Russian police arrest former member of LockBit and Hive

Does the indictment of "Wazawaka" signal a shift in the Kremlin's stance on Russian cybercriminals?

On November 29, 2024, the Russian news agency RIA Novosti reported that authorities had arrested and indicted Mikhail Matveev, a cybercriminal better known by the alias “Wazawaka.” A Russian citizen and former member of the ransomware gangs LockBit and Hive, he faces charges of “computer hacking.”

A cybersecurity researcher using the pseudonym “club1337” contacted Wazawaka, who allegedly confirmed the arrest. According to the researcher, Russian authorities seized a significant amount of cryptocurrency from Matveev and imposed two fines on him. “He is currently out on bail, unharmed, and awaiting the next steps in the judicial process,” club1337 added.

Mikhail Matveev had previously boasted about his safety in Russia. “Being sanctioned [by the West] means Russia won’t extradite me,” he declared in a video posted on social media. Indeed, the Kremlin traditionally refrains from targeting Russian cybercriminals as long as they avoid attacking friendly nations.

This arrest, along with other recent legal actions, may hint at a shift in this doctrine. On December 2, 2024, a Russian court sentenced the former head of Hydra, a darknet platform for selling illegal goods, including narcotics, to life imprisonment.