The Justice Department has charged a Russian citizen with conspiring to destroy Ukrainian government computer systems as part of a widespread hacking effort by Russia ahead of its illegal invasion of Ukraine.
U.S. prosecutors in Maryland said Wednesday that Amin Stigal, 22, is wanted for helping set up servers used by Russian government hackers that were used to launch devastating cyberattacks on Ukrainian ministries in January 2022, a month before the Kremlin order tanks and troops to cross Ukraine’s border.
The cyberattack campaign, known as “WhisperGate,” was based on so-called wiper malware that masqueraded as ransomware but deliberately and irrevocably scrambled data on infected devices. Prosecutors said the cyberattacks were designed to “sow anxiety” in Ukrainian civil society about the security of their government’s systems.
Stigall is also accused of helping hackers working for Russia’s military intelligence unit — known as the GRU — target allies of Ukraine, including the United States, according to the indictment against Stigall that was unsealed Wednesday.
According to the unsealed indictment, Stigal allegedly used cryptocurrencies to pay for and set up servers from an unnamed US-based company that allowed Russian GRU hackers to launch their cyberattacks targeting the Ukrainian government with the malware which destroys data.
Russian hackers stole reams of data during the cyberattacks, including citizens’ health data, criminal records and auto insurance data from Ukrainian government systems, the indictment alleges. The hackers later advertised the data for sale on well-known cybercrime forums.
U.S. prosecutors say Russian hackers also targeted an unnamed U.S. government agency based in Maryland dozens of times between 2021 and 2022 before the hack, allowing district attorneys to take jurisdiction over the case and seek to indict Stigall.
Later, in October 2022, Russian hackers used the same servers created by Stigal to target the transport sector of an unnamed Central European country, which US prosecutors say provided civilian and military aid to Ukraine after the invasion . The incident fits its timing a cyber attack in October 2022 in Denmarkwhich caused massive disruptions and delays across the country’s rail network at the time.
said the US government is offering $10 million for information leading to the identification or capture of Stigall, who remains at large and is believed to be in Russia.
Stigall faces up to five years in prison if convicted.
