# Mikhail Pavlovich Matveev

Also known as: Wazawaka, m1x, Boriselcin, Uhodiransomwar

Charged

Public record reviewed to August 20, 2026

Index entry last updated August 21, 2026

_Alleged_ ransomware affiliate associated with LockBit, Babuk, and Hive.

Every charge in this entry is an allegation. No conviction is recorded.

- US-indicted ransomware affiliate associated with LockBit, Babuk, and Hive.
- Reportedly charged in Russia in late 2024; that report rests substantially on Russian media and is not independently confirmed.

Everything on this page comes from cited public sources.

This entry records 2 actions across 1 takedown, each traced to a cited source. Every linked takedown sits in the verified core of this index. Where the record is silent, this page says so rather than filling the gap.

Legal summary

**Associated takedowns:** [Operation Cronos wave 1](https://takedownindex.org/takedowns/operation-cronos-wave-1)

**Recorded role:** Ransomware affiliate associated with LockBit, Babuk, and Hive

**Group segment:** Affiliate

**Charging authority:** United States Department of Justice

**Charging jurisdiction:** United States

**Case number:** Not published

**Latest recorded action:** Charged, May 2023

**Nationality:** Russia

**Country of residence:** Russia

- [Associated takedowns](https://takedownindex.org/people/mikhail-pavlovich-matveev)
- [Legal history](https://takedownindex.org/people/mikhail-pavlovich-matveev/legal-history)
- [Charges](https://takedownindex.org/people/mikhail-pavlovich-matveev/charges)
- [Sources](https://takedownindex.org/people/mikhail-pavlovich-matveev/sources)

## Legal history

Every step recorded in the public legal record for this person, in the order it happened.

These entries describe procedure only. Nothing here establishes guilt, and a charge remains an allegation until a court rules.

1. May 16, 2023

2. Date not established

Sequence note. 1 action carries no date in the public record. It is listed last, out of sequence, because the date was never published.

Record note. Dates follow the earliest official announcement of each step. Where proceedings were subject to reporting restrictions, this entry records only what was published.