[Back to NetWalker ransomware disruption](https://takedownindex.org/takedowns/netwalker-ransomware-disruption)

# Organizations and roles

January 2021, Ransomware
[NetWalker ransomware disruption](https://takedownindex.org/takedowns/netwalker-ransomware-disruption)

Last reviewed August 21, 2026

The public record puts 3 organizations on this action. Operational lead: FBI. The table lists the role the cited record assigns each one, in the record's own wording where it gives any.

## Why this page names organizations only

Roles on this page describe the agencies that took part. Individuals named in the public record appear on the takedown entry itself, under People and accountability.

## Organizations and roles

| Emblem | Organization | Role | What the record says |
| --- | --- | --- | --- |
| | [Federal Bureau of Investigation](https://takedownindex.org/organizations/federal-bureau-of-investigation), United States | Operational lead | Led the investigation and the seizure of the dark-web resources. |
| | [United States Attorney's Office for the Middle District of Florida](https://takedownindex.org/organizations/united-states-attorney-s-office-for-the-middle-district-of-florida), United States | Charging | Filed charges against Sebastien Vachon-Desjardins. |
| | [General Directorate Combating Organized Crime, Bulgaria](https://takedownindex.org/organizations/general-directorate-combating-organized-crime-bulgaria), Bulgaria | Infrastructure seizure | Executed the seizure of Bulgaria-hosted dark-web infrastructure. |

## Accountability

### Legal authority

US criminal complaint and seizure warrants (Middle District of Florida); Bulgarian judicial action

### Ongoing investigation

Group accounted for: Partial. Only an affiliate was charged and convicted. The core developer group was never identified or apprehended.

This page records organizational involvement as the cited sources state it. Where a role carries no description, the record gives none.

Last reviewed August 21, 2026