{ "id": "68780e3d-f8cc-4a68-8775-fed0d743136b", "created_at": "2026-04-06T00:22:14.86098Z", "updated_at": "2026-04-10T13:12:28.272937Z", "deleted_at": null, "sha1_hash": "d94b50496c6d3afae92edda34b1d58438748950c", "title": "Sodinokibi/REvil Affiliate Sentenced for Role in $700M Ransomware Scheme", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 36216, "plain_text": "Sodinokibi/REvil Affiliate Sentenced for Role in $700M\r\nRansomware Scheme\r\nPublished: 2024-05-01 · Archived: 2026-04-02 10:37:10 UTC\r\nA Ukrainian national was sentenced today to 13 years and seven months in prison and ordered to pay over $16\r\nmillion in restitution for his role in conducting over 2,500 ransomware attacks and demanding over $700 million\r\nin ransom payments.\r\n“As this sentencing shows, the Justice Department is working with our international partners and using all tools at\r\nour disposal to identify cybercriminals, capture their illicit profits, and hold them accountable for their crimes,”\r\nsaid Attorney General Merrick B. Garland.\r\n“Deploying the REvil ransomware variant, the defendant reached out across the globe to demand hundreds of\r\nmillions of dollars from U.S. victims,” said Deputy Attorney General Lisa Monaco. “But this case shows the\r\nJustice Department’s reach is also global—working with our international partners, we are bringing to justice\r\nthose who target U.S. victims, and we are disrupting the broader cybercrime ecosystem.”\r\n“Today, the FBI’s close collaboration with our worldwide partners has again ensured that a cybercriminal who\r\nthought he was beyond our reach faces the consequences of his actions,” said FBI Director Christopher Wray. “We\r\nwill continue to relentlessly pursue cyber criminals like Vasinksyi wherever they may hide, while we disrupt their\r\ncriminal schemes, seize their money and infrastructure, and target their enablers and criminal associates to the\r\nfullest extent of the law.”\r\nAccording to court documents, Yaroslav Vasinskyi, also known as Rabotnik, 24, conducted thousands of\r\nransomware attacks using the ransomware variant known as Sodinokibi/REvil.  Ransomware is malicious\r\nsoftware designed to encrypt data on victim computers, allowing bad actors the ability to demand a ransom\r\npayment in exchange for the decryption key. The co-conspirators demanded ransom payments in cryptocurrency\r\nand used cryptocurrency exchangers and mixing services to hide their ill-gotten gains. To drive their ransom\r\ndemands higher, Sodinokibi/REvil co-conspirators also publicly exposed their victims’ data when victims would\r\nnot pay ransom demands.\r\n“Yaroslav Vasinskyi and his co-conspirators hacked into thousands of computers around the world and encrypted\r\nthem with ransomware,” said Principal Deputy Assistant Attorney General Nicole M. Argentieri, head of the\r\nJustice Department’s Criminal Division. “Then they demanded over $700 million in ransom payments and\r\nthreatened to publicly disclose victims’ data if they refused to pay. Although the conspirators attempted to cover\r\ntheir tracks by laundering the payments from victims, Vasinskyi could not hide from law enforcement. Vasinskyi’s\r\nsentence today should serve as a reminder to ransomware actors everywhere: we will track you down and bring\r\nyou to justice.”\r\n“Using ransomware, malicious actors from around the globe can paralyze U.S. companies in a matter of minutes,”\r\nsaid U.S. Attorney Leigha Simonton for the Northern District of Texas. “But as cybercriminals work together to\r\nhttps://www.justice.gov/opa/pr/sodinokibirevil-affiliate-sentenced-role-700m-ransomware-scheme\r\nPage 1 of 2\n\ndeploy these attacks, law enforcement throughout the United States stands ready to dismantle their criminal\r\nenterprises. The dedicated prosecutors from the Northern District of Texas and the skilled agents at the FBI Dallas\r\nField Office proved once again today to ransomware actors everywhere: When you hit targets in the United States,\r\nthe Justice Department and its partners will come after you.”  \r\nVasinskyi previously pleaded guilty in the Northern District of Texas to an 11-count indictment charging him with\r\nconspiracy to commit fraud and related activity in connection with computers, damage to protected computers,\r\nand conspiracy to commit money laundering. He was previously extradited to the United States from Poland. \r\nRelatedly, in 2023, the Department obtained the final forfeiture of millions of dollars’ worth of ransom payments\r\nobtained through two related civil forfeiture cases, which included 39.89138522 Bitcoin and $6.1 million in U.S.\r\ndollar funds traceable to alleged ransom payments received by other members of the conspiracy.\r\nThe FBI investigated the case.\r\nSenior Counsel Frank Lin of the Criminal Division’s Computer Crime and Intellectual Property Section and\r\nAssistant U.S. Attorney Tiffany H. Eggers for the Northern District of Texas prosecuted the case. Assistant U.S.\r\nAttorney Dimitri N. Rocha for the Northern District of Texas assisted with the related civil forfeiture cases.\r\nThe Justice Department’s Office of International Affairs worked with Polish authorities to secure the extradition of\r\nVasinskyi.\r\nSource: https://www.justice.gov/opa/pr/sodinokibirevil-affiliate-sentenced-role-700m-ransomware-scheme\r\nhttps://www.justice.gov/opa/pr/sodinokibirevil-affiliate-sentenced-role-700m-ransomware-scheme\r\nPage 2 of 2", "extraction_quality": 1, "language": "EN", "sources": [ "ETDA" ], "origins": [ "web" ], "references": [ "https://www.justice.gov/opa/pr/sodinokibirevil-affiliate-sentenced-role-700m-ransomware-scheme" ], "report_names": [ "sodinokibirevil-affiliate-sentenced-role-700m-ransomware-scheme" ], "threat_actors": [], "ts_created_at": 1775434934, "ts_updated_at": 1775826748, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/d94b50496c6d3afae92edda34b1d58438748950c.pdf", "text": "https://archive.orkl.eu/d94b50496c6d3afae92edda34b1d58438748950c.txt", "img": "https://archive.orkl.eu/d94b50496c6d3afae92edda34b1d58438748950c.jpg" } }