Europol Arrested LockBit Ransomware Operator in Canada

Today, Europol has announced the arrest of the LockBit Ransomware operator who had attacked the critical infrastructure of the high profiled company worldwide. 

The arrested Mikhail Vasiliev, a 33-year-old Russian national, is believed to have deployed the LockBit ransomware to carry out attacks against critical infrastructure and large industrial groups across the world.

The suspect was arrested in Ontario, Canada, last month following an investigation led by the French National Gendarmerie with the help of Europol's European Cybercrime Centre (EC3), the FBI, and the Canadian Royal Canadian Mounted Police (RCMP).

The announcement of the arrest was made by the press release, stating 'one of the world's most prolific ransomware operators has been arrested on 26 October in Ontario, Canada.' Currently, it seems that Europol has taken down the press release, and the reason for taking it down is not yet clear. 

Thanks to the cybersecurity reporter Catalin Cimpanu who shared the screenshot part of the press release.

Authorities have also seized eight computers and 32 external hard drives, two firearms, and €400,000 worth of cryptocurrency from the suspect's home.

Europol describes the suspect as an 'operator' of the LockBit ransomware, but Bleeping computer reported he is likely an affiliate rather than a manager of the cybercrime operation. This is because a LockBit representative known as 'LockBitSupp' was posting in hacker forums as recently as yesterday.

Statement from the US Department of Justice

US DoJ has just released a statement regarding the arrest of a member of the LockBit Ransomware.

DoJ says, Mikhail Vasiliev, 33, of Bradford, Ontario, Canada, is in custody in Canada and is awaiting extradition to the United States.

They further add -

“This arrest is the result of over two-and-a-half-years of an investigation into the LockBit ransomware group, which has harmed victims in the United States and around the world,” said Deputy Attorney General Lisa O. Monaco. “It is also a result of more than a decade of experience that FBI agents, Justice Department prosecutors, and our international partners have built dismantling cyber threats. Let this be yet another warning to ransomware actors: working with partners around the world, the Department of Justice will continue to disrupt cyber threats and hold perpetrators to account. With our partners, we will use every available tool to disrupt, deter, and punish cyber criminals.”

According to court documents, Vasiliev allegedly participated in the LockBit campaign. He is charged with conspiracy to intentionally damage protected computers and to transmit ransom demands. If convicted, he faces a maximum of five years in prison. A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

About LockBit Ransomware

According to court documents, LockBit is a ransomware variant that first appeared in or around January 2020. It has become one of the most active and destructive ransomware variants in the world. Since first appearing, LockBit has been deployed against at least as many as 1,000 victims in the United States and around the world. LockBit members have made at least $100 million in ransom demands and have extracted tens of millions of dollars in actual ransom payments from their victims. The FBI has been investigating the LockBit conspiracy since in or around March 2020.