NetWalker — Ransomware Profile
NetWalker was a ransomware-as-a-service operation first seen in August 2019, initially tracked as Mailto because early builds appended that string to encrypted files; Palo Alto Networks Unit 42 attributes its creation to a group dubbed Circus Spider, assessed but never confirmed to be Russian in origin. From March 2020 the operators shifted to a ransomware-as-a-service model and began recruiting affiliates, and a July 2020 FBI flash alert warned that the crew was compromising government bodies in the US and abroad, schools, companies, and health agencies, leaning on COVID-19-themed phishing lures while the healthcare sector was under pandemic strain. Notable victims included the University of California San Francisco, which, per the HIPAA Journal, paid a ransom of about 1.14 million dollars. The operation ended in January 2021 when the US Department of Justice and Bulgarian authorities seized its dark-web payment and leak infrastructure and charged Canadian affiliate Sebastien Vachon-Desjardins, who was later extradited and sentenced to 20 years in a US prison. The operation is considered defunct.Also tracked as
Mailto, Circus Spider
Vendor research
- Ransomware Threat Assessment: NetWalker Palo Alto Networks Unit 42
- NetWalker ransomware dark web sites seized by law enforcement BleepingComputer
- Arrest, Seizures Tied to Netwalker Ransomware KrebsOnSecurity
- NetWalker affiliate sentenced to 20 years in prison The Record