A 31-year-old Canadian man has been charged with ransomware attacks against organizations in the United States and Canada, according to a recently issued federal indictment.
See also: Microsoft: Seizes websites used by Chinese state hackers
Matthew Philbert of Ottawa was involved in several cyberattacks, according to FBI investigations.
Philbert was arrested on November 30, 2021, following an investigation that began in January 2020, when the FBI contacted the OPP regarding Canadian-based cyber incidents.
According to the indictment, from April 2018 to May 2018, Philbert targeted at least ten computers of a healthcare organization from the District of Alaska.
The defendant failed to deploy ransomware on the victims' computers, according to the indictment, which would have affected the "medical examination, diagnosis, treatment and care" of many individuals.
See also: New Cerber ransomware targets Confluence and GitLab servers
The attack , which took place on April 26, resulted in the exposure of personal information belonging to more than 500 people. Typically, ransomware is deployed in the last stage of an attack after attackers have determined which computers to encrypt.
Even though Philbert's US indictment cited failed ransomware attacks, the investigation by Ontario Provincial Police found that the defendant developed "multiple ransomware attacks" that affected private businesses and government agencies in Canada.
In the US, Philbert is charged with one count of conspiracy to commit computer fraud and related activity and one count of wire fraud and related activity.
In Canada, the accused faces charges of possessing a device to obtain unauthorized use of a computer system or committing computer malfunction, fraud, and unauthorized use.
See also: Emotet installs Cobalt Strike on devices allowing for faster ransomware infection
During Philbert's arrest, police in Canada seized desktop and laptop computers, a tablet, multiple storage devices, cell phones, passwords for a Bitcoin wallet, and blank magnetic stripe cards.
During their investigation, the OPP received assistance from the Royal Canadian Mounted Police's National Cybercrime Coordination Unit (NC3) and Europol, which suggests that Philbert may have been involved in ransomware attacks outside of the US and Canada.
