The Justice Department has unsealed an indictment against Russian national Aleksandr Viktorovich Ryzhenkov, charging him with using the BitPaymer ransomware variant to attack multiple victims in Texas and across the United States. The indictment alleges that since at least June 2017, Ryzhenkov gained unauthorized access to victims' computer networks, deployed BitPaymer ransomware to encrypt files, and demanded ransom for decryption keys and to prevent public exposure of sensitive information.
Ryzhenkov and his conspirators allegedly used phishing campaigns, malware, and exploited vulnerabilities in computer systems to intrude into networks. They then demanded millions of dollars in ransom from their victims. Ryzhenkov is believed to be residing in Russia.
In conjunction with the indictment's unsealing, the Treasury Department's Office of Foreign Assets Control added Ryzhenkov to its list of specially designated nationals. This designation blocks any property or interests he may have in the United States and prohibits U.S. financial institutions from engaging in transactions with him.
“The Justice Department is using all the tools at its disposal to attack the ransomware threat from every angle,” said Deputy Attorney General Lisa Monaco. “Today’s charges against Ryzhenkov detail how he and his conspirators stole the sensitive data of innocent Americans and then demanded ransom. With law enforcement partners here and around the world, we will continue to put victims first and show these criminals that, in the end, they will be the ones paying for their crimes.”
FBI Deputy Director Paul Abbate stated, “The FBI, together with partners, continues to leverage all resources to impose cost on criminals engaging in ransomware attacks. Today’s indictment delivers a clear message to those who engage in cyber-criminal activity – you will face severe consequences for your illicit activities and will be held accountable under the law.”
Principal Deputy Assistant Attorney General Nicole M. Argentieri emphasized that addressing ransomware threats is a high priority for the Criminal Division: “Aleksandr Ryzhenkov extorted victim businesses throughout the United States by encrypting their confidential information and holding it for ransom... The coordinated actions announced today demonstrate... that the Justice Department is committed to working with its partners to take an all-tools approach to protecting victims and holding cybercriminals accountable.”
U.S. Attorney Leigha Simonton for the Northern District of Texas noted that ransomware attacks can paralyze companies quickly: “Whether or not the ransom is paid, recovering from a ransomware attack is generally costly and time-consuming... The U.S. Attorney’s Office for the Northern District of Texas is committed to pursuing cybercriminals who hold data hostage, no matter where in the world they may be hiding.”
The FBI Dallas Field Office is investigating this case. Trial Attorney Debra L. Ireland of the Criminal Division’s Computer Crime and Intellectual Property Section and Assistant U.S. Attorney Vincent J. Mazzurco for the Northern District of Texas are prosecuting it.
Victims of ransomware attacks are encouraged to contact their local FBI field office. Additional information on ransomware can be found at StopRansomware.gov.
An indictment is merely an allegation; all defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.