REvil member accused of Kaseya ransomware attack arraigned in Texas

Yaroslav Vasinskyi faces up to 115 years in jail.

The Justice Department extradited and arraigned a member of the REvil ransomware group accused of conducting multiple ransomware attacks, including the July attack against Florida-based IT and security firm Kaseya.

Yaroslav Vasinskyi, 22, is one of two REvil members the Justice Department indicted for the attack in August 2021. U.S. officials announced charges against Vasinskyi and Russian national Yevgeniy Polyanin in November.

Vasinskyi was arrested on Oct. 8 in Poland and held there before extradition to the United States. When authorities announced his arrest, they also announced the seizure of $6.1 million in funds traced to ransomware payments from the attacks. He made his initial appearance in a Texas court on Wednesday, where he was arraigned.

Vasinskyi allegedly deployed malicious code belonging to the REvil ransomware gang (also referred to as Sodinokibi) through a Kaseya product, leading it to spread to customer computers. Vasinskyi left victims a ransom demand for virtual currency in exchange for a key to decrypt their files.

The attack on Kaseya led to the breaches of more than 1,500 of the company’s clients, including schools in New Zealand, a major Swedish grocery chain and two Maryland towns. Three weeks after the attack, the FBI provided Kaseya a decryption key to help hundreds of victims to recover their files.

“When last year I announced charges against members of the Sodinokibi/REvil ransomware group, I made clear that the Justice Department will spare no resource in identifying and bringing to justice transnational cybercriminals who target the American people,” Attorney General Merrick Garland said in a statement. “That is exactly what we have done. The United States, alongside our international partners, will continue to swiftly identify, locate, and apprehend alleged cybercriminals, capture their illicit profits, and bring them to justice.”

The FBI also accuses REvil of being behind a May attack on meat supplier JBS. Between April 2019 and June 2021, REvil affiliates generated some $200 million in ransomware payments in the U.S. and elsewhere, according to the FBI. The FBI seized a separate $2.3 million worth of cryptocurrency from a hacker affiliated with the REvil ransomware gang in August.

Vasinskyi faces 115 years in prison on charges of computer fraud, conspiracy to commit money laundering and damage to protected computers. 

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure