iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The U.S. charged Ukrainian national Yaroslav Vasinskyi in 2021, alleging that he and co-conspirators used REvil ransomware in the July 2 Kaseya attack. The case later went beyond an allegation: Vasinskyi pleaded guilty in 2022 and was sentenced in 2024 to 13 years and seven months in prison, with more than $16 million in restitution, according to Reuters’ report of the Justice Department’s announcement.
What DOJ alleged about the Kaseya attack
On November 8, 2021, the U.S. Department of Justice (DOJ) announced that an indictment charged Vasinskyi with ransomware attacks against multiple victims, including the July 2021 attack on Kaseya. DOJ alleged that he and co-conspirators used Sodinokibi, also known as REvil. The indictment had been filed under seal on August 11, 2021, in the Northern District of Texas, according to DOJ’s later account.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
FixMeStick Gold Computer Virus Removal Stick for Windows PCs - Unlimited Use on Up to 3 Laptops or... | $114.41 | Buy on Amazon |
DOJ described the alleged Kaseya attack as a supply-chain-style incident: malicious REvil code was deployed through a Kaseya product, whose production functionality then pushed ransomware to endpoints on Kaseya customer networks. DOJ said the ransomware encrypted data. Its account is an allegation and description in the prosecution record, not an independent technical analysis of the incident.
Recommended Free Tools
According to DOJ, ransom notes directed victims to Tor or a public website, where they received a demand and a virtual-currency address. DOJ said the alleged operators provided decryption keys to victims who paid and threatened to expose or sell data when victims did not.
#1 Best Overall
- Booting from FixMeStick may be challenging or impossible on certain PC models and configurations due to variations in BIOS/UEFI settings and hardware. Before purchasing, please review the list of incompatible devices below. If you encounter any difficulties, our technical support team is available to assist with troubleshooting and resolving these issues. Incompatible devices: Tablets, Smartphones, Microsoft Surface, Chromebooks, HP ENVY, Acer Aspire, Dell Precision.
What charges were filed, and what did the case become?
The 2021 indictment charged Vasinskyi with conspiracy to commit computer fraud and related activity, damage to protected computers, and conspiracy to commit money laundering. At the time, DOJ said the statutory maximum could be 115 years if he were convicted on all counts. That was a maximum possible penalty stated at the charging stage, not the sentence ultimately imposed.
DOJ’s original release emphasized that an indictment is an allegation and defendants are presumed innocent unless proven guilty beyond a reasonable doubt. The case later advanced through court proceedings: the district court accepted Vasinskyi’s guilty plea on August 23, 2022, and adjudged him guilty on the listed counts, including conspiracy to commit fraud and related activity in connection with computers, intentional damage to a protected computer, and conspiracy to commit money laundering.
Reuters reported on May 1, 2024, that DOJ announced Vasinskyi had been sentenced to 13 years and seven months in prison and ordered to pay more than $16 million in restitution. Reuters also reported DOJ’s figures for Vasinskyi’s broader activity: more than 2,500 ransomware attacks and more than $700 million in ransom demands. Those totals are not Kaseya-only figures.
Vasinskyi case timeline
- August 11, 2021: The indictment was filed under seal in the Northern District of Texas, according to DOJ’s later account.
- October 8, 2021: DOJ said Vasinskyi was taken into custody in Poland.
- November 8, 2021: DOJ announced that the indictment had been unsealed and described the charges.
- March 3, 2022: DOJ said Vasinskyi arrived in Dallas after extradition from Poland. On March 9, he made an initial appearance and was arraigned in the Northern District of Texas.
- August 23, 2022: The district court accepted his guilty plea and adjudged him guilty on the listed counts.
- May 1, 2024: Reuters reported DOJ’s announcement of his sentence and restitution order.
What the headline-era figures do—and do not—mean
Several dollar and scale figures associated with the DOJ announcements refer to different defendants or broader activity. They should not be read as Kaseya-specific losses, payments, or victim counts.
| Figure | Scope and attribution |
|---|---|
| About 175,000 computers worldwide | Attorney General Merrick B. Garland’s 2021 estimate of REvil deployment overall, not the Kaseya incident alone. |
| At least $200 million in ransom paid | Garland’s 2021 figure for REvil overall, not ransom paid in the Kaseya incident. |
| More than 2,500 attacks and more than $700 million in demands | DOJ figures for Vasinskyi’s broader activity reported by Reuters in 2024; not Kaseya-only totals. |
| $6.1 million seized | DOJ’s 2021 announcement concerned funds alleged to be traceable to ransom proceeds received by Russian national Yevgeniy Polyanin in a separate case. It was not a seizure from Vasinskyi or a Kaseya-specific recovery. |
The figures describe distinct scopes: REvil-wide ransom paid, Vasinskyi’s broader attack and demand totals, and a separate seizure tied to Polyanin. They are not competing estimates of the same Kaseya event.
Why the $6.1 million seizure was reported alongside the charge
DOJ’s November 2021 announcement covered two defendants. Vasinskyi was the Ukrainian national charged in connection with the Kaseya attack. Polyanin, a Russian national charged in a separate indictment, was associated with the announced $6.1 million seizure. DOJ said those funds were alleged to be traceable to ransom payments Polyanin received from attacks that included Texas victims dating to 2019. The seizure should not be attributed to Vasinskyi or treated as money recovered from the Kaseya attack.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
