Target Sector: Government, Defense & Elections
Court filings, technical advisories, and SEC Form 8-K enforcement disclosures documenting cyber intrusions against organizations in Government, Defense & Elections.
Key Facts
- 22 documented prosecution and advisory matters targeting Government, Defense & Elections.
- Cumulative reported financial losses exceed $16.3 billion.
- 5 of 22 cases reached conviction, guilty plea, or final sentencing.
- Tracked actors include Sandworm Team, LockBit Ransomware Group, Volt Typhoon, APT29.
Documented Incidents (22)
U.S. v. Andrienko et al. (Sandworm / GRU Unit 74455)
Six Russian Main Intelligence Directorate (GRU) military officers charged with deploying the NotPetya wiper, Olympic Destroyer malware, KillDisk attacks against Ukrainian power grids, and cyberattacks targeting French elections.
U.S. v. Khoroshev et al. (LockBit Ransomware Operation)
Comprehensive global law enforcement takedown (Operation Cronos) of LockBit ransomware infrastructure, unmasking creator Dmitry Khoroshev (LockBitSupp) and multiple active affiliates who extorted over $500 million from thousands of victims.
Volt Typhoon Critical Infrastructure Pre-Positioning
State-sponsored cyber group sponsored by the People's Republic of China breached dozens of U.S. critical infrastructure operators in communications, energy, transportation, and water systems to establish disruptive persistent access.
SolarWinds Orion Supply Chain Intrusion (APT29 / SVR)
Sophisticated software supply chain compromise by the Russian Foreign Intelligence Service (SVR), inserting the SUNBURST backdoor into updates of SolarWinds Orion software and compromising multiple federal agencies.
U.S. v. Yakubets & Turashev (Evil Corp / Dridex Banking Malware)
Leader and core administrator of Evil Corp charged with deploying Bugat/Dridex banking malware and ransomware, stealing dozens of millions of dollars from bank accounts of municipalities, school districts, and businesses.
U.S. v. Vachon-Desjardins (Netwalker Ransomware)
Affiliate of Netwalker ransomware responsible for attacking dozens of healthcare systems, universities, and businesses during the COVID-19 pandemic, extorting tens of millions of dollars.
U.S. v. Joshua Schulte (CIA Vault 7 Leak)
Former Central Intelligence Agency software developer convicted of the historic transmission of classified CIA cyber warfare tools, source code, and zero-day exploits (Vault 7) to WikiLeaks, causing catastrophic national security damage.
U.S. v. Alla Witte & Vladimir Dunaev (Trickbot Malware Group)
Key software developers and coders of the transnational Trickbot cybercrime group charged with infecting millions of victim computers with banking trojans and facilitating Conti/Ryuk ransomware deployments against hospitals.
U.S. v. Netyksho et al. (APT28 / GRU Unit 26165 DNC Hack)
Twelve Russian GRU military intelligence officers charged with hacking into the Democratic National Committee and Hillary Clinton presidential campaign servers, exfiltrating emails, and orchestrating strategic leaks via DCLeaks and Guccifer 2.0.
U.S. v. Tyler Barriss (Serial Swatting / Wichita Incident)
Perpetrator of dozens of fraudulent emergency 911 calls and bomb threats across the United States for hire, culminating in a fatal police shooting in Wichita, Kansas, over a Call of Duty video game dispute.
U.S. v. Elena Alekseevna Khusyaynova (Project Lakhta)
Russian chief accountant charged with managing the financial administration of Project Lakhta, a massive state-funded covert influence and cyber operation designed to sow political discord in U.S. elections.
U.S. v. Artem Radchenko (SEC EDGAR Insider Trading Hack)
Ukrainian cybercriminals who hacked into the SEC EDGAR corporate filing test system, exfiltrating non-public quarterly earnings reports for hundreds of publicly traded companies before their official release to generate $4.1 million in illegal insider trades.
U.S. v. Ross Ulbricht (Dread Pirate Roberts / Silk Road)
Historic trial and life sentencing of Ross William Ulbricht, creator and operator of Silk Road, the internet's first comprehensive darknet market using Tor and Bitcoin.
U.S. & International Action: Dmitry Badin (German Bundestag Hack)
Russian GRU military officer charged with the 2015 cyber intrusion into the German Federal Parliament (Bundestag), which compromised parliamentary IT infrastructure and exfiltrated thousands of emails from Chancellor Angela Merkel's office.
U.S. v. Aleksandr Sikerin & Yevgeniy Polyanin (REvil Operations)
International enforcement action against REvil ransomware money exchangers and operators, recovering $6.1 million in ransomware proceeds extorted from businesses and local governments across the United States.
MOVEit Transfer Mass Zero-Day Extortion Campaign
Mass cyber extortion campaign exploiting a zero-day SQL injection vulnerability (CVE-2023-34362) in Progress Software MOVEit Transfer appliances, exfiltrating personal records of over 90 million individuals across 2,700 organizations without encrypting files.
Viasat KA-SAT Satellite Modem Wiper Sabotage (AcidRain)
Russian state-sponsored operators exploited an unpatched Fortinet VPN gateway to access Viasat satellite network management segments, broadcasting malicious AcidRain wiper firmware that permanently bricked tens of thousands of satellite terminals across Ukraine and Europe.
Boeing Commercial Airplanes Parts Supply Extortion
LockBit ransomware affiliates exploited the Citrix Bleed zero-day (CVE-2023-4966) to bypass multi-factor authentication, exfiltrating 43 gigabytes of sensitive internal aerospace data and parts distribution documentation from Boeing parts and distribution business.
Log4Shell Ubiquitous Remote Code Execution Crisis (CVE-2021-44228)
Universal zero-day vulnerability in Apache Log4j (Log4Shell) where arbitrary JNDI lookup strings (${jndi:ldap://...}) processed by logger components permitted unauthenticated remote code execution, triggering mass scanning and exploitation across billions of enterprise cloud servers by nation-state actors and ransomware syndicates worldwide.
United States ex rel. Markus v. Aerojet Rocketdyne (Civil Cyber-Fraud Settlement)
Landmark Department of Justice Civil Cyber-Fraud Initiative settlement under the False Claims Act where defense contractor Aerojet Rocketdyne paid $9 million to resolve a qui tam whistleblower lawsuit alleging it falsely certified compliance with federal cybersecurity regulations (DFARS 252.204-7012 and NIST SP 800-171) on Department of Defense and NASA missile contracts.
U.S. v. Amin Stigal (GRU Unit 29155 WhisperGate Wiper)
Federal criminal indictment charging Russian military intelligence conspirator serving GRU Unit 29155 with unleashing the destructive WhisperGate master boot record wiper malware against Ukrainian civilian ministry systems on the eve of the 2022 invasion and conducting cyber reconnaissance against 26 NATO member state critical infrastructure networks.
FTC v. Global Tel*Link Corp. (Correctional S3 Bucket Leak)
Landmark Federal Trade Commission enforcement action against major correctional telecommunications vendor Global Tel*Link (GTL) for reckless data security practices that left an unencrypted Amazon S3 cloud repository containing 650,000 personal and biometric records exposed to the public internet for months.