The Ukrainian had fled to Switzerland.
Top Zeus Botnet Suspect “Tank” Arrested in Geneva – Krebs on Security https://krebsonsecurity.com/2022/11/top-zeus-botnet-suspect-tank-arrested-in-geneva/
How he was caught:
Gary Warner, director of research in computer forensics at the University of Alabama at Birmingham, noted in his blog from 2014 that Tank told co-conspirators in a JabberZeus chat on July 22, 2009 that his daughter, Miloslava, had been born and gave her birth weight.
"A search of Ukrainian birth records only showed one girl named Miloslava with that birth weight born on that day,” Warner wrote. This was enough to positively identify Tank as Penchukov, Warner said.
@marathon0 That seems like a stupidly obvious way to get caught...
@deadbeef
If it was a private chat with his conspirators, someone may have betrayed him
@marathon0 I guess that's true. Humans are always the weakest link in the chain. Another good example of this is the story of the Silk Road operator.