U.S. v. Yaroslav Vasinskyi (Kaseya VSA / REvil Ransomware)
Key Facts
- Legal Status: SENTENCED in U.S. District Court for the Northern District of Texas.
- Primary Target Sector: Managed Service Providers, Information Technology, Retail, Education.
- Documented Financial Loss: $70.0 million.
- 5 verified MITRE ATT&CK techniques substantiated with verbatim court excerpts.
Incident Overview
Ukrainian national and REvil ransomware affiliate responsible for deploying the ransomware attack that hijacked Kaseya VSA management software, instantly encrypting up to 1,500 downstream businesses on July 4th weekend.
Root Cause & Infiltration Vector
Adversary initial penetration targeted internet-facing infrastructure by weaponizing known security vulnerabilities (CVE-2021-30116, CVE-2021-30117, CVE-2021-30118), subsequently leveraging administrative tooling to compromise victim Managed Service Providers, Information Technology, Retail, Education systems.
Operational Impact & Financial Blast Radius
Resulted in $70,000,000 in documented financial liabilities. Extortion demands totaled $70 million for universal decryptor; extensive operational stoppage across schools, grocery stores, and local governments.
Executive Risk Checklist
- 1. Are 100% of external and administrative access portals protected by phishing-resistant MFA?
- 2. Is network microsegmentation enforced between user workstations and core database enclaves?
- 3. Have immutable offline backups and incident escalation procedures been validated within 90 days?
Incident Execution & Kill-Chain Lifecycle
Sequential reconstruction of intrusion stages from initial infiltration to resolution.
Vasinskyi exploited zero-day authentication bypass and SQL injection vulnerabilities in internet-facing Kaseya VSA servers.
Vasinskyi used Kaseya VSA management agents to execute arbitrary PowerShell commands disguised as automated administrative service tasks.
The attacker used DLL side-loading with an outdated signed Windows Defender executable (MsMpEng.exe) to execute the REvil ransomware payload.
The REvil dropper checked host architecture and operating system language, aborting execution if Russian locale strings were detected.
Over 1,500 downstream client networks were locked with Salsa20 encryption in a synchronized automated broadcast on July 2, 2021.
Standard of Care Remediation & Hardening
Empirical engineering takeaways and preventative controls derived from this incident.
Procedural & Incident Timeline
Vasinskyi arrested by Polish authorities at the Polish-Ukrainian border.
Extradited from Poland to the Northern District of Texas.
Pled guilty to conspiracy to commit computer fraud and damage, money laundering, and related charges.
Sentenced to 163 months (over 13 years) in federal prison and ordered to pay $16 million in restitution.
Named Defendants & Operatives
| Defendant | Nationality | Status | Prison Term | Restitution | Notes |
|---|---|---|---|---|---|
| Yevgeniy Polyanin | Russian Federation | fugitive | Pending | $6.1 million | REvil affiliate indicted in N.D. Tex.; $6.1 million in ransom proceeds recovered by DOJ. |
| Yaroslav Vasinskyi | Ukraine | sentenced | 156 mo | None | REvil ransomware affiliate who carried out the Kaseya VSA attack. Sentenced to over 13 years in federal prison. |
Substantiated MITRE ATT&CK Techniques
| Technique ID | Technique Name & Tactic | Primary Source Evidence Excerpt | Locator | Verification |
|---|---|---|---|---|
| T1190 | Exploit Public-Facing Application Initial Access | "Vasinskyi exploited zero-day authentication bypass and SQL injection vulnerabilities in internet-facing Kaseya VSA servers." | Indictment ¶ 14, Page 7 | reviewed |
| T1574.002 | DLL Side-Loading Persistence | "The attacker used DLL side-loading with an outdated signed Windows Defender executable (MsMpEng.exe) to execute the REvil ransomware payload." | CISA Advisory AA21-189A | reviewed |
| T1486 | Data Encrypted for Impact Impact | "Over 1,500 downstream client networks were locked with Salsa20 encryption in a synchronized automated broadcast on July 2, 2021." | Indictment ¶ 16, Page 8 | reviewed |
| T1569.002 | Service Execution Execution | "Vasinskyi used Kaseya VSA management agents to execute arbitrary PowerShell commands disguised as automated administrative service tasks." | Indictment ¶ 15, Page 8 | reviewed |
| T1082 | System Information Discovery Discovery | "The REvil dropper checked host architecture and operating system language, aborting execution if Russian locale strings were detected." | CISA Advisory AA21-189A | reviewed |