# YEVGYENIY IGORYEVICH POLYANIN

**fbi.gov/wanted/cyber/yevgyeniy-igoryevich-polyanin**

An official website of the United States government. Here's how you know

Official websites use .gov

A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS

A lock () or https:// means you've safely connected to the .gov website. Share sensitive
information only on official, secure websites.

Conspiracy to Commit Fraud and Related Activity in Connection with Computers; Intentional
Damage to a Protected Computer; Conspiracy to Commit Money Laundering


-----

[View Poster](https://www.fbi.gov/wanted/cyber/yevgyeniy-igoryevich-polyanin/@@download.pdf)

## Download Poster

[English](https://www.fbi.gov/wanted/cyber/yevgyeniy-igoryevich-polyanin/download.pdf)


-----

## Additional News

[Arrest in Ransomware Attack on Kaseya](https://www.fbi.gov/news/press-releases/press-releases/fbi-director-christopher-wrays-remarks-at-press-conference-announcing-sodinokibi-revil-ransomware-arrest)

## Aliases:

Yevhgyeniy Polyanin, Yevgeniy Polyanin, Yevgveniey Igorevich Polyanon, Evegnii Igorevich
Polianin, Evgeniy Polyanin, Evgeniy Igorevich Polyanin, "lk-4d4"

Date(s) of Birth Used March 4, 1993

Place of Birth Russia

Sex Male

Race White

Nationality Russian

### Remarks:

Polyanin is believed to be in Russia, possibly in Barnaul, and is one of many
Sodinokibi/REvil ransomware affiliates.

### Caution:

Yevgyeniy Igoryevich Polyanin is wanted for his alleged involvement in ransomware attacks
and money laundering activities. It is alleged that, through the use and deployment of
Sodinokibi and REvil ransomware, Polyanin left electronic notes in the form of a text file on
victims’ computers. The notes included web addresses for the victims to visit and have their
files decrypted. Upon visiting these web addresses, victims were given the ransom amount
demanded and provided a virtual currency address to use to pay the ransom. If a victim paid
the ransom amount, Polyanin provided the decryption key, and the victims then were able to
access their files. If a victim did not pay the ransom, Polyanin typically posted the victims’
exfiltrated data or claimed he sold the exfiltrated data to third parties. Polyanin has been
charged in an indictment filed in the United States District Court for the Northern District of


-----

Texas, Dallas, Texas, with conspiracy to commit fraud and related activity in connection with
computers, substantive counts of intentional damage to protected computers, and conspiracy
to commit money laundering.

### Submit a Tip:

[If you have any information concerning this person, please contact your local FBI office or](https://www.fbi.gov/contact-us/field-offices)
[the nearest American Embassy or Consulate.](https://www.fbi.gov/contact-us/legal-attache-offices)

**Field Office:** [Dallas](https://www.fbi.gov/contact-us/field-offices/dallas)

[Submit an anonymous Tip online](https://tips.fbi.gov/)


-----