US costs Kaseya hacker and seizes $6M from REvil ransomware gang – TechCrunch

The U.S. Division of Justice (DOJ) has charged a 22-year-old Ukrainian citizen linked to the REvil ransomware gang for orchestrating the July ransomware assault in opposition to U.S. expertise agency Kaseya. It has additionally seized greater than $6 million in ransom tied to a different member of the infamous ransomware group.

Throughout a information convention on Monday, U.S. Lawyer Common Merrick Garland introduced that Yaroslav Vasinskyi was arrested final month in Poland on the request of the U.S. authorities and is at the moment being held pending U.S. extradition proceedings. Vasinskyi, who used completely different names on-line to keep away from detection, is accused of being a long-time affiliate of the now-defunct REvil ransomware operation and of deploying 2,500 assaults in opposition to companies worldwide.

Most notably, Vasinskyi — whose ransom calls for are mentioned to have totalled $767 million — is accused of being concerned within the high-profile assault on Kaseya, which impacted greater than 1,500 companies in the united statesand carried a ransom demand of $70 million.

U.S. officers have additionally seized $6.1 million in reference to hacking campaigns linked to a different REvil affiliate, Russian nationwide Yevgeniy Polyanin, who’s accused of conducting 3,000 ransomware assaults and extorting round $13 million from victims, U.S. officers mentioned. Vasinsky and Polyanin have each been charged with conspiracy to commit cash laundering, conspiracy to commit fraud and intentional harm to a protected pc.

“The Justice Division is sparing no useful resource to establish and convey to justice anybody, anyplace who targets america with a ransomware assault,” Garland mentioned.

It’s not simply the hackers the U.S. authorities goes after, because the Treasury Division additionally immediately introduced sanctions in opposition to the Chatex cryptocurrency change for facilitating ransom transactions.

Moreover, the State Division has introduced a reward of as much as $10 million “for info resulting in the identification or location of any particular person(s) who maintain a key management place within the Sodinokibi/REvil ransomware variant transnational organized crime group,” in addition to as much as $5 million for info resulting in the arrest or conviction of any particular person taking part in a REvil variant ransomware incident.

Final week it introduced the same bounty for key info on the hackers behind the so-called DarkSide ransomware, which compelled main U.S. gasoline supplier Colonial Pipeline to close down for days in Could. Previous to this, the U.S. has recovered $2.3 million of the ransomware cost that Colonial Pipeline paid to the ransomware gang.

Up to now 5 months, the DoJ’s efforts have resulted within the arrest of seven REvil associates. European regulation enforcement company Europol introduced on Monday that two hackers who used the REvil ransomware to contaminate and try and extort as many as 5,000 victims had been arrested in Romania. The 2 unnamed people, who pocketed €500,000 (roughly $578,000) in ransom funds, had been arrested on November 4, in accordance with Europol. On the identical day, Kuwaiti authorities additionally arrested a 3rd REvil ransomware affiliate.

In addition to Vasinskyi, who was arrested in October when making an attempt to enter Poland from his native nation, two different people believed to be REvil associates had been apprehended in South Korea in February and April, regulation enforcement disclosed for the primary time immediately.

“A complete of seven suspects linked to the 2 ransomware households have been arrested since February 2021,” Europol mentioned. “They’re suspected of attacking about 7,000 victims in whole.”

The arrests are the outcomes of Operation GoldDust, which concerned regulation enforcement brokers from 17 nations, Europol, Eurojust and Interpol. The operation additionally obtained assist from the cybersecurity business from corporations together with Bitdefender, KPN and McAfee. Researchers at Bitdefender supplied technical insights all through the investigation, together with decryption instruments to assist victims of ransomware assaults get better their information with out having to pay the ransom.

In response to Europol, the REvil decryption instruments have helped greater than 1,400 corporations decrypt their networks following ransomware assaults, saving over €475 million ($550 million) from being paid to cybercriminals. In response to U.S officers, the whole REvil ransomware operation obtained greater than $200 million because it began exercise.

These arrests are the most recent in a string of operations by regulation enforcement focusing on ransomware operations. Final month noticed a Europol-led operation goal 12 suspects in Ukraine and Switzerland believed to be behind LockerGoga, MegaCortex, Dharma and different ransomware assaults.