US charges 2 in massive ransomware attack

By Eric Tucker and Alan Suderman | Associated Press

WASHINGTON — A suspected Ukrainian hacker has been arrested and charged successful the United States successful transportation with a drawstring of costly ransomware attacks, including 1 that snarled businesses astir the globe connected the Fourth of July weekend, U.S. officials said Monday.

Yaroslav Vasinskyi was arrested past period aft traveling to Poland, according to the Justice Department, which besides announced the betterment of $6.1 cardinal successful ill-gotten funds from a Russian nationalist who was separately charged and remains sought by the FBI.

Both men are alleged to beryllium affiliated with the prolific Russia-based REvil ransomware gang, whose attacks person compromised tens of thousands of computers worldwide and yielded astatine slightest $200 cardinal successful ransom payments, said Attorney General Merrick Garland. Victims person included the world’s largest nutrient processor, JBS SA, and a exertion institution called Kaseya, which was deed successful a vacation play onslaught past July that the institution said affected betwixt 800 and 1,500 businesses that relied connected its software.

The coordination of aggregate agencies crossed the Biden medication amounted to possibly the astir high-profile effect yet to a blitz of ransomware attacks that officials accidental continues to endanger nationalist information and the economy. Deputy Attorney General Lisa Monaco appeared to foreshadow Monday’s announcement successful an interrogation with The Associated Press past week, saying that “in the days and weeks to come, you’re going to spot much arrests” arsenic good arsenic much seizures of illicit ransomware proceeds.

Speaking astatine a quality league Monday, she said, “We person been utilizing each instrumentality astatine our disposal and leveraging each authorization we person to hunt down and clasp accountable cybercriminals wherever they question to hide.”

The indictment accuses Vasinskyi, 22, of deploying REvil ransomware, besides known arsenic Sodinokibi, a wide scope of victims — including the monolithic Kaseya attack.

Yevgeniy Polyanin, a Russian national, is charged successful a abstracted indictment. He’s accused of conducting astir 3,000 ransomware attacks connected companies and entities crossed the U.S., including instrumentality enforcement agencies and section governments successful the authorities of Texas.

Both indictments were filed successful national tribunal successful the Northern District of Texas, a authorities wherever REvil ransomware compromised the machine networks of immoderate 2 twelve section authorities agencies successful the summertime of 2019.

The U.S. is seeking Vasinskyi’s extradition from Poland. Though it successfully seized $6 cardinal successful ransomware payments from Polyanin, the FBI is continuing to question his arrest, and the State Department connected Monday announced a $10 cardinal reward for anyone with accusation starring to the seizure of immoderate leaders of the REvil group.

The Treasury Department, meanwhile, announced sanctions against the brace arsenic good arsenic a virtual currency exchange, Chatex, that it said was utilized to facilitate fiscal transactions for ransomware gangs.

President Joe Biden commended the government’s actions, saying helium was making bully connected his committedness to Russian person Vladimir Putin that the U.S. would clasp cyber criminals accountable.

He said successful a connection that the U.S. was “bringing the afloat spot of the national authorities to disrupt malicious cyber enactment and actors” and to “bolster resilience astatine home.”

The announcement of the transgression charges came hours aft European instrumentality enforcement officials revealed the results of a lengthy, 17-nation operation. As portion of that operation, Europol said, a full of 7 hackers linked to REvil and different ransomware household person been arrested since February, including 2 past week by Romanian authorities.

The Justice Department has tried aggregate ways to code a ransomware scourge that has exploded implicit the past twelvemonth with attacks against captious infrastructure and large corporations. Arrests of overseas hackers are important for the Justice Department, and rare, since galore of them run successful the refuge of countries that bash not extradite their ain citizens to the U.S. for prosecution.

“There’s tons of reasons wherefore radical travel, and I can’t get into the circumstantial reasons wherefore Mr. Vasinskyi traveled, but lad are we gladsome helium did,” FBI Director Christopher Wray said Monday.

Even so, ransomware attacks — successful which hackers prehend and encrypt information and request often-exorbitant sums to merchandise it to victims — person been hard to curb. Monaco told the AP past week that since Biden’s admonitions to Putin past summertime to rein successful ransomware gangs, “we person not seen a worldly alteration successful the landscape.”

Garland did not reply straight erstwhile asked if determination was grounds that the Russian authorities was alert of REvil’s activities, but said, “we expect and anticipation that immoderate authorities successful which 1 of these ransomware actors is residing volition bash everything it tin to supply that idiosyncratic to america for prosecution.”

The $6.1 cardinal seizure successful this lawsuit builds connected a akin occurrence from months ago.

Federal authorities successful June seized $2.3 cardinal successful cryptocurrency from a outgo made by Colonial Pipeline pursuing a ransomware onslaught that caused the institution to temporarily halt operations, creating substance shortages successful parts of the country.

Justice Department officials besides utilized Monday’s quality league to impulse Congress to make a nationalist modular for the reporting of important cyber incidents, and to necessitate that that accusation beryllium shared instantly with national instrumentality enforcement.

Suderman reported from Richmond, Virginia. Associated Press writer Jake Bleiberg successful Dallas contributed to this report.