US seizes $6 million in ransom payments and expected to charge Ukrainian over major cyberattack

by | Nov 8, 2021 | Cybersecurity

Yaroslav Vasinskyi, a Ukrainian national who was arrested in Poland last month, is accused of deploying ransomware known as REvil, which has been used in hacks that have cost US firms millions of dollars. Vasinskyi conducted a ransomware attack over the Fourth of July weekend on Florida-based software firm Kaseya that infected up to 1,500 businesses around the world, according to an indictment unsealed Monday.
Vasinskyi and another alleged REvil operative, Russian national Yevgeniy Polyanin, are charged with conspiracy to commit fraud and conspiracy to commit money laundering, among other charges. As part of the investigation, authorities seized at least $6 million in funds allegedly linked to ransom payments received by Polyanin, US officials said.
CNN was first to report on the law enforcement actions before the Justice Department announcement.
The law enforcement bust is one of the most impactful actions yet in the Biden administration’s multipronged fight against ransomware, which accelerated after a series of hacks hampered US critical infrastructure firms this year. While some ransomware groups have continued to breach US companies and demand payment, others have gone quiet in recent months.
Attorney General Merrick Garland said at a press conference that the US and its allies would do “everything in our power” to track down ransomware operatives and claw back the money “they have stolen from the American people.”
Vasinskyi, 22, is being held in Poland pending US extradition proceedings, while Polyanin, 28, remains at large. CyberScoop, first
To turn up the pressure, the State Department last week announced a $10 million reward for key information on the hackers behind the so-called DarkSide ransomware, which forced major US fuel provider Colonial Pipeline to shut down for days in May.
Government agencies have leaned heavily on private experts in their pursuit of criminal hackers. Cybersecurity firm Emsisoft, for example, saved victims of a type of ransomware millions of dollars in ransom payments by discovering a flaw in the hackers’ code.
John Fokker, a former Dutch cybercrime investigator who is now with cybersecurity firm McAfee Enterprise, told CNN that his team had helped law enforcement identify multiple suspects involved in REvil and Gandcrab, another type of ransomware.
No single law enforcement action will be a fatal blow to the lucrative, transnational ransomware economy.
Victims of ransomware attacks paid about $350 million in ransoms in 2020, according to Chainalysis, a firm that tracks cryptocurrency. But that figure is likely just a fraction of the digital extortion that went on that year. And victims who don’t pay the ransom can spend millions of dollars rebuilding their computer infrastructure.
FBI Director Christopher Wray told US lawmakers in September that the bureau was investigating more than 100 different types of ransomware.

CNN’s Evan Perez contributed reporting.