The FBI seizes more than $2.2M in bitcoin from a ransomware affiliate.

The Federal Bureau of Investigation (FBI) has captured more than $2.2 million in bitcoin linked to ransomware payments. The coin is said to be the property of a Gandcrab and Revil/Sodinokibi ransomware affiliate.

According to a court filing released Tuesday, the FBI confiscated nearly 40 bitcoins from a Russian citizen linked to the Revil and Gandcrab malware. According to the forfeiture complaint:

The United States of America files this verified complaint in rem against 39.89138522 bitcoin seized from Exodus wallet … that is now located and in the custody and management of the Federal Bureau of Investigation (FBI) Dallas Division.

According to Bitcoin.com Markets, the price of bitcoin is now at $56,318.06 at the time of writing. The total amount seized is over $2.247 million.

The seizure occurred on August 3. While the FBI did not specify how it obtained access to the wallet, the court complaint states that it included Revil ransom payments belonging to an associate named Aleksandr Sikerin (aka Alexander Sikerin and Oleksandr Sikerin), whose email address is engfog1337@gmail.com.

The name “engfog” in the email address is linked to a well-known Gandcrab and Revil/Sodinokibi affiliate known as “Lalartu,” according to Bleeping Computer.

According to the news site, the Gandcrab and Revil groups functioned as Ransomware-as-a-Service (RaaS), in which core operators collaborate with third-party hackers known as affiliates, and ransom revenues are shared between the affiliate and core operators. Typically, the operators get between 20% and 30% of the ransom.

The US Department of Justice (DOJ) said earlier this month that it had confiscated $6.1 million from Yevgeniy Polyanin, a Russian “charged with distributing Sodinokibi/Revil ransomware to attack companies and government institutions in the US.”

Meanwhile, the US government has stepped up its efforts to combat ransomware assaults. Two bitcoin exchanges linked to ransom payments have previously been sanctioned by the Treasury Department.

Patrick

Coincu News