Kaseya ransomware attack accused hacker extradited, arraigned in Texas

Yaroslav Vasinskyi, 22, who allegedly has connections with the Sodinokibi/REvil ransomware group was extradited and arraigned in a Dallas, Texas court.  

The Justice Department said in November that the accused was instrumental in the ransomware attack against Kaseya in July 2021 that brought in prolonged damaging impact to several companies around the world for days. 

According to November CyberScoop report, Vasinskyi was arrested on October 8 last year at a border crossing in Dorohusk, a village located on the Polish and Ukrainian border.  

“When last year I announced charges against members of the Sodinokibi/REvil ransomware group, I made clear that the Justice Department will spare no resource in identifying and bringing to justice transnational cybercriminals who target the American people,” said Attorney General Merrick B. Garland, Department of Justice, USA.  

“Just eight months after committing his alleged ransomware attack on Kaseya from overseas, this defendant has arrived in a Dallas courtroom to face justice,” said Deputy Attorney General Lisa O. Monaco, Department of Justice, USA.  

According to the indictment, in the alleged attack against Kaseya, Vasinskyi caused the deployment of malicious Sodinokibi/REvil code throughout a Kaseya product that caused the Kaseya production functionality to deploy REvil ransomware to “endpoints” on Kaseya customer networks. After the remote access to Kaseya endpoints was established, the ransomware was executed on those computers, which resulted in the encryption of data on computers of organisations around the world that used Kaseya software.  

Vasinskyi made $2.3 million from ransoms after demanding a total of more than $760 million, said the Department of Justice.