Suspected hackers arrested in global ransomware attacks

By ERIC TUCKER

WASHINGTON (AP) – Two suspected criminal hackers have been charged in the United States in a wave of ransomware attacks, including one that led to the temporary closure of the world’s largest meat processing company and another that targeted companies around the globe on the fourth . July weekend, U.S. officials said Monday.

Attorney General Merrick Garland and other top officials announced charges against Ukrainian Yaroslav Vasinskyi and Russian Yevgeniy Polyanin, claiming they were part of the REvil ransomware gang. Officials said Vasinskyi was recently arrested in Poland and that the U.S. government had recovered $ 6.1 million in ill-gotten funds from Polyanin.

“The Department of Justice is saving no resources to identify and bring to justice anyone who attacks the United States with a ransomware attack,” Garland said.

The Treasury Department also announced sanctions against the couple in what it said was a virtual currency exchange, Chatex said the department was used by ransomware gangs.

European law enforcement agencies also announced on Monday that they had arrested two other suspected ransomware operators with links to REvil in Romania.

The arrests were part of a law enforcement investigation called GoldDust, which involved the United States and 16 other countries. REvil, also known as Sodinokibi, has in recent months been linked to ransomware targeting the world’s largest meat breeder, JBS SA, as well as a weekend attack from the Fourth of July that ripped businesses around the world through a breach of a Florida-based software company. called Kaseya.

Deputy prosecutor Lisa Monaco appeared to warn of Monday’s announcement in an interview with The Associated Press last week, saying that “in the coming days and weeks you will see more arrests” as well as seizures of ransomware revenue.

The Department of Justice has tried several ways to counter a ransomware wave that it considers a national security and economic threat. Arrests of foreign hackers are important to the Department of Justice, as many of them operate in shelters for countries that do not extradite their own citizens to the United States for prosecution.

The Justice Department seized $ 2.3 million in cryptocurrency in June from a payment made by the Colonial Pipeline following a ransomware attack that caused the company to temporarily halt operations, creating fuel shortages in parts of the country.

___

Associated Press writer Jake Bleiberg of Dallas contributed to this report.

Follow Eric Tucker on Twitter at http://www.twitter.com/etuckerAP.