When police raided this pleasant suburban home looking for a man allegedly part of a notorious global ransomware
gang, the cops found him sitting at a table in the garage with an open laptop in front of him.
They restrained him quickly — before he could lock his computer.
Securing direct access to that private computer revealed information about the alleged hacker,
and perhaps others, and fed FBI agents information used to file
charges against him in U.S federal court and request his extradition from Canada
The Mob Reporter here with dramatic news of an attack targeting the world's most prolific and
notorious ransomware gang, one operating on a global stage — from New Jersey and Toronto
to Paris and Berlin, from Jakarta and Kyiv to New Delhi and Beijing. Let me tell you about it
It's called LockBit and the name applies to both malevolent software and a rapacious
group who weaponized it. I'm sure you've seen headlines about ransomware attacks
in recent years. The hackers who pull off these extortions are the digital equivalent
of kidnappers from the past. They don't grab relatives of the rich and demand money for
their return. And unlike simple hackers who just steal data, ransomware is uniquely painful
They encrypt and lock a victim's data so no one can access it without a code to decrypt
it. The attackers leave behind a ransom note on the computers where the working files used to be
Last year in Ukraine, two alleged associates of LockBit were raided. You see the operation
here. It was the result of an investigation by French and Ukrainian police and led to
the arrest of two men. In that September 2021 raid, police also seized 375,000 dollars
in cash, two luxury vehicles, and froze assets of $1.3 million in cryptocurrencies
Europol, the European police agency, said they were part of an organized group that were
high-value targets and at the time they said they continued to search for "the main operator"
Europol connected those arrests in Ukraine to the one in Canada that came a year later
These scenes from the European investigation may give us some
idea of how their most recent activity might have played out
The most recent raid was on Oct. 26, 2022, and targeted this detached house in Canada
in the residential community of Bradford West Gwillimbury, an hour's drive due north from Toronto
The raid by the Ontario Provincial Police seems to have caught the target by surprise: 33-year-old
dual Russian and Canadian citizen Mikhail Vasiliev. He was in the garage sitting at a table with an
open laptop in front of him when officers crashed in. Vasiliev didn't have a chance to close his
laptop before he was restrained. Police said the laptop revealed a browser window with an open
tab titled "LockBit Login," pointing to a domain on the dark web, according to allegations in a
criminal complaint sworn by an FBI agent and filed in court in New Jersey. The FBI believes
this was a LockBit control panel, through which ransomware attackers carry out their extortion
Also on the computer, authority's allege, was a seed phrase for accessing a Bitcoin
wallet. The wallet showed a payment on February 5. The FBI alleges those funds
were a portion of a ransom payment made six hours earlier by a confirmed LockBit victim
Investigators with France's Gendarmerie, the FBI, and the European Cyber Crime Center were
deployed to Ontario to work with Canadian police, according to Europol, the European police agency
Europol said Canadian police seized two guns, eight computers, and 32 external hard drives in
the search of the home, along with 400,000 Euros in cryptocurrencies. This was not
the first police visit to Vasiliev’s home. The OPP first raided it in August but kept it hush-hush
while the international investigation took shape. During the August raid, officers found
a file titled "TARGETLIST" which appears to be a list of prospective or past cyber crime victims
It included a New Jersey business that was hit by LockBit last November, including instructions
for deploying a LockBit attack, and photos of user names and passwords for employees of a
LockBit victim in Canada that was hit in January, according to an FBI affidavit filed in court
After the October raid, the OPP didn't charge Vasiliev for anything to do with LockBit, hacking, or
even computers. He was only charged over two guns and ammunition police say were found in the house,
including procession of a prohibited or restricted gun. The day after his arrest, he made a quick and
quiet court appearance in a small courthouse even further north, and was released on bail. His release
conditions included GPS monitoring and staying six miles away from Toronto's international
airport and 12 miles away from any border crossing. Prosecutors were clearly concerned he might try
to leave the country while they waited for the Americans to get their paperwork in order. On
November 2nd, the U.S officials filed a criminal complaint and arrest warrant for Vasiliev in a
New Jersey court under seal. That made it secret from the public. The request for his arrest was
then forwarded to Canadian authorities who then arrested Vasiliev the second time, on November 10th
This time on behalf of the United States with an eye for his extradition. He made an unscheduled
court appearance that day and this time he was held in custody pending a further hearing
U.S charges against him are conspiring to damage protected computers and to transmit
ransom demands. None of the allegations have been proven in court I asked Vasiliev's lawyer
if he or his client wished to comment on the allegations, and he declined at this time
The U.S Department of Justice said the arrest comes after more than two and a half years of
investigating LockBit. LockBit is sometimes portrayed online as a bit of a Robin Hood
style organization for mostly targeting the banking, insurance, financial, and professional
services sectors — rather than hospitals, schools, and charities. Their targets are usually large
organizations that have two things: a lot of important data and the resources to pay
handsomely to get it back. LockBit attracted added attention when analysts found it had a
special subroutine; before launching an attack it determined where the target servers were, and if
they were in Russia or one of the former Soviet Union states, it would abort the attack. What sets
LockBit apart for authorities as a gang as opposed to individual hackers or a collective is their
organized structure. They use a ransomware-as-a-service model. They have a hierarchy of developers
and affiliates, they recruit and interact, they share and cooperate. They run a bug bounty
program for finding any flaws in their program. Like a forward-thinking tech company they're
always looking to improve — and that's bad news for their victims. Here's one last weird thing though:
A few hours after Europol posted its announcement about the arrest in Canada online, it disappeared
— poof — replaced with this 404 Error notice, without any explanation. I've asked Europol three times
now to explain, without any response, which is odd because they're usually good about responding to
my questions. The weirdness continues, because when I spoke with someone from the agency in Canada that
arrested Vasiliev, they said they didn't work with Europol. And while the U.S Department of Justice
thanked 10 agencies for their collaboration on the file, not one is a European agency. In
any event, no matter who did what, where, Vasiliev remains in Canada facing extradition to the
United States, whatever interest there might be for him in Europe. Please tap the "Thanks" button
under this video to help me out, or join me on Patreon for perks and bonus content. That's at
Patreon.com/TheMobReporter. Please like, subscribe, and comment on this video. Thanks for watching