US authorities on Thursday filed charges and sanctions against two Russian nationals who allegedly run a cyber theft operation known as Evil Corp. The organization used malware to steal personal banking information from victims in more than 40 countries, netting them more than $100 million in stolen funds.

The two nationals are named in an indictment as Maksim Yakubets and Igor Turashev. Yakubets, from Moscow, is alleged to have acted as the group’s leader, and Turashev as an administrator. The US Treasury department stated in its press release that it has also sanctioned an additional 15 individuals and seven “entities” associated with the hacking group.

The group’s malware program, known as Dridex, was spread via phishing e-mails which encouraged recipients to click an internet link. Once the malware had infected the recipient’s computer it stole their personal banking information. This information was used to steal the victim’s funds which were sent through a network of money launderers, who then transferred the funds to Evil Corp. members.

The two hackers are still at large and are suspected to be residing in Russia. The US Treasury Department has announced a $5 million bounty for information leading to Yakubets’ capture or conviction, the largest bounty offered for a cyber criminal to date according to the department. Treasury officials believe that Yakubets was also enlisted in cyber operations conducted by the Russian government which targeted national security entities.