U.S. v. Yaroslav Vasinskyi (Kaseya VSA / REvil Ransomware)
Key Facts
- Legal Status: SENTENCED in U.S. District Court for the Northern District of Texas.
- Primary Target Sector: Managed Service Providers, Information Technology, Retail, Education.
- Documented Financial Loss: $70.0 million.
- 5 verified MITRE ATT&CK techniques substantiated with verbatim court excerpts.
Case Summary
Executive Summary for Board Members & Leadership
Plain-English Root Cause
Adversary initial penetration relied on exploitation of known vulnerabilities (CVE-2021-30116, CVE-2021-30117, CVE-2021-30118) combined with targeted spearphishing and stolen remote access credentials.
Operational & Financial Fallout
Extortion demands totaled $70 million for universal decryptor; extensive operational stoppage across schools, grocery stores, and local governments. Impacted Managed Service Providers, Information Technology, Retail, Education infrastructure and associated victim operations.
3 Critical Boardroom Questions
- 1. Do 100% of our external portals enforce phishing-resistant hardware MFA?
- 2. Can compromised endpoint credentials traverse laterally to domain controllers or cloud storage?
- 3. Have our air-gapped immutable recovery backups been restored and tested within the last 90 days?
Attack Anatomy & Incident Execution
Forensic analysis of initial intrusion vector, step-by-step kill chain, operational blast radius, and defensive controls.
Adversary initial penetration relied on exploitation of known vulnerabilities (CVE-2021-30116, CVE-2021-30117, CVE-2021-30118) combined with targeted spearphishing and stolen remote access credentials.
Adversary Kill Chain Flow
5 Documented PhasesVasinskyi exploited zero-day authentication bypass and SQL injection vulnerabilities in internet-facing Kaseya VSA servers.
Vasinskyi used Kaseya VSA management agents to execute arbitrary PowerShell commands disguised as automated administrative service tasks.
The attacker used DLL side-loading with an outdated signed Windows Defender executable (MsMpEng.exe) to execute the REvil ransomware payload.
The REvil dropper checked host architecture and operating system language, aborting execution if Russian locale strings were detected.
Over 1,500 downstream client networks were locked with Salsa20 encryption in a synchronized automated broadcast on July 2, 2021.
Extortion demands totaled $70 million for universal decryptor; extensive operational stoppage across schools, grocery stores, and local governments. Impacted Managed Service Providers, Information Technology, Retail, Education infrastructure and associated victim operations.
Procedural & Incident Timeline
Vasinskyi arrested by Polish authorities at the Polish-Ukrainian border.
Extradited from Poland to the Northern District of Texas.
Pled guilty to conspiracy to commit computer fraud and damage, money laundering, and related charges.
Sentenced to 163 months (over 13 years) in federal prison and ordered to pay $16 million in restitution.
Named Defendants & Operatives
| Defendant | Nationality | Status | Prison Term | Restitution | Notes |
|---|---|---|---|---|---|
| Yevgeniy Polyanin | Russian Federation | fugitive | Pending | $6.1 million | REvil affiliate indicted in N.D. Tex.; $6.1 million in ransom proceeds recovered by DOJ. |
| Yaroslav Vasinskyi | Ukraine | sentenced | 156 mo | None | REvil ransomware affiliate who carried out the Kaseya VSA attack. Sentenced to over 13 years in federal prison. |
Substantiated MITRE ATT&CK Techniques
| Technique ID | Technique Name & Tactic | Primary Source Evidence Excerpt | Locator | Verification |
|---|---|---|---|---|
| T1190 | Exploit Public-Facing Application Initial Access | "Vasinskyi exploited zero-day authentication bypass and SQL injection vulnerabilities in internet-facing Kaseya VSA servers." | Indictment ¶ 14, Page 7 | reviewed |
| T1574.002 | DLL Side-Loading Persistence | "The attacker used DLL side-loading with an outdated signed Windows Defender executable (MsMpEng.exe) to execute the REvil ransomware payload." | CISA Advisory AA21-189A | reviewed |
| T1486 | Data Encrypted for Impact Impact | "Over 1,500 downstream client networks were locked with Salsa20 encryption in a synchronized automated broadcast on July 2, 2021." | Indictment ¶ 16, Page 8 | reviewed |
| T1569.002 | Service Execution Execution | "Vasinskyi used Kaseya VSA management agents to execute arbitrary PowerShell commands disguised as automated administrative service tasks." | Indictment ¶ 15, Page 8 | reviewed |
| T1082 | System Information Discovery Discovery | "The REvil dropper checked host architecture and operating system language, aborting execution if Russian locale strings were detected." | CISA Advisory AA21-189A | reviewed |