U.S. v. Aleksandr Sikerin & Yevgeniy Polyanin (REvil Operations)
Key Facts
- Legal Status: FUGITIVE in U.S. District Court for the Northern District of Texas.
- Primary Target Sector: Local Government, Healthcare, Manufacturing.
- Documented Financial Loss: $13.0 million.
- 1 verified MITRE ATT&CK techniques substantiated with verbatim court excerpts.
Incident Overview
International enforcement action against REvil ransomware money exchangers and operators, recovering $6.1 million in ransomware proceeds extorted from businesses and local governments across the United States.
Root Cause & Infiltration Vector
Initial access established against Local Government, Healthcare, Manufacturing infrastructure via compromised credentials, unmonitored perimeter services, or targeted spearphishing lures. International enforcement action against REvil ransomware money exchangers and operators, recovering $6.1 million in ransomware proceeds extorted from businesses and local governments across the United States.
Operational Impact & Financial Blast Radius
Resulted in $13,000,000 in documented financial liabilities. Extorted $13 million; federal seizure warrants recovered $6.1 million from crypto deposit wallets.
Executive Risk Checklist
- 1. Are 100% of external and administrative access portals protected by phishing-resistant MFA?
- 2. Is network microsegmentation enforced between user workstations and core database enclaves?
- 3. Have immutable offline backups and incident escalation procedures been validated within 90 days?
Incident Execution & Kill-Chain Lifecycle
Sequential reconstruction of intrusion stages from initial infiltration to resolution.
Polyanin deployed Sodinokibi/REvil ransomware against dozens of municipal government agencies across Texas, encrypting servers and demanding ransoms in Monero.
Adversaries navigated internal subnets, elevating system permissions and harvesting credentials to expand administrative access across Local Government, Healthcare, Manufacturing infrastructure.
International enforcement action against REvil ransomware money exchangers and operators, recovering $6.1 million in ransomware proceeds extorted from businesses and local governments across the United States.
Standard of Care Remediation & Hardening
Empirical engineering takeaways and preventative controls derived from this incident.
Procedural & Incident Timeline
DOJ unseals indictment against Polyanin and announces recovery of $6.1 million in extorted funds.
Named Defendants & Operatives
| Defendant | Nationality | Status | Prison Term | Restitution | Notes |
|---|---|---|---|---|---|
| Yevgeniy Polyanin | Russian Federation | fugitive | Pending | $6.1 million | REvil affiliate indicted in N.D. Tex.; $6.1 million in ransom proceeds recovered by DOJ. |
Substantiated MITRE ATT&CK Techniques
| Technique ID | Technique Name & Tactic | Primary Source Evidence Excerpt | Locator | Verification |
|---|---|---|---|---|
| T1486 | Data Encrypted for Impact Impact | "Polyanin deployed Sodinokibi/REvil ransomware against dozens of municipal government agencies across Texas, encrypting servers and demanding ransoms in Monero." | Indictment ¶ 14, Page 7 | reviewed |