Â鶹´«Ã½

Skip to main content

Russian-Canadian man arrested, awaiting U.S. extradition for alleged global ransomware crimes

The United States Department of Justice says a Russian-Canadian man from Ontario is in police custody and awaiting extradition to the U.S. for his alleged participation in a global ransomware campaign. (Shutterstock) The United States Department of Justice says a Russian-Canadian man from Ontario is in police custody and awaiting extradition to the U.S. for his alleged participation in a global ransomware campaign. (Shutterstock)
Share

A Russian-Canadian man from Ontario is in police custody and awaiting extradition to the United States for his alleged participation in a global ransomware campaign, the U.S. Department of Justice announced Thursday.

Mikhail Vasiliev, a 33-year-old dual Russian and Canadian national from Bradford, Ont., is charged with conspiracy to intentionally damage protected computers and to transmit ransom demands in connection with his alleged role in the LockBit global ransomware scheme, the department said in a press release.

LockBit is a ransomware variant that has made at least $100 million in ransom demands and extracted tens of millions of dollars in actual payments from victims, according to a court document filed in the District of New Jersey. It first appeared as early as January 2020 and members of the conspiracy have since executed at least 1,000 LockBit attacks against victims in the U.S. and around the world, the document alleged.

Ransomware is a type of malware used by cybercriminals to encrypt data stored on a victim's computer to render it inaccessible or unusable, transmit that data to a remote computer, or both. After a ransomware attack, perpetrators typically demand a ransom payment from the victim and threaten to publish, sell or prevent access to the stolen data if the money is not paid.

"In many instances, LockBit perpetrators have posted highly confidential and sensitive data stolen from LockBit victims to a publicly available website under their ownership and control," Federal Bureau of Investigation agent Matthew Haddad wrote in the criminal complaint. "In this way, LockBit has become one of the most active and destructive ransomware variants in the world."

The document said the FBI began looking into LockBit around March 2020 and concluded that Vasiliev, who faces a maximum of five years in prison if convicted, is an alleged member of the LockBit conspiracy. No contact information for Vasiliev's legal representatives was immediately available on Thursday.

The criminal complaint against Vasiliev says Canadian police officers searched his Bradford home in August, where they discovered a file containing a list of alleged prospective or previous cybercrime victims.

Also discovered in the search were screenshots of messages discussing topics related to the LockBit campaign, a text file including instructions to deploy a LockBit program against a computer and usernames and passwords for various platforms belonging to employees of a Canadian LockBit victim, documents show.

The complaint further reveals that Vasiliev's home was raided again on Oct. 26, and upon entering, "Canadian law enforcement discovered Vasiliev sitting in the garage at a table with a laptop, which he was unable to lock before being restrained."

Investigators found multiple tabs open on the laptop, including one pointing to a site named "LockBit LOGIN" with a LockBit logo and a login screen hosted at a dark web domain, the document alleged.

It further alleged Canadian law enforcement found a Bitcoin wallet address in Vasiliev's home during the October raid, which led them to discover that the wallet had received a Bitcoin payment from funds originating from a ransom payment made six hours earlier by a confirmed LockBit victim.

Vasiliev's arrest is the result of a more than two-and-a-half year investigation into LockBit and more than a decade of experience between FBI agents, Justice Department prosecutors and international partners in dismantling cyber threats, said U.S. Deputy Attorney General Lisa Monaco in a news release.

"Let this be yet another warning to ransomware actors: working with partners around the world, the Department of Justice will continue to disrupt cyber threats and hold perpetrators to account," Monaco said.

This report by The Canadian Press was first published Nov. 10, 2022.

This story was produced with the financial assistance of the Meta and Canadian Press News Fellowship. 

CTVNews.ca Top Stories

A team of tornado experts is heading to Fergus, Ont. after a storm ripped through the area Sunday night.

Why brain aging can vary dramatically between people

Researchers are uncovering deeper insights into how the human brain ages and what factors may be tied to healthier cognitive aging, including exercising, avoiding tobacco, speaking a second language or even playing a musical instrument.

Local Spotlight

For the second year in a row, the ‘Gift-a-Family’ campaign is hoping to make the holidays happier for children and families in need throughout Barrie.

Some of the most prolific photographers behind CTV Skywatch Pics of the Day use the medium for fun, therapy, and connection.

A young family from Codroy Valley, N.L., is happy to be on land and resting with their newborn daughter, Miley, after an overwhelming, yet exciting experience at sea.

As Connor Nijsse prepared to remove some old drywall during his garage renovation, he feared the worst.

A group of women in Chester, N.S., has been busy on the weekends making quilts – not for themselves, but for those in need.

A Vancouver artist whose streetside singing led to a chance encounter with one of the world's biggest musicians is encouraging aspiring performers to try their hand at busking.

Ten-thousand hand-knit poppies were taken from the Sanctuary Arts Centre and displayed on the fence surrounding the Dartmouth Cenotaph on Monday.

A Vancouver man is saying goodbye to his nine-to-five and embarking on a road trip from the Canadian Arctic to Antarctica.

Stay Connected