Canadian Netwalker ransomware crook pleads guilty to million-dollar crimes
(2022/02/08)
- Reference: 1644351409
- News link: https://www.theregister.co.uk/2022/02/08/netwalker_ransomware_jailed/
- Source link:
A Canadian who used the Netwalker ransomware to attack 17 organisations and had C$30m (US$23.6m) in cash and Bitcoin when police raided his house has been jailed for more than six years.
Sebastien Vachons-Desjardins of Gatineau, Ottawa, was sentenced to six years and eight months in prison earlier this month after pleading guilty to five criminal charges in Ontario's Court of Justice.
"The Defendant excelled at what he did," sniffed Justice Paul Renwick in a sentencing note published on Canadian [1]court document repository CanLII . "Between 10-15 unknown individuals hired the Defendant to teach them his methods. Some of these activities benefitted those interested in securing computer networks from these types of attacks. Some of the Defendant's students were likely other cyber threat actors."
[2]
Vachons-Desjardins was arrested last year after the Federal Bureau of Investigation accused him of [3]bringing in $27m for the Netwalker gang of which he was a part. The FBI said last year it had retrieved US$450k worth of cryptocurrency from three separate infections, while saying Bulgarian police had shut down a "dark web hidden resource" used by Netwalker.
[4]
[5]
In [6]a 2020 analysis Sophos said Netwalker's tools included "programs intended to capture Domain Administrator credentials from an enterprise network."
"Some of the scripts and exploit tools were copied directly from Github repositories," said Sophos, adding: "Several of the tools are freely available Windows utilities, such as Amplia Security's Windows Credential Editor."
[7]
Sentencing Vachons-Desjardins, the judge said: "The Defendant personally profited greatly from these offences; he earned the equivalent of over $600,000 in cash (seized by police), bank balances of over $400,000, and Bitcoin transfers to money spent estimated at $1,755,000, and the value of at least 944 Bitcoins (720 seized and 224 paid in the days leading up to the seizure to invest in NetWalker), worth over $30,000,000 when seized."
The sentence was imposed for two counts of extortion, one count of participating in the activities of a criminal organisation, and one count of "mischief to data". The newly convicted criminal still faces extradition and trial in the US.
His victims, who are all receiving five to six-figure sums in "restitution" ordered by the judge, included: Windward Software Systems (which makes an ERP suite); Cegep St Felicien, a Quebecois college; business insurance firm Continental Casualty Company; and custom car shop Enterprise Robert Thibert, among others.
[8]Russia starts playing by the rules: FSB busts 14 REvil ransomware suspects
[9]Feds cuff Russian said to be developer of 'Trickbot' ransomware
[10]Cuffed: Ukraine police collar six Clop ransomware gang suspects in joint raids with South Korean cops
[11]BlackMatter ransomware gang says it's disbanding – again – after Ukraine arrests
Ransomware gangs are relatively rarely brought to trial, so Vachons-Desjardins' guilty plea makes him an unusual suspect.
Ukrainian police have made a number of [12]arrests over the past few months , while the US has, over the years, [13]occasionally imprisoned foreign criminals who travelled to countries with American extradition treaties.
[14]
Even Russia, thought to be home to most ransomware criminals, seems to have [15]got in on the act in recent weeks. Maybe a firmer approach to online crims is coming, but thee are troubled times for geopolitical cooperation. ®
Get our [16]Tech Resources
[1] https://www.canlii.org/en/on/oncj/doc/2022/2022oncj43/2022oncj43.html
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YgL2G-5ccUiKeIDtxec8owAAAE4&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.theregister.com/2021/02/01/in_brief_security/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YgL2G-5ccUiKeIDtxec8owAAAE4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YgL2G-5ccUiKeIDtxec8owAAAE4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://news.sophos.com/en-us/2020/05/27/netwalker-ransomware-tools-give-insight-into-threat-actor/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YgL2G-5ccUiKeIDtxec8owAAAE4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2022/01/14/russia_revil_ransomware_gang_charged/
[9] https://www.theregister.com/2021/10/29/trickbot_arrest/
[10] https://www.theregister.com/2021/06/16/clop_ransomware_gang_arrests_ukraine/
[11] https://www.theregister.com/2021/11/03/blackmatter_ransomware_disbanding_claim/
[12] https://www.theregister.com/2021/06/16/clop_ransomware_gang_arrests_ukraine/
[13] https://www.theregister.com/2021/10/29/trickbot_arrest/
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YgL2G-5ccUiKeIDtxec8owAAAE4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[15] https://www.theregister.com/2022/01/14/russia_revil_ransomware_gang_charged/
[16] https://whitepapers.theregister.com/
Sebastien Vachons-Desjardins of Gatineau, Ottawa, was sentenced to six years and eight months in prison earlier this month after pleading guilty to five criminal charges in Ontario's Court of Justice.
"The Defendant excelled at what he did," sniffed Justice Paul Renwick in a sentencing note published on Canadian [1]court document repository CanLII . "Between 10-15 unknown individuals hired the Defendant to teach them his methods. Some of these activities benefitted those interested in securing computer networks from these types of attacks. Some of the Defendant's students were likely other cyber threat actors."
[2]
Vachons-Desjardins was arrested last year after the Federal Bureau of Investigation accused him of [3]bringing in $27m for the Netwalker gang of which he was a part. The FBI said last year it had retrieved US$450k worth of cryptocurrency from three separate infections, while saying Bulgarian police had shut down a "dark web hidden resource" used by Netwalker.
[4]
[5]
In [6]a 2020 analysis Sophos said Netwalker's tools included "programs intended to capture Domain Administrator credentials from an enterprise network."
"Some of the scripts and exploit tools were copied directly from Github repositories," said Sophos, adding: "Several of the tools are freely available Windows utilities, such as Amplia Security's Windows Credential Editor."
[7]
Sentencing Vachons-Desjardins, the judge said: "The Defendant personally profited greatly from these offences; he earned the equivalent of over $600,000 in cash (seized by police), bank balances of over $400,000, and Bitcoin transfers to money spent estimated at $1,755,000, and the value of at least 944 Bitcoins (720 seized and 224 paid in the days leading up to the seizure to invest in NetWalker), worth over $30,000,000 when seized."
The sentence was imposed for two counts of extortion, one count of participating in the activities of a criminal organisation, and one count of "mischief to data". The newly convicted criminal still faces extradition and trial in the US.
His victims, who are all receiving five to six-figure sums in "restitution" ordered by the judge, included: Windward Software Systems (which makes an ERP suite); Cegep St Felicien, a Quebecois college; business insurance firm Continental Casualty Company; and custom car shop Enterprise Robert Thibert, among others.
[8]Russia starts playing by the rules: FSB busts 14 REvil ransomware suspects
[9]Feds cuff Russian said to be developer of 'Trickbot' ransomware
[10]Cuffed: Ukraine police collar six Clop ransomware gang suspects in joint raids with South Korean cops
[11]BlackMatter ransomware gang says it's disbanding – again – after Ukraine arrests
Ransomware gangs are relatively rarely brought to trial, so Vachons-Desjardins' guilty plea makes him an unusual suspect.
Ukrainian police have made a number of [12]arrests over the past few months , while the US has, over the years, [13]occasionally imprisoned foreign criminals who travelled to countries with American extradition treaties.
[14]
Even Russia, thought to be home to most ransomware criminals, seems to have [15]got in on the act in recent weeks. Maybe a firmer approach to online crims is coming, but thee are troubled times for geopolitical cooperation. ®
Get our [16]Tech Resources
[1] https://www.canlii.org/en/on/oncj/doc/2022/2022oncj43/2022oncj43.html
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YgL2G-5ccUiKeIDtxec8owAAAE4&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.theregister.com/2021/02/01/in_brief_security/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YgL2G-5ccUiKeIDtxec8owAAAE4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YgL2G-5ccUiKeIDtxec8owAAAE4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://news.sophos.com/en-us/2020/05/27/netwalker-ransomware-tools-give-insight-into-threat-actor/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YgL2G-5ccUiKeIDtxec8owAAAE4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2022/01/14/russia_revil_ransomware_gang_charged/
[9] https://www.theregister.com/2021/10/29/trickbot_arrest/
[10] https://www.theregister.com/2021/06/16/clop_ransomware_gang_arrests_ukraine/
[11] https://www.theregister.com/2021/11/03/blackmatter_ransomware_disbanding_claim/
[12] https://www.theregister.com/2021/06/16/clop_ransomware_gang_arrests_ukraine/
[13] https://www.theregister.com/2021/10/29/trickbot_arrest/
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YgL2G-5ccUiKeIDtxec8owAAAE4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[15] https://www.theregister.com/2022/01/14/russia_revil_ransomware_gang_charged/
[16] https://whitepapers.theregister.com/
The newly convicted criminal still faces extradition and trial in the US.
Oh good, that should add another 50+ years to his Canadian 6.