Threat Insight

Russian Police Arrests Ransomware Criminal

The Russian government has confirmed the indictment of the 32-year-old cybercriminal Mikhail Pavlovich Matveev in Kaliningrad. Matveev who used the monikers “Wazawaka” and “BoricElcin”, was the leader of the Babuk ransomware group in 2022, but after Babuk dissolved, he appears to be mostly acted as affiliate to other ransomware groups, like LockBit, DarkSide and Hive.

  • Insight

According to people that have been in contact with Matveev, he claims the police confiscated some of his cryptocurrency, but he was then released on bail. He now awaits the next step in the judiciary process. Matveev is one of the Russian ransomware criminals that has been identified by Western law enforcement and was indicted by the US Department of Justice in May 2023.

Assesment

While Russian cybercriminals are mostly left alone by Russian authorities, there are some notable cases where cybercriminals have been arrested in Russia. In January 2022 thirteen former members of the then defunct ransomware group REvil were arrested. That arrest coincided with Russian preparations for the invasion of Ukraine a month later and may have been a signal to the West that Russia could clamp down on ransomware if the West refrained from supporting Ukraine. It’s too early to determine if the arrest of Matveev signals a similar offer to the incoming US administration. Matveev has had a controversial past. He was the leader of Babuk but the group was allegedly splintered because the rest of the group were unhappy weith his leadership. He is missing one finger, allegedly after losing a wager. It’s possible that his arrest is tied to something in his personal past.

References

[1] https://epp.genproc.gov.ru/web/gprf/mass-media/news/archive?item=99391672
[2] https://www.justice.gov/opa/pr/russian-national-charged-ransomware-attacks-against-critical-infrastructure
[3] https://krebsonsecurity.com/2022/02/wazawaka-goes-waka-waka/