Russian cybercriminal, Mikhail Matveev, also known as “Wazawaka” has been recently arrested by the Russian government after being indicted by the U.S. government for his involvement in various ransomware groups. Matveev has been accused of creating malware that was used to extort money from companies, schools, hospitals, and government agencies, leading to the U.S. government offering a $10 million reward for information leading to his arrest.
The Russian interior ministry released a statement last week confirming the arrest of a 32-year-old hacker for violating domestic laws related to malicious software. While the statement did not mention the name of the accused, anonymous sources cited by the Russian state news agency RIA Novosti identified the detained hacker as Matveev.
Despite the charges, Matveev has remained relatively open about his activities, as evidenced by his interactions on various cybercrime forums and social media platforms. He has acknowledged using the monikers “Wazawaka” and “Boriselcin” and even posted pictures of U.S. government wanted posters for himself on his profiles.
Throughout his career, Matveev has claimed to adhere to the unwritten rule of Russian cybercrime – avoiding attacks on Russian entities to avoid arrest. However, allegations suggest that he may have strayed from this rule on occasion, including engaging in activities such as stealing accounts from drug dealers on darknet platforms.
The recent arrest of Matveev has raised speculations among cybersecurity experts, with some suggesting that there may be more behind the scenes than meets the eye. Intel 471, a cyber intelligence firm, believes that the arrest could be a result of a shakedown by local authorities seeking to profit from Matveev’s substantial cryptocurrency holdings.
While Russia has not traditionally been proactive in pursuing cybercriminals within its borders, recent arrests signal a shift in policy. Earlier this year, four individuals linked to the REvil ransomware group were sentenced to prison terms, and arrests were made in connection with the Sugarlocker ransomware program.
Notably, Aleksandr Ermakov and Mikhail Shefel, also known as Mikhail Lenin, were arrested for their involvement in Sugarlocker, with Ermakov becoming the first cybercriminal sanctioned by Australia. Shefel, who was identified as “Rescator” in connection with the Target and Home Depot breaches, has claimed that his arrest was retaliation for reporting a former boss’s son to the police.
The cybersecurity landscape is evolving, with governments beginning to take more decisive actions against cybercriminals. The arrest of Matveev and other high-profile cybercriminals signals a growing awareness of the threats posed by ransomware and the need for international cooperation to combat these crimes effectively. As the legal proceedings unfold, the cybersecurity community will be closely monitoring the outcomes and implications for future cybercrime investigations.