Year: 2017
Court filings and enforcement actions initiated or unsealed during calendar year 2017.
Key Facts
- 7 major cases opened or unsealed in 2017.
- Cumulative losses identified for 2017 matters exceed $5.0 billion.
- Documented from federal indictments and official government disclosures.
Documented Matters for 2017
U.S. v. Baratov et al. (Yahoo 2014 Breach / FSB Officers)
Conspiracy between Russian Federal Security Service (FSB) officers and criminal hackers to breach Yahoo's network, compromising 500 million user accounts to conduct espionage against journalists, government officials, and commercial executives.
U.S. v. Joshua Schulte (CIA Vault 7 Leak)
Former Central Intelligence Agency software developer convicted of the historic transmission of classified CIA cyber warfare tools, source code, and zero-day exploits (Vault 7) to WikiLeaks, causing catastrophic national security damage.
U.S. v. Marcus Hutchins (Kronos Banking Malware)
British malware researcher who previously halted the global WannaCry ransomware outbreak charged with authoring the Kronos banking trojan and UPAS kit years earlier as a teenager.
U.S. v. Peter Levashov (Kelihos Botnet)
Russian operator (Severa) of the notorious Kelihos botnet, controlling over 100,000 infected computers worldwide used to harvest credentials, distribute ransomware, and blast billions of spam and stock pump-and-dump emails daily.
WannaCry Global Self-Propagating Ransomware Worm
Global automated ransomware worm that weaponized the leaked NSA EternalBlue exploit (MS17-010) to self-propagate across 200,000 Windows computers in over 150 countries within hours, paralyzing 80 National Health Service (NHS) hospital trusts in the UK.
U.S. v. Gal Vallerius (Dream Market OxyMonster Administrator)
Federal prosecution of French cybercriminal Gal Vallerius (known as OxyMonster), senior administrator and escrow vendor for Dream Market darknet marketplace, arrested at Atlanta Hartsfield-Jackson airport while traveling to the World Beard Championships and sentenced to 20 years in federal prison.
TRITON / HatMan Petrochemical Safety Instrumented System Attack
Russian state research institute (Central Scientific Research Institute of Chemistry and Mechanics / TsNIIKhM) deployed the TRITON (HatMan) malware framework inside a Saudi Arabian petrochemical plant, directly manipulating Schneider Electric Triconex Safety Instrumented System (SIS) controllers to cause emergency plant shutdowns with the potential for physical explosion.