NEWARK, N.J. – A Russian and Canadian national has been charged with participating in the LockBit global ransomware campaign, U.S. Attorney Philip R. Sellinger, Deputy Attorney General Lisa O. Monaco, Assistant Attorney General Kenneth A. Polite, and FBI-Newark Special Agent in Charge James E. Dennehy announced today.

Mikhail Vasiliev, 33, of Bradford, Ontario, Canada, is charged by complaint unsealed today in Newark federal court with conspiring with others to intentionally damage protected computers and to transmit ransom demands in connection with doing so. He was arrested Nov. 9, 2022, is awaiting extradition proceedings to bring him to the District of New Jersey.

/** * SNN Article Link Cleanup & Display Stability * Disable BOTH "Link Cleaner" and "WP Perf" before activating. * Paste into Code Snippets as PHP; run everywhere. * * Standard RSS feeds, REST output, schema and article identifiers * are not rewritten. Requires WordPress 6.2+ for link cleanup. */ if ( ! class_exists( 'SNN_Safe_Display_20261031', false ) ) { final class SNN_Safe_Display_20261031 { public static function boot() { add_action( 'init', array( __CLASS__, 'head_cleanup' ), 20 ); add_filter( 'the_content', array( __CLASS__, 'article_links' ), 99 ); add_action( 'wp_enqueue_scripts', array( __CLASS__, 'display_css' ), 100 ); } public static function head_cleanup() { if ( is_admin() ) { return; } remove_action( 'wp_head', 'wp_generator' ); remove_action( 'wp_head', 'print_emoji_detection_script', 7 ); remove_action( 'wp_print_styles', 'print_emoji_styles' ); } public static function skip_request() { return is_admin() || is_feed() || is_trackback() || ( defined( 'REST_REQUEST' ) && REST_REQUEST ) || wp_doing_ajax() || is_preview(); } /** * Remove UTM parameters while preserving other query parameters, * their order, encoding and the URL fragment. */ public static function clean_url( $url ) { if ( ! is_string( $url ) || $url === '' ) { return $url; } // Preserve non-web schemes such as mailto:, tel: and data:. if ( preg_match( '/^[a-z][a-z0-9+.-]*:/i', $url ) && ! preg_match( '~^https?://~i', $url ) ) { return $url; } $parts = explode( '#', $url, 2 ); $base = explode( '?', $parts[0], 2 ); if ( count( $base ) !== 2 ) { return $url; } $pairs = explode( '&', $base[1] ); // Preserve commonly signed URLs. foreach ( $pairs as $pair ) { $parameter = explode( '=', $pair, 2 ); $key = strtolower( urldecode( $parameter[0] ) ); if ( in_array( $key, array( 'signature', 'sig', 'x-amz-signature', 'x-goog-signature', ), true ) ) { return $url; } } $kept = array(); $changed = false; foreach ( $pairs as $pair ) { $parameter = explode( '=', $pair, 2 ); $key = urldecode( $parameter[0] ); if ( stripos( $key, 'utm_' ) === 0 ) { $changed = true; continue; } $kept[] = $pair; } if ( ! $changed ) { return $url; } $query = implode( '&', $kept ); return $base[0] . ( $query !== '' ? '?' . $query : '' ) . ( isset( $parts[1] ) ? '#' . $parts[1] : '' ); } /** * Clean anchor URLs in displayed single-post content only. * Do not buffer or rewrite the full page or feed response. */ public static function article_links( $html ) { if ( ! is_string( $html ) || self::skip_request() || ! is_singular( 'post' ) || ! in_the_loop() || ! is_main_query() || apply_filters( 'snn_safe_display_skip_links', false ) || ! class_exists( 'WP_HTML_Tag_Processor' ) ) { return $html; } $processor = new WP_HTML_Tag_Processor( $html ); while ( $processor->next_tag( 'A' ) ) { $href = $processor->get_attribute( 'href' ); if ( ! is_string( $href ) ) { continue; } $clean = self::clean_url( $href ); if ( $clean !== $href ) { $processor->set_attribute( 'href', $clean ); } } return $processor->get_updated_html(); } public static function display_css() { if ( self::skip_request() || ! is_singular( 'post' ) ) { return; } /* * Space reservations apply only to ad wrappers with these classes. * Adjust the heights to match your actual ad placements. * Unfilled ad slots can retain blank space. */ $css = ' .snn-ad-container.snn-ad-inarticle { min-height: 280px; } .snn-ad-container.snn-ad-sidebar { min-height: 280px; } .entry-content p.wp-block-paragraph { overflow-wrap: break-word; } @media (max-width: 921px) { .snn-ad-container.snn-ad-sidebar { min-height: 100px; } } '; wp_register_style( 'snn-safe-display', false, array(), '1.0.0' ); wp_enqueue_style( 'snn-safe-display' ); wp_add_inline_style( 'snn-safe-display', $css ); } } SNN_Safe_Display_20261031::boot(); }

“International ransomware threats like LockBit are the most pressing cybercrime challenge facing law enforcement today,” U.S. Attorney Sellinger said. “These attacks cause disruption and damage to their victims that far exceed the dollar figures of ransom demands or payments, which are themselves significant. However, the United States is up for this challenge and will use all legal means to find the perpetrators of these attacks and bring them to justice.”

“This arrest is the result of over two-and-a-half-years of investigation into the LockBit ransomware group, which has harmed victims in the United States and around the world,” Deputy Attorney General Lisa O. Monaco said. “It is also a result of more than a decade of experience that FBI agents, Justice Department prosecutors, and our international partners have built dismantling cyber threats. Let this be yet another warning to ransomware actors: working with partners around the world, the Department of Justice will continue to disrupt cyber threats and hold perpetrators to account. With our partners, we will use every available tool to disrupt, deter, and punish cyber criminals.”

“Cyber criminals who damage protected systems, exploit privileged information, or hold for ransom important files and data are a threat to our way of life,” FBI-Newark Special Agent in Charge James E. Dennehy said. “The FBI will not stand idly by while companies and government entities are bled dry or while their systems are corrupted by these criminal opportunists. We will utilize every tool in our arsenal – including our global partnerships – to shut down these types of schemes.”

According to documents filed in this case and statements made in court:

LockBit is a ransomware variant that first appeared as early as January 2020 and has been deployed against over 1,000 victims in the United States and around the world. LockBit members have made at least $100 million in ransom demands to those victims and have extracted tens of millions of dollars in actual ransom payments from those victims. The FBI has been investigating the LockBit conspiracy since in or around March 2020. Vasiliev participated in the LockBit campaign by conspiring with others to intentionally damage protected computers and to transmit ransom demands.

The charge of conspiring to intentionally damage protected computers and to transmit ransom demands is punishable by a maximum of five years in prison and a maximum fine of $250,000, or twice the gross pecuniary gain or loss from the scheme, whichever is greatest.

U.S. Attorney Sellinger credited the Newark Cyber Crimes Task Force, under the direction of Special Agent in Charge Dennehy, with the investigation leading to the charges. U.S. Attorney Sellinger also thanked FBI Atlanta, FBI Pittsburgh, FBI Miami, the FBI’s Legal Attaché-Ottawa, the Jersey City Police Department, New Jersey State Police, New Jersey Office of Homeland Security and Preparedness, and members of the U.S. Attorney’s Office for the Northern District of Georgia and of the U.S. Attorney’s Office for the Western District of Pennsylvania for their assistance. The Justice Department’s Office of International Affairs provided valuable assistance in securing Vasiliev’s arrest.

The government is represented by Assistant U.S. Attorneys Andrew M. Trombly and David E. Malagold of the Cybercrime Unit in Newark and by Trial Attorney Jessica C. Peck of the Computer Crime and Intellectual Property Section in Washington, D.C.

The charges and allegations contained in the complaint are merely accusations, and the defendant is presumed innocent unless and until proven guilty.