A Ukrainian man has been sentenced to almost 14 years in prison and ordered to pay more than $16 million in restitution for his role in infecting thousands of victims with REvil ransomware.

Yaroslav Vasinksyi, aka Rabotnik, was a member of the notorious cyber crime crew and played a part in more than 2,500 ransomware attacks – costing organizations and individuals more than $700 million in extortion payments – according to the US Justice Department. For those crimes, the 24-year-old was sentenced to 13 years and seven months behind bars.

"Deploying the REvil ransomware variant, the defendant reached out across the globe to demand hundreds of millions of dollars from US victims," deputy attorney general Lisa Monaco declared in a [1]statement .

[2]

"But this case shows the Justice Department's reach is also global – working with our international partners, we are bringing to justice those who target US victims, and we are disrupting the broader cyber crime ecosystem," she added.

[3]

[4]

In 2022, a year after being [5]arrested on Poland's border with Ukraine, Vasinksyi was [6]extradited to the US. He later pleaded guilty in a Texas court to an [7]11-count indictment [PDF] that outlined charges including conspiracy to commit fraud and related activity in connection with computers, damage to protected computers, and conspiracy to commit money laundering.

[8]Ukrainian cuffed, faces extradition to US for allegedly orchestrating Kaseya ransomware infection

[9]Alleged REvil suspect extradited on ransomware spree charges

[10]Fresh ransomware samples indicate REvil is back

[11]UnitedHealth CEO: 'Decision to pay ransom was mine'

In 2023, the Justice Department clawed back the final forfeiture of millions of dollars worth of ransom payments. These included 39.89138522 Bitcoin and $6.1 million that the feds traced to alleged [12]ransom payments linked to Vasinksyi and another [13]alleged REvil ransomware gangster, Russian national Yevgeniy Polyanin.

The Russian-speaking crew also used double-extortion tactics to pressure victims to pay – first stealing sensitive data before encrypting files, and then threatening to leak the stolen info if organizations didn't pay the ransom demand.

This group, which emerged in 2019, is also felt to have been behind the high-profile 2021 attacks on IT management software maker [14]Kaseya and global meat processor [15]JBS Foods .

[16]

Later that year, a multi-country law enforcement operation seized control of REvil's infrastructure and seemingly forced the group to go out of business, despite some efforts to [17]rise from the dead. ®

Get our [18]Tech Resources



[1] https://www.justice.gov/opa/pr/sodinokibirevil-affiliate-sentenced-role-700m-ransomware-scheme

[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZjNkQ-EvKKVVUBRiiCYHyQAAAFE&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZjNkQ-EvKKVVUBRiiCYHyQAAAFE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZjNkQ-EvKKVVUBRiiCYHyQAAAFE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[5] https://www.theregister.com/2022/01/13/ukraine_arrests_five_ransomware_suspects/

[6] https://www.theregister.com/2022/03/10/revil_suspect_ukrainian_arraigned_us_court/

[7] https://regmedia.co.uk/2024/05/01/vasinskyi.pdf

[8] https://www.theregister.com/2021/11/08/revil_ransomware_operators/

[9] https://www.theregister.com/2022/03/10/revil_suspect_ukrainian_arraigned_us_court/

[10] https://www.theregister.com/2022/05/11/revil-returns-secureworks-samples/

[11] https://www.theregister.com/2024/04/30/unitedhealth_ceo_ransom/

[12] https://www.theregister.com/2021/11/08/revil_ransomware_operators/

[13] https://www.theregister.com/2021/11/08/revil_ransomware_operators/

[14] https://www.theregister.com/2021/07/13/revil_ransomware_shuts/

[15] https://www.theregister.com/2021/06/02/jbs_fodds_ransomware

[16] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZjNkQ-EvKKVVUBRiiCYHyQAAAFE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[17] https://www.theregister.com/2022/05/11/revil-returns-secureworks-samples/

[18] https://whitepapers.theregister.com/