The U.S. Justice Department on Monday charged a Ukrainian and a Russian national suspected of being involved in one of the worst ransomware attacks on US targets.
Ukrainian Yaroslav Vasinskyi, arrested in Poland last September, is accused of exploiting the victim companies and installing encryption software developed by the ransomware group REvil, which in turn conducted the ransom negotiations and shared the profits with conspirators such as Vasinskyi.
The arrest was part of a large-scale operation coordinated by the FBI, Europol and national police organisations across Europe, as well as private security companies.
REvil, the prime suspect in a major attack on global meat packer JBS SA, was penetrated by the joint operation in which authorities demanded a $6 million ransom, and the notorious ransomware group said it ceased operations last month.
Another alleged REvil operative, Russian national Yevgeniy Polyanin, is also facing charges in U.S. District Court for the Northern District of Texas for conspiracy to defraud, conspiracy to launder money and a range of other offences.
Polyanin remains at large.
Both Vasinskyi and Polyanin face sanctions for their role in ransomware operations in the U.S., including transacting in a virtual currency exchange called Chatex, which facilitates financial transactions for ransomware actors.
The US Treasury Department said more than $200 million in ransoms had been paid in Bitcoin and Monero.