A Bradford man made his latest court appearance in connection with a ransomware attack described by American investigators as one of the most destructive variants in the world.
Mikhail Vasiliev was in a Newmarket courtroom Thursday, entering a guilty plea on multiple counts involving cyber-extortion, mischief and weapons charges. This is in relation to his attempts to extract hundreds of thousands of dollars from Canadian victims, including several businesses.
He was charged following a raid at a Bradford home in 2022, the result of a two-and-a-half-year probe into the LockBit ransomware group, which the United States government says has harmed victims around the world.
The Ontario Provincial Police announced in a November 2022 news release that investigators seized evidence related to a cross-border ransomware investigation, as well as two prohibited firearms during the raid.
In its own news release issued the same day, the U.S. Department of Justice announced Vasiliev, who was 33 years old at the time and described as a dual Russian and Canadian national, was charged in connection with the LockBit campaign. There was no reference to anyone else implicated in the scheme.
LockBit was described in the American release as having first appeared around January 2020 and becoming “one of the most active and destructive ransomware variants in the world.” Its malware infiltrates networks through unpatched vulnerabilities, insider access and zero-day exploits. It is then able to gain control of a victim’s system, collect network information and steal or encrypt data.
Its “members” are accused of making at least $100 million in ransom demands, extracting tens of millions of dollars in payments from up to 1,000 victims, including Indigo, Toronto’s Hospital for Sick Children and the Lisbon Port Authority in Portugal.
Vasiliev has been charged in the U.S. with conspiracy to intentionally damage protected computers and to transmit ransom demands in connection with LockBit, and could face up to five years in prison, if convicted.
The U.S. has sought Vasiliev’s extradition.
The investigation, launched around March 2020, was conducted by numerous FBI field offices, the FBI’s Legal Attaché-Ottawa, the Newark Cyber Crimes Task Force, the Jersey City Police Department, the New Jersey State Police, and the New Jersey Office of Homeland Security and Preparedness.
The criminal complaint against Vasiliev says Canadian police officers searched his Bradford home in August, where they discovered a file containing a list of alleged prospective or previous cyber-crime victims.
Also discovered in the search were screenshots of messages discussing topics related to the LockBit campaign, a text file including instructions to deploy a LockBit program against a computer, and usernames and passwords for various platforms belonging to employees of a Canadian LockBit victim, documents show.
The complaint further reveals that Vasiliev’s home was raided again on Oct. 26, 2022 and upon entering, “Canadian law enforcement discovered Vasiliev sitting in the garage at a table with a laptop, which he was unable to lock before being restrained.”
Investigators also found multiple tabs open on the laptop, including one pointing to a site named “LockBit LOGIN” with a LockBit logo and a login screen hosted at a dark web domain, the document alleged.
Vasiliev has another court appearance scheduled later this month.
Multiple attempts to reach his lawyer for comment prior to the publication of this article were unsuccessful.
— With files from Marg. Bruineman and the Canadian Press
