Accused ‘NetWalker’ Ransomware Hacker Agrees to Plead Guilty

Jeff Stone, Bloomberg News

Red light illuminates the keys of a laptop computer. Photographer: Andrey Rudakov/Bloomberg , Photographer: Andrey Rudakov/Bloomberg

(Bloomberg) -- A former Canadian government employee has agreed to plead guilty in the US to charges that he worked for a ransomware gang that researchers say has reaped almost $50 million in illegal payments during the past two years.

Sebastien Vachon-Desjardins has agreed to plead guilty to hacking-related charges, according to court documents filed Tuesday in federal court in Tampa. He was accused of working as part of a digital extortion group known as NetWalker.

The ransomware gang has targeted US hospitals, law enforcement organizations, schools, colleges and universities, according to the FBI. The blockchain-analysis firm Chainalysis Inc. has determined that victims have paid $46 million in extortion fees to the NetWalker hackers since 2020. NetWalker has been among the most active ransomware gangs since it emerged two years ago, researchers determined, and the group has been particularly focused on health-care providers during the Covid-19 pandemic.

The US Justice Department announced in March that Vachon-Desjardins, of Gatineau, Quebec, had been extradited to Florida from Canada. The US government also seized the equivalent of $28 million in Bitcoin from Vachon-Desjardins at the time he was extradited.

The NetWalker gang offers ransomware-as-a-service, meaning it leases its malware to “affiliates” for a cut of the illegal proceeds. Vachon-Desjardins was described by the DOJ as an affiliate and accused of converting Bitcoin stolen from ransomware victims into Canadian currency. But the full extent of his alleged involvement in cyberattacks isn’t immediately clear.

The defendant previously worked for the department of Public Services and Procurement Canada, an agency that works on real estate for the federal government, according to CBC News.

The case represents a rare example of an alleged ransomware hacker facing charges in a US courtroom. While many suspected hackers operate from Russia – outside the reach of US law enforcement – authorities say Vachon-Desjardins conducted much of his illicit activity from Canada.

In his plea deal, the defendant also agreed to cooperate with US prosecutors as part of any connected investigations.

Vachon-Desjardins faces as many as 40 years in prison under the terms of the agreement. The deal is subject to a court’s approval.

An attorney for the defendant didn’t immediately respond to a request for comment Tuesday.

The case is U.S. v. Vachon-Desjardins, 20-cr-00366, U.S. District Court, Middle District of Florida.