Skip to main content
Back to the takedown index

NetWalker ransomware disruption

January 2021, Ransomware
Led by Federal Bureau of Investigation

Verified core entry, last reviewed August 21, 2026

What was taken down?

Dark-web victim communication and leak resources seized and taken offline; approximately 454,530 USD in cryptocurrency seized.[1][2]

See what happened

What happened to the people?

Officials reported 1 charged, 1 apprehended, and 1 convicted.
1 charged named in the public record.
Group accounted for: Partial

See people and accountability

Did it stay down?

Not established in the public record. No later activity is recorded against this entry.

See what happened afterward

US and Bulgarian authorities disabled the NetWalker dark-web resource used to communicate with victims, alongside charges against a prolific affiliate.[1][2]

Announced January 27, 2021.

Date
January 2021
Target
NetWalker, ransomware as a service
Activity
Ransomware
Operational lead
FBI
Partners
USAO-MDFL, GDBOP[1]
Jurisdiction
United States, Bulgaria, and Canada
Outcome
Dark-web victim communication and leak resources seized and taken offline; approximately 454,530 USD in cryptocurrency seized.
Status
Completed
Legal mechanism
US criminal complaint and seizure warrants (Middle District of Florida); Bulgarian judicial action
Group accounted for
Partial

Infrastructure

Onion services seized and cryptocurrency wallets seized, with no count in the record.

Identifier Recorded as Status Notes
Not published Onion service Seized, Bulgaria Dark-web resources used for victim communication and data leaks, seized with Bulgarian assistance.[1]
Not published Cryptocurrency wallet Seized, United States Approximately 454,530 USD in cryptocurrency seized.[1]

Domains and onion addresses are shown defanged. Where the record gives a count but no identifier, the count is shown in place of one. This list carries only what appears in the cited sources.

1
charged

Named in the public record: 1 charged.

Figures count individuals named in charging documents and official statements, each person once per outcome. People alleged to be involved but not publicly identified are not counted.

Reported and named. Officials reported 1 charged, 1 apprehended, and 1 convicted. 1 charged named in the public record. The two figures come from different places and are never added together. Officials publish a headline total, and this index counts only the individuals it can name from the cited record.
Person Role Current public status
NetWalker affiliate ChargedSentenced
Charging authority
United States Attorney's Office for the Middle District of Florida
Main charges
Conspiracy to commit computer fraud; Conspiracy to commit wire fraud; Intentional damage to a protected computer; Transmitting a demand in relation to damaging a protected computer
Case number
Not established in the public record
Arresting authority
Not established in the public record
Arrest location
Not established in the public record
Extradition status
Not established in the public record
Conviction or plea
Not established in the public record
Sentence
Approximately seven years imprisonment in Canada
Segment
Affiliate
Sources
[1]
Full record
Everything indexed for Sebastien Vachon-Desjardins

Sebastien Vachon-Desjardins

NetWalker affiliate. Current public status: Charged and Sentenced.

Charging authority
United States Attorney's Office for the Middle District of Florida
Main charges
Conspiracy to commit computer fraud; Conspiracy to commit wire fraud; Intentional damage to a protected computer; Transmitting a demand in relation to damaging a protected computer
Case number
Not established in the public record
Arresting authority
Not established in the public record
Arrest location
Not established in the public record
Extradition status
Not established in the public record
Conviction or plea
Not established in the public record
Sentence
Approximately seven years imprisonment in Canada
Segment
Affiliate
Sources
[1]
Full record
Everything indexed for Sebastien Vachon-Desjardins

Rows expand to show charging authority, case identifiers, custody status, and sources.

Group accounted for: Partial

Only an affiliate was charged and convicted. The core developer group was never identified or apprehended.

Core developers were never publicly identified; the charged individual was an affiliate rather than a core operator.

See the organizations and roles behind this action

Sebastien Vachon-Desjardins convicted and sentenced in Canada and later in the United States.[1][2]

Not established in the public record. No later activity is recorded against this entry.

Return class G. The class is a research grading carried in the source dataset and its scale is not published, so this page relies on the relationship and confidence values instead. How this index handles it.

Numbered markers throughout this entry link to the source that supports the claim beside them.

Official sources

  1. [1]
    Department of Justice Launches Global Action Against NetWalker Ransomware

    United States Department of Justice, January 27, 2021, Source grade P1

    Seizure of dark-web resources with Bulgarian assistance, charges against Vachon-Desjardins, cryptocurrency seizure

    No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

  2. [2]
    Europol statement on the NetWalker action

    Europol, January 27, 2021, Source grade P2

    Bulgarian role and international coordination

    No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

Coverage note. Vachon-Desjardins is recorded with group_segment affiliate, not core_operator. This distinction matters for the completeness assessment.