US triggers global action against hackers operating NetWalker

The United States Department of Justice (DoJ) has launched global action against hackers who have made millions from the sale of NetWalker ransomware-as-a-service (RaaS). The police action, which has been coordinated with several countries, was released by the DoJ on Thursday, 28.

NetWalker has already claimed numerous victims worldwide, including businesses, municipalities, hospitals, justice departments, emergency services, school districts, colleges and universities. In June last year, the University of California at San Francisco admitted to having paid $ 1.14 million to retrieve important academic papers stored on some of its Medical School servers that were encrypted by NetWalker.

“This action reflects the determination of the United States Attorney’s Office for the Florida Middle District to stop sophisticated international cybercrime schemes,” US Attorney Maria Chapa Lopez for the Central District of Florida told Infosecurity. “Although these individuals believe that they operate anonymously in the digital space, we have the ability and tenacity to identify and prosecute these actors to the fullest extent of the law and to seize their criminal products.”

According to court documents, NetWalker operates a RaaS model with “developers” and “affiliates” that share ransom payments made by victims. While developers are responsible for creating and updating ransomware and making it available to affiliates, affiliates are tasked with identifying and attacking high-value victims with malware.

The actions against NetWalker included charges against Canadian Sebastien Vachon-Desjardins, of Gatineau, Ottawa, for participating in the ransomware attacks that reportedly netted NetWalker at least $ 27.6 million. On January 10, more than $ 454,000 in cryptocurrency were seized by US agents for ransom payments made by victims of three separate NetWalker attacks, in addition to the Bulgarian authorities deactivating a hidden feature on the dark web that NetWalker used to communicate with their victims.

Visitors to the system on the dark web are being reported and investigated. “We are reacting against the growing threat of ransomware, not only bringing criminal charges against those responsible, but also disrupting the online infrastructure of the crime and, whenever possible, recovering the victims’ extorted ransom payments,” said the deputy attorney general at exercise Nicholas McQuaid of the Criminal Division of the Department of Justice. “Ransomware victims should know that reporting to the police as soon as possible after an attack can lead to significant results, such as those obtained in today’s multifaceted operation.”