Sebastien Vachon-Desjardins, a Canadian indicted by the US for his involvement in NetWalker ransomware attacks, has been sentenced to 6 years and 8 months in prison after pleading guilty before an Ontario judge to multiple offences related to 17 attacks.
See also: Ransomware gangs are changing tactics and ransoms are increasing!
On Monday, the judge said that while Desjardins cooperated with authorities to help identify the victims and their disappearances, he still “played a dominant, almost exclusive, role in these offences.” His position was also compounded by his unrelated criminal record for drug trafficking and a previous 54-month prison sentence in Quebec.
The FBI discovered Desjardins' real identity after linking email accounts (Microsoft, Gmail, and Protonmail) he used to register accounts on XSS.is and HackForums with online activity (searches and emails) on multiple services (MEGA, ExpressVPN, ZoomInfo) he used to upload the files he stole from victims, hide his real IP address, and find financial information on his victims.
Of course, he made it easier for the authorities himself by posting personal information on public forums, including the fact that he worked as an IT technician for the Canadian government (Public Works and Government Services Canada) for more than four years.
See also: Lockbit ransomware: FBI provides details on the operation and protection tips
Losses of tens of millions
The attacks in which Desjardins participated resulted in millions of dollars in losses, after data was stolen from victims' networks and they were blackmailed into paying ransoms worth millions in cryptocurrency.
The US Department of Justice said in January 2021 that Desjardins allegedly earned more than $27.6 million after multiple successful attacks and extortion attempts since April 2020, when he began these activities.
In addition to 719.99591411 BTC seized from Desjardins' BTC wallet in January 2021, according to a restraining order filed in January 2022, police also seized 15.725489349111 XMR from a Monero wallet, as well as several million dollars from his bank accounts.
See also: Ransomware gangs carry out surgical attacks because of authorities
After searching his home, law enforcement authorities also seized multiple devices containing approximately 20 TB of data.
On January 27, 2021, when the US Department of Justice indicted Desjardins, law enforcement authorities from the US and Bulgaria also took down dark webs associated with the Netwalker ransomware operation, including Tor payment and data leakage websites.
The seizure was the result of a joint investigation conducted by the FBI, the U.S. Department of Justice, the Bulgarian National Investigation Service and the Bulgarian General Directorate for Combating Organized Crime.
Netwalker was a Ransomware-as-a-Service (RaaS) operation that emerged in late 2019, recruiting affiliates to develop ransomware in exchange for a 60-75% share of all ransom payments.
This ransomware operation was extremely profitable for all threat actors involved, as an August 2020 report estimated that they collected $25 million from victims in just five months.
Information source: bleepingcomputer.com
