US Government Takes Aim at NetWalker Ransomware Attacks

Prosecutors indicted an alleged NetWalker affiliate and coordinated the takedown of darkweb resources.

AccessTimeIconJan 28, 2021 at 7:54 p.m. UTC
Updated Sep 14, 2021 at 11:02 a.m. UTC
10 Years of Decentralizing the Future
May 29-31, 2024 - Austin, TexasThe biggest and most established global event for everything crypto, blockchain and Web3.Register Now

Federal prosecutors struck back at a favorite tool of the ransomware community Wednesday, indicting one alleged NetWalker user, a Canadian national named Sebastien Vachon-Desjardins, on wire fraud, hacking and network extortion charges, and coordinating the takedown of a victim guidebook hosted on the darkweb.

The action, which included assistance from Bulgarian authorities, is the U.S. government's first public assault against a malicious software that's booming in popularity. Ransoms against schools, hospitals, businesses and governments netted NetWalker attackers tens of millions of dollars in 2020.

NetWalker burrows into and encrypts victim computers, only releasing its hold once victims pay a ransom - usually in bitcoin. It follows the ransomware-as-a-service model, making the individual hackers (affiliates) who deploy the attack lock down the computer and demand the ransom akin to franchisees who share their profits with corporate (the ransomware developer).

Sebastien Vachon-Desjardins is alleged to have been one such affiliate. Prosecutors said he held a Florida-based company's computers hostage with NetWalker in violation of federal law. Prosecutors also demanded forfeiture of $27 million accrued through his alleged ransomware crimes.

Vachon-Desjardins mounted at least 91 NetWalker heists from April 2020 onward, blockchain tracing company Chainalysis said, citing government partners. In a Wednesday blog post the firm said Vacho-Desjardins' associated wallet addresses have allegedly banked more than $14 million in bitcoin since February 2018, a trove now worth $27 million.

Chainalysis CSO Jonathan Levin told CoinDesk Vachon-Desjardins' transactions offer a window into the workings of the underground ransomware economy. Chainalysis has followed $46 million in illicit ransomware bitcoin flows since 2019.

"The transparency of the blockchain really enables you to see not only the affiliates that are dealing with NetWalker, but also the affiliates that are actually using the other ransomware-as-a service strains. So we can see links between different ransomware strains via common affiliates of the different strains," he said.

NetWalker attacks are unlikely to abate with the removal of a single affiliate, he said.


Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.

Learn more about Consensus 2024, CoinDesk's longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to to register and buy your pass now.