Federal prosecutors struck back at a favorite tool of the ransomware community Wednesday, indicting one alleged NetWalker user, a Canadian national named Sebastien Vachon-Desjardins, on wire fraud, hacking and network extortion charges, and coordinating the takedown of a victim guidebook hosted on the darkweb.
The action, which included assistance from Bulgarian authorities, is the U.S. government's first public assault against a malicious software that's booming in popularity. Ransoms against schools, hospitals, businesses and governments netted NetWalker attackers tens of millions of dollars in 2020.
NetWalker burrows into and encrypts victim computers, only releasing its hold once victims pay a ransom - usually in bitcoin. It follows the ransomware-as-a-service model, making the individual hackers (affiliates) who deploy the attack lock down the computer and demand the ransom akin to franchisees who share their profits with corporate (the ransomware developer).
Sebastien Vachon-Desjardins is alleged to have been one such affiliate. Prosecutors said he held a Florida-based company's computers hostage with NetWalker in violation of federal law. Prosecutors also demanded forfeiture of $27 million accrued through his alleged ransomware crimes.
Vachon-Desjardins mounted at least 91 NetWalker heists from April 2020 onward, blockchain tracing company Chainalysis said, citing government partners. In a Wednesday blog post the firm said Vacho-Desjardins' associated wallet addresses have allegedly banked more than $14 million in bitcoin since February 2018, a trove now worth $27 million.
Chainalysis CSO Jonathan Levin told CoinDesk Vachon-Desjardins' transactions offer a window into the workings of the underground ransomware economy. Chainalysis has followed $46 million in illicit ransomware bitcoin flows since 2019.
"The transparency of the blockchain really enables you to see not only the affiliates that are dealing with NetWalker, but also the affiliates that are actually using the other ransomware-as-a service strains. So we can see links between different ransomware strains via common affiliates of the different strains," he said.
NetWalker attacks are unlikely to abate with the removal of a single affiliate, he said.