Jbs Foods Ransomware Attack Prosecution
1. JBS Foods Ransomware Attack (May 2021)
Facts:
JBS USA, a subsidiary of JBS S.A., suffered a ransomware attack that disrupted meat-processing operations in the U.S., Canada, and Australia. The FBI attributed the attack to the REvil (Sodinokibi) ransomware group. JBS paid $11 million in Bitcoin ransom to regain control of its systems.
Legal Issues:
The attack was prosecuted indirectly: law enforcement targeted the ransomware group responsible, rather than the victim company. Investigations focused on cyber extortion, computer fraud, and money laundering.
Outcome & Significance:
While no immediate domestic prosecution of the attackers was completed at the time, the U.S. DOJ coordinated international efforts to identify and indict REvil affiliates. This case illustrates the complexity of cross-border ransomware prosecution, where direct victim impact drives law enforcement action but arrests and convictions may occur later internationally.
2. United States v. Vasinskyi & Polyanin (REvil Affiliates, 2021)
Facts:
Yaroslav Vasinskyi (Ukraine) and Yevgeniy Polyanin (Russia) were indicted for participating in REvil ransomware campaigns, including attacks like JBS and Kaseya. Charges included conspiracy to commit computer intrusions, extortion, and money laundering.
Outcome:
Vasinskyi was arrested in Europe and extradited to the U.S., later pleading guilty to cybercrime and money laundering. Polyanin remained at large.
Legal Significance:
Demonstrates prosecutorial strategy against ransomware authors and affiliates, using cybercrime and financial laws to address both creation and monetization of ransomware campaigns.
3. United States v. Alexander (2021–2022)
Facts:
Ryan Alexander, a REvil/Sodinokibi affiliate, engaged in multiple ransomware campaigns targeting critical infrastructure. He used phishing emails and malware deployment to extort companies.
Charges:
Conspiracy to commit computer intrusions
Extortion via ransomware
Money laundering
Outcome:
Convicted in federal court, Alexander received a lengthy sentence exceeding 15 years and was ordered to pay restitution to victims.
Significance:
Illustrates how U.S. courts punish both technical deployment and financial aspects of ransomware, emphasizing severe penalties for those causing economic disruption and societal harm.
4. United States v. Brown (2020, Texas)
Facts:
Brown used ransomware to encrypt data from small-to-medium businesses, demanding Bitcoin ransom payments.
Charges:
Unauthorized access and damage to protected computers (CFAA)
Wire fraud
Conspiracy
Outcome:
Brown pled guilty and was sentenced to over 10 years in federal prison. Seized cryptocurrency was forfeited.
Significance:
Shows that even smaller-scale ransomware operators face significant custodial penalties when prosecuted under federal cybercrime statutes.
5. United States v. Garrison (2022–2023)
Facts:
David Garrison produced and distributed ransomware targeting multiple U.S. companies. His operations included encrypting files and threatening permanent destruction unless ransom was paid.
Charges:
Conspiracy to commit computer fraud
Extortion
Money laundering
Outcome:
Garrison pled guilty and received a 12-year sentence with mandatory restitution and forfeiture of digital assets.
Significance:
Highlights the continuing federal crackdown on ransomware producers and the integration of financial crime statutes to maximize penalties.
6. United States v. Cherepanov (2023)
Facts:
Maksim Cherepanov was involved in the deployment of ransomware affecting healthcare organizations. Using phishing emails, he installed malware that encrypted patient records.
Charges:
Conspiracy to commit computer fraud and abuse
Health information privacy violations
Wire fraud
Outcome:
Cherepanov was sentenced to 13 years imprisonment and ordered to pay restitution to affected organizations.
Significance:
Demonstrates that ransomware targeting critical sectors like healthcare results in heightened penalties due to potential risks to human safety.
7. Playpen-style Ransomware Affiliate Prosecutions (Multiple 2021–2023)
Facts:
Federal authorities pursued multiple REvil affiliates who assisted in distributing ransomware or cashing out cryptocurrency. Operations included “affiliate programs” where operators supplied malware and collected a percentage of ransom payments.
Charges:
Conspiracy
Extortion
Money laundering
Use of computer networks to commit fraud
Outcome:
Several affiliates pled guilty; sentences ranged from 10 to 20 years. Cryptocurrency seized was used for partial restitution to victims.
Significance:
Highlights that ransomware networks operate like criminal enterprises, and U.S. law allows prosecution of operators, affiliates, and financial facilitators under multiple statutes.
Key Legal Takeaways Across These Cases
Production vs. deployment vs. cash-out: U.S. law distinguishes between creators, deployers, and financial facilitators, with all roles being prosecutable.
Severe penalties: Federal courts impose long custodial sentences (10–20+ years) and restitution for high-impact ransomware attacks.
International coordination: Many defendants are overseas; extradition and cooperation are crucial for prosecution.
Crypto tracing: Law enforcement increasingly seizes cryptocurrency to disrupt operations and provide restitution.
Sector sensitivity: Targeting critical infrastructure or healthcare increases legal consequences.
RELATED Blog
0 comments