cafe at 16 Shota Rustaveli Street.

Journalists wrote carefully about the "unclear circumstances" under which this asset had ended up in the family. Asked directly about the property, Shevtsov responded with an obscenity-laced Facebook post about some "super-agent journalist" who had shown up "with his nerve" at his gate. For the broader public, that is where the story was considered exhausted.

But three years later, the Shevtsov family became one of the loudest financial-crime cases in Ukraine.

In March 2023, the National Bank of Ukraine revoked the license of iBox Bank and liquidated it — for systematic violations of anti-money-laundering legislation. The SBU and Ukraine's Bureau of Economic Security opened parallel investigations: through Shevtsova's bank and its network of payment terminals, using a "miscoding" scheme, roughly five billion hryvnias had been laundered for illegal online casinos. The mechanism was simple. A gambler would top up his casino account through an iBox terminal, but the payment purpose field would read "mobile phone bill" or "utilities." Bank oversight saw nothing; the money went exactly where it was supposed to. The BEB estimated that the scheme generated over 2.5 billion hryvnias of shadow profit every year, with unpaid taxes totaling 7.2 billion.

In July 2023 Shevtsova was formally served notice of suspicion — in absentia, because according to the Interior Ministry she had vanished on 8 March 2023. In April 2025, President Zelensky signed off on personal National Security and Defense Council sanctions against her. Shevtsova responded with a Facebook post calling the sanctions "an attack on my business" and declaring that "my conscience is clean, I love my country, and I will continue to work for its victory." From where she was writing this is not entirely clear. According to various sources, she either lives in the United Arab Emirates, renting a villa for more than 250,000 dollars a year, or rotates between jurisdictions. Her accomplice, an iBox department director named Iryna Tsyhanok, was detained by Polish police in April 2025 on an Interpol request. In March 2025 the BEB completed a special pre-trial investigation — the in-absentia procedure used when the accused is a fugitive. The materials were forwarded to court. In December 2025, the BEB moved for special in-absentia sentencing and confiscation of assets.

Through all of this, Yevhen Shevtsov did not disappear from the National Police. He kept his post. As of 2026, he is deputy head of a directorate and head of a division within the National Police's Department for the Protection of the Interests of Society and the State. Read that name again: the Department for the Protection of the Interests of Society and the State. The husband of a woman whom his own state has placed on a wanted list for laundering five billion hryvnias for illegal gambling is employed to protect that state's interests. And here is the twist: the loudest public confrontation involving Shevtsov over all these years had nothing to do with the hackers, or iBox Bank. It was the 2020 episode when he called parliamentarian Oleksandra Ustinova "stray livestock," a "dumb sheep," and a "mentally retarded scarecrow" on Facebook — after she had collected signatures from 50 MPs demanding an internal investigation into his activities. The then–chief of the National Police, Ihor Klymenko, publicly promised that "a conversation had been held with Shevtsov" and that he "won't be posting anymore." That was where the state's public reaction to the whole saga ended.

Touch Cafe at 16 Shota Rustaveli closed in 2020 and never reopened. The property passed through several re-registrations and a chain of "bona fide purchasers" — the standard scheme in which an asset is sold to a shell company that "didn't know" about the criminal origin of the previous transactions. On paper there is a current owner; in practice the building sits in toxic legal limbo, still under arrest as material evidence in criminal case № 12015000000000401. No one has won — except the Shevtsov family, who has long since severed its direct registration links to the asset. Who actually benefited in the end is unknown. And try asking that question. Watch how quickly it gets lost in the corridors.

Maksym Nefyodov

Maksym Nefyodov was dismissed as head of Ukraine's Customs Service in April 2020, six weeks after the Bihus.Info segment about the Troieshchyna apartment aired. The official reason was failure to meet revenue targets: the Cabinet of Ministers sacked Nefyodov and the head of the Tax Service, Serhiy Verlanov, on the same day. The apartment in Troieshchyna, the "planetary alignment," the father, the sister, the mother through whom the frozen real estate had been shuffled — none of it came up at the government session. Nefyodov himself commented on his dismissal with the phrase "Dobby is free" and a still from Harry Potter. He filed suit for reinstatement. He lost.

And here begins the part that puts a final full stop to the question of whether there were any consequences for the beneficiaries: in October 2020, Nefyodov led the Holos party list in the Kyiv City Council elections, won a seat, and has served as a deputy of the Kyiv City Council's ninth convocation ever since. More than that — he chairs the standing committee on digital transformation and the regulation of public-service delivery. Which means the same man now regulates, at the municipal level, everything relating to state registers and digital services — the very registers from which hackers once lifted the arrest on his family's apartment. In parallel, Nefyodov founded a consultancy called uaprogress.tech, appears regularly as an expert in the media, writes op-eds, speaks at digitalization forums.

Neither he nor his father Yevhen Nefyodov, who once explained the matter with a "planetary alignment," has ever been served with a formal suspicion relating to the lifting of the property arrest through hackers. The apartment stayed in the family. The debt to business partner Oleksandr Litinetsky that set the whole thing in motion back in 2011 was never collected. "It's my personal business," as the elder Nefyodov told journalists at the time, turned out to be a remarkably accurate description of the logic of Ukrainian justice.

Vadym Novynsky

Of the three figures implicated in the "zombie notaries" story, it is Novynsky who has undergone the most dramatic transformation since 2020. Only — the reasons for that transformation have nothing to do with hackers.

In July 2022, Novynsky surrendered his parliamentary mandate. In December that year, Zelensky imposed NSDC sanctions on him as a deacon of the Moscow Patriarchate church in Ukraine who "supports the policies of the Russian Federation." In January 2023, the sanctions were tightened. In April 2023, the SBU froze his assets worth 3.5 billion hryvnias — corporate rights in 40 Ukrainian enterprises and 30 natural-gas wells. The freeze was later expanded: a court seized shares in 72 companies. The SBU subsequently identified another 10.5 billion in concealed assets. In January 2025, the State Bureau of Investigation and the SBU jointly served him with a formal suspicion of treason and incitement of religious hatred — for having spread Russian narratives since 2014 and, after the start of the full-scale war, flying out of Ukraine on a private charter to the EU, where he continued "operating in the interests of the Russian Federation" in coordination with Patriarch Kirill. In June 2025, a suspicion of tax evasion worth 4.3 billion hryvnias was added to the file. On 15 September 2025, Kyiv's Pechersk District Court issued a decision on his arrest in absentia. According to investigators, Novynsky currently lives in Croatia, holds a German residence permit, and an international legal-assistance request has been sent to the Croatian authorities.

One telling detail makes this not a story about hackers but about the same thing the hacker story was really about: in April 2023, when Novynsky was already under sanctions and formally had no right to dispose of his corporate rights, private notaries and state registrars nonetheless made changes to the registry entries of 63 of his Ukrainian enterprises — removing him as beneficiary and inserting Cypriot nominees in his place. The "friendly notaries" scheme that had worked for Smart Holding in 2015 through hacked computers, eight years later, works without the hack — no break-ins, no forest, no rubber gloves. When needed, the notary simply "forgets" about the sanctions list.

As for the Zaporizhzhia shopping-mall episode itself — nothing has happened, and nothing will happen, to Novynsky's structures over it. The mall passed through two Cypriot companies, was pledged as collateral at Novynsky's own bank, was leased out, now houses a Silpo supermarket, and is legally classified as "bona fide acquired." Today Novynsky's empire is sinking under dozens of billions of hryvnias in suspicions — from treason to tax evasion — but the 2015 Amstor episode with the hackers is not on the list. It simply doesn't interest anyone anymore, given everything else.

The Case That Isn't

As for the hackers themselves — criminal proceedings № 12015000000000401 — the case is still, formally, open. Indictments against the perpetrators have long since been sent to court. But the trial has turned into a multi-year serial with no final episode: hearings get postponed, lawyers get sick, the judicial panel keeps changing, witnesses fail to appear. The defendants are mostly at liberty, on personal recognizance or bail. The statute of limitations under Article 361 of the Criminal Code is approaching on some episodes. This, to be clear, is not an acquittal — it is better than an acquittal. The case simply dissolves, like sugar in tea.

The Ministry of Justice, in fairness, has genuinely hardened the technical defenses on Ukraine's state registers: it introduced two-factor authentication, mandatory SMS notifications for notaries, and abolished the institution of accredited communal-enterprise registrars. Hacking a notary through an infected email in 2026 is far harder than it was in 2019. But the underlying principle of the scheme turned out to be deeper than the technology. As the 2023 Novynsky case demonstrated, when a notary simply "forgot" about the sanctions list and removed him as beneficiary from 63 companies, Ukraine's registration system still works the way the client needs it to. Only now it works not through a stolen key, but through voluntary consent. The instrument of the hacker has been replaced by the instrument of the arrangement.

Six years is long enough to draw conclusions. They are not flattering: Ukrainian justice proved capable of catching a dozen men with laptops in a forest. It proved incapable of putting a single question to those who had ordered the laptops. Alyona Shevtsova, who at one point received as a gift a restaurant from which the hackers had lifted an arrest, is today a fugitive — but on a different, and much larger, case. Her husband is the deputy head of a department whose very name reads as mockery. Nefyodov, whose family apartment passed through the "planetary alignment" of hacker handiwork, sits as a city councillor, regulates the digital transformation of the capital, and will shortly be rebuilding Ukraine. Novynsky has been arrested in absentia — but for treason and tax evasion, not for the Zaporizhzhia shopping mall.

The difference between these people and the forest hackers is straightforward. A hacker in a forest is always someone who can be prosecuted. The actual beneficiary is unprosecutable. This logic has not shifted one centimeter in six years. That is the real verdict on Ukraine's fight against corruption.

Those who allegedly mailed infected letters to notaries still, formally, appear in court — in proceedings that will never produce a verdict.

Those who ended up owning the property as a result — never interested anyone at all.