[Back to the takedown index](https://takedownindex.org/takedowns) # NetWalker ransomware disruption January 2021, Ransomware Led by [Federal Bureau of Investigation](https://takedownindex.org/organizations/federal-bureau-of-investigation) Verified core entry, last reviewed August 21, 2026 What was taken down? Dark-web victim communication and leak resources seized and taken offline; approximately 454,530 USD in cryptocurrency seized.[[1]](#source-1)[[2]](#source-2) [See what happened](#what-happened) What happened to the people? Officials reported 1 charged, 1 apprehended, and 1 convicted. 1 charged named in the public record. Group accounted for: Partial [See people and accountability](#people) Did it stay down? Not established in the public record. No later activity is recorded against this entry. [See what happened afterward](#afterward) ## What happened US and Bulgarian authorities disabled the NetWalker dark-web resource used to communicate with victims, alongside charges against a prolific affiliate.[[1]](#source-1)[[2]](#source-2) Announced January 27, 2021. **Date:** January 2021 **Target:** NetWalker, ransomware as a service **Activity:** Ransomware **Operational lead:** FBI **Partners** USAO-MDFL, GDBOP[[1]](#source-1) - [United States Attorney's Office for the Middle District of Florida](https://takedownindex.org/organizations/united-states-attorney-s-office-for-the-middle-district-of-florida), charging - [General Directorate Combating Organized Crime, Bulgaria](https://takedownindex.org/organizations/general-directorate-combating-organized-crime-bulgaria), infrastructure seizure **Jurisdiction:** United States, Bulgaria, and Canada **Outcome:** Dark-web victim communication and leak resources seized and taken offline; approximately 454,530 USD in cryptocurrency seized. **Status:** Completed **Legal mechanism:** US criminal complaint and seizure warrants (Middle District of Florida); Bulgarian judicial action **Group accounted for:** Partial ### Infrastructure Onion services seized and cryptocurrency wallets seized, with no count in the record. | Identifier | Recorded as | Status | Notes | | --- | --- | --- | --- | | Not published | Onion service | Seized, Bulgaria | Dark-web resources used for victim communication and data leaks, seized with Bulgarian assistance.[[1]](#source-1) | | Not published | Cryptocurrency wallet | Seized, United States | Approximately 454,530 USD in cryptocurrency seized.[[1]](#source-1) | Domains and onion addresses are shown defanged. Where the record gives a count but no identifier, the count is shown in place of one. This list carries only what appears in the cited sources. ## People and accountability Named in the public record: 1 charged. Figures count individuals named in charging documents and official statements, each person once per outcome. People alleged to be involved but not publicly identified are not counted. Reported and named. Officials reported 1 charged, 1 apprehended, and 1 convicted. 1 charged named in the public record. The two figures come from different places and are never added together. Officials publish a headline total, and this index counts only the individuals it can name from the cited record. #### Sebastien Vachon-Desjardins NetWalker affiliate. Current public status: Charged and Sentenced. **Charging authority:** United States Attorney's Office for the Middle District of Florida **Main charges:** Conspiracy to commit computer fraud; Conspiracy to commit wire fraud; Intentional damage to a protected computer; Transmitting a demand in relation to damaging a protected computer **Case number:** Not established in the public record **Arresting authority:** Not established in the public record **Arrest location:** Not established in the public record **Extradition status:** Not established in the public record **Conviction or plea:** Not established in the public record **Sentence:** Approximately seven years imprisonment in Canada **Segment:** Affiliate **Sources:** [[1]](#source-1) **Full record:** [Everything indexed for Sebastien Vachon-Desjardins](https://takedownindex.org/people/sebastien-vachon-desjardins) Group accounted for: Partial Only an affiliate was charged and convicted. The core developer group was never identified or apprehended. Core developers were never publicly identified; the charged individual was an affiliate rather than a core operator. [See the organizations and roles behind this action](https://takedownindex.org/takedowns/netwalker-ransomware-disruption/organizations) ## What happened afterward Sebastien Vachon-Desjardins convicted and sentenced in Canada and later in the United States.[[1]](#source-1)[[2]](#source-2) Not established in the public record. No later activity is recorded against this entry. Return class G. The class is a research grading carried in the source dataset and its scale is not published, so this page relies on the relationship and confidence values instead. [How this index handles it](https://takedownindex.org/about). ## Sources Numbered markers throughout this entry link to the source that supports the claim beside them. ### Official sources 1. [Department of Justice Launches Global Action Against NetWalker Ransomware](https://takedownindex.org/sources/united-states-department-of-justice-department-of-justice-launches-global-action) United States Department of Justice, January 27, 2021, Source grade P1 Seizure of dark-web resources with Bulgarian assistance, charges against Vachon-Desjardins, cryptocurrency seizure No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher. 2. [Europol statement on the NetWalker action](https://takedownindex.org/sources/europol-europol-statement-on-the-netwalker-action) Europol, January 27, 2021, Source grade P2 Bulgarian role and international coordination No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher. Coverage note. Vachon-Desjardins is recorded with group\_segment affiliate, not core\_operator. This distinction matters for the completeness assessment. Research context ## How this entry was checked This entry went through a dedicated source verification pass. Publisher, title, publication date, and docket numbers were confirmed against each cited source. Source review: Verified core Sources cited: 2 Research cutoff: August 20, 2026 Last reviewed August 21, 2026 See also [About the Internet Takedown Index](https://takedownindex.org/about) Related entries - [CityXGuide seizure](https://takedownindex.org/takedowns/cityxguide-seizure) - [WeLeakInfo seizure](https://takedownindex.org/takedowns/weleakinfo-seizure) - [Cyclops Blink disruption](https://takedownindex.org/takedowns/cyclops-blink-disruption) Report updates or corrections Help keep this record accurate. [Submit feedback](https://takedownindex.org/about#corrections-and-updates)