U.S. Supplied $10M for Hacker Simply Arrested by Russia – Krebs on Safety

In January 2022, KrebsOnSecurity recognized a Russian man named Mikhail Matveev as “Wazawaka,” a cybercriminal who was deeply concerned within the formation and operation of a number of ransomware teams. The U.S. authorities indicted Matveev as a prime ransomware purveyor a yr later, providing $10 million for data resulting in his arrest. Final week, the Russian authorities reportedly arrested Matveev and charged him with creating malware used to extort firms.

Matveev, a.okay.a. “Wazawaka” and “Boriselcin” labored with at the least three completely different ransomware gangs that extorted tons of of tens of millions of {dollars} from firms, colleges, hospitals and authorities companies, U.S. prosecutors allege.

Russia’s inside ministry final week issued a statement saying a 32-year-old hacker had been charged with violating home legal guidelines in opposition to the creation and use of malicious software program. The announcement didn’t identify the accused, however the Russian state information company RIA Novosti cited nameless sources saying the person detained is Matveev.

Matveev didn’t reply to requests for remark. Daryna Antoniuk at TheRecord reports {that a} safety researcher mentioned on Sunday they’d contacted Wazawaka, who confirmed being charged and mentioned he’d paid two fines, had his cryptocurrency confiscated, and is at present out on bail pending trial.

Matveev’s hacker identities had been remarkably open and talkative on quite a few cybercrime boards. Shortly after being recognized as Wazawaka by KrebsOnSecurity in 2022, Matveev printed a number of selfie movies on Twitter/X the place he acknowledged utilizing the Wazawaka moniker and talked about a number of safety researchers by identify (together with this creator). Extra not too long ago, Matveev’s X profile (@ransomboris) posted an image of a t-shirt that options the U.S. authorities’s “Wished” poster for him.

A picture tweeted by Matveev exhibiting the Justice Division’s wished poster for him on a t-shirt. picture: x.com/vxunderground

The golden rule of cybercrime in Russia has all the time been that so long as you by no means hack, extort or steal from Russian residents or firms, you might have little to worry of arrest. Wazawaka claimed he zealously adhered to this rule as a private {and professional} mantra.

“Don’t shit the place you reside, journey native, and don’t go overseas,” Wazawaka wrote in January 2021 on the Russian-language cybercrime discussion board Exploit. “Mom Russia will allow you to. Love your nation, and you’ll all the time get away with every part.”

Nonetheless, Wazawaka might not have all the time caught to that rule. At a number of factors all through his profession, Wazawaka claimed he made good cash stealing accounts from drug sellers on darknet narcotics bazaars.

Cyber intelligence agency Intel 471 mentioned Matveev’s arrest raises extra questions than solutions, and that Russia’s motivation right here possible goes past what’s occurring on the floor.

“It’s potential it is a shakedown by Kaliningrad authorities of an area web thug who has tens of tens of millions of {dollars} in cryptocurrency,” Intel 471 wrote in an evaluation printed Dec. 2. “The nation’s ingrained, institutional corruption dictates that if dues aren’t paid, bother will come knocking. Nevertheless it’s often an issue cash can repair.

Intel 471 says whereas Russia’s court docket system is opaque, Matveev will possible be open in regards to the proceedings, significantly if he pays a toll and is granted passage to proceed his harmful actions.

“Sadly, none of this is able to mark significant progress in opposition to ransomware,” they concluded.

Though Russia historically hasn’t put lots of effort into going after cybercriminals inside its borders, it has introduced a sequence of fees in opposition to alleged ransomware actors this yr. In January, 4 males tied to the REvil ransomware group had been sentenced to prolonged jail phrases. The lads had been amongst 14 suspected REvil members rounded up by Russia within the weeks earlier than Russia invaded Ukraine in 2022.

Earlier this yr, Russian authorities arrested at the least two males for allegedly working the short-lived Sugarlocker ransomware program in 2021. Aleksandr Ermakov and Mikhail Shefel (now legally Mikhail Lenin) ran a safety consulting enterprise known as Shtazi-IT. Shortly earlier than his arrest, Ermakov grew to become the primary ever cybercriminal sanctioned by Australia, which alleged he stole and leaked information on almost 10 million prospects of the Australian well being large Medibank.

In December 2023, KrebsOnSecurity recognized Lenin as “Rescator,” the nickname utilized by the cybercriminal chargeable for promoting greater than 100 million fee playing cards stolen from prospects of Goal and Dwelling Depot in 2013 and 2014. Final month, Shefel admitted in an interview with KrebsOnSecurity that he was Rescator, and claimed his arrest within the Sugarlocker case was payback for reporting the son of his former boss to the police.

Ermakov was sentenced to 2 years probation. However on the identical day my interview with Lenin was printed right here, a Moscow court docket declared him insane, and ordered him to endure obligatory medical therapy, The Document’s Antoniuk notes.