Russia Indicts Ransomware Hacker Wanted by the FBI

A prolific ransomware affiliate hacker and developer wanted by the FBI is facing criminal charges in Russia, Kremlin media reported Friday.

See Also: Protect Your Small & Mid-Sized Business From Cyberthreats This Holiday

Russian prosecutors announced the indictment of a 32-year-old resident of the Russian-controlled Baltic port city of Kalingrad for allegedly creating malicious computer code. State-owned Ria Novosti identified the accused hacker as Mikhail Pavlovich Matveev, also known as Wazawaka.

Matveev has been wanted by U.S. authorities since 2023 for his role in hacking activities as part of ransomware groups including LockBit and Hive. He allegedly was a senior leader of the Babuk ransomware operation. Federal prosecutors in the District of Columbia say he played a key role in hacking the Washington, D.C. Metropolitan Police Department in 2021. Babuk demanded $4 million in extortion and subsequently dumped what it said was 250 gigabytes of law enforcement data (see: Alleged Babuk Ransomware Hacker ‘Wazawaka’ Indicted in US).

Federal prosecutors in New Jersey say Matveev also deployed LockBit and Hive ransomware. Their indictment accused the hacker of using LockBit encryption in June 2020 against a law enforcement agency in Passaic County, and in May 2022 attacking a nonprofit behavorial healthcare organization in Mercer County with Hive ransomware.

The U.S. Department of State offers a bounty of $10 million for details regarding the hacker. Mateev has also been sanctioned by the U.S. Treasury for their role in hacks against the U.S. critical infrastructure.

Matveev’s cybercriminal career has encompassed hospitals, schools, nonprofits and – in the Netherlands – a supermarket logistics supplier. An attack with Babuk ransomware against Bakker Logistiek lead to a nationwide disruption in the supply of cheese (see: Gouda Hacker: Charges Tie to Ransomware Hit Affecting Cheese).

Russia does not extradite its nationals and has long tolerated ransomware hackers operating within its borders, so long as they don’t attack organizations within the Russian sphere of influence. The U.S. government estimates that three-quarters of known ransomware incidents have a connection to Russia.

Why Russian authorities acted against Matveev is the subject of intense speculation by close observers of the Russian criminal underground.

Jon DiMaggio, chief security strategist, Analyst1, told Information Security Media Group his information is that Matveev was “was arrested, held for 24 hours, fined and let go” but not before giving up a considerable cryptocurrency stash. “In my opinion, it is kind of a signal to the new [Trump] administration coming in that if the right shifts are on the table, they might be willing to partake.” But, “I don’t see Matveev being shut in the prison or from being stopped from doing what he is doing,” DiMaggio said.

“It is not the first time we have been surprised by the Russian authorities. Just before the Russia-Ukraine war broke out, they arrested some Revil affiliates,” said John Fokker, head of cyber investigations at Trellix Threat Labs.

“Maybe he did something abrupt and wrong. In the past, when I was still with the Dutch police, we had to get cybercriminals arrested or held accountable by the Russian authorities by demonstrating how they haven’t paid their taxes or how they were laundering money – so that could be a possibility here.”

Stefan Soesanto, a senior cyber researcher at ETH Zurich, told Information Security Media Group that Matveev essentially ran his mouth off too often for Russian authorities to ignore him. “He was so brazen online – taunting of the FBI was too much exposure to just let him walk away from this.”

Matveev has been vocally online, maintaining an X social media account under the handle “ransomboris,” at one point posting a t-shirt with his FBI wanted poster transferred onto it. Cybersecurity reporter Brian Krebs said in early 2022 that other Russian cybercriminals believed that Matveev had “lost his mind” after he dropped exploit code on Twitter and published “bizarre selfie videos taunting security researchers and journalists.”

“My guess is that Matveev will get a lenient sentence to ensure his cooperation with the Russian state. The government already confiscated his crypto wallets and Matveev has a family now – so he likely won’t flee the country after his sentencing,” Soesanto said.

Stephen Robinson, senior threat intelligence analyst at WithSecure, told The Register it’s possible Matveev fell behind in paying protection money to the government, which decided to act because it’s hard pressed for cash to sustain its ongoing war of conquest against Ukraine.