Wazawaka

Threat Actor updated 5 months ago (2024-07-03T17:18:07.169Z)

Download STIX

Preview STIX

Wazawaka, identified by the FBI as Mikhail Matveev, is a significant threat actor in the cybercrime landscape. Known for his affiliations with multiple ransomware groups, including LockBit, throughout 2020 and 2021, he became a central figure in the Babuk ransomware-as-a-service gang. Matveev's operations have been vast, selling access to numerous organizations and operating his own ransomware affiliate programs. His personal mantra reflects a strong sense of national loyalty, advocating for local operations and relying on "Mother Russia" for protection. In January 2022, KrebsOnSecurity published an investigative piece that traced Wazawaka's many pseudonyms and contact details on Russian-language cybercrime forums back to Mikhail Matveev, a 31-year-old from Abaza, Russia. This identification was a significant step in understanding the individual behind Wazawaka's extensive cybercriminal activities. Despite this exposure, Wazawaka continued his operations, demonstrating a disregard for personal security similar to other top Russian access brokers. The U.S. authorities unsealed indictments against Matveev and another alleged LockBit affiliate, Mikhail Vasiliev, in May 2023. This indictment marked a critical turning point in the fight against these cybercriminals. The State Department’s Transnational Organized Crime Rewards Program has since issued a $10 million bounty for information leading to Matveev's arrest, reflecting the severity of his crimes and the U.S. government's commitment to combating such cyber threats.

Description last updated: 2024-07-03T17:15:30.453Z

What's your take? (Question 1 of 5)

Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.

Possible Aliases / Cluster overlaps

It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at. Create a free account to see the source evidence for each alias, and help fix any errors.

Alias Description	Votes
Mikhail Matveev is a possible alias for Wazawaka. Mikhail Matveev, also known by the aliases Wazawaka, m1x, Boriselcin, and Uhodiransomwar, is a prominent threat actor associated with significant cybercrime activities. His involvement in the cybercrime world was traced back to 2020 and 2021 when he was identified as an affiliate of LockBit, a notor	4
Boriselcin is a possible alias for Wazawaka. Mikhail Pavlovich Matveev, also known as Boriselcin, is a threat actor that has been implicated in significant cybercrime activities. Beginning at least as early as 2020, Matveev has been allegedly involved in deploying three ransomware variants: LockBit, Babuk, and Hive. These attacks targeted vari	4
Mikhail Pavlovich Matveev is a possible alias for Wazawaka. Mikhail Pavlovich Matveev, a Russian national also known by online monikers Wazawaka, m1x, Boriselcin, and Uhodiransomwar, has been identified as a major threat actor in the world of cybersecurity. Matveev is among five Russians charged in connection with Lockbit, a group widely recognized as one of	4
Uhodiransomwar is a possible alias for Wazawaka. Uhodiransomwar, also known as Mikhail Pavlovich Matveev, Wazawaka, m1x, and Boriselcin, is a significant threat actor in the cybersecurity landscape. A Russian national aged 30, Matveev has been implicated in a series of malicious cyber activities since at least 2020. He is alleged to have participa	3
M1x is a possible alias for Wazawaka. M1x, also known as Wazawaka, Boriselcin, and Uhodiransomwar, is a threat actor identified as Mikhail Pavlovich Matveev. This individual has been allegedly involved in malicious cyber activities since at least 2020. Matveev's primary mode of operation involves the deployment of ransomware, specifical	3
Hive Ransomware is a possible alias for Wazawaka. Hive ransomware, a prominent threat actor active in 2022, was known for its widespread malicious activities in numerous countries, including the US. The group's modus operandi involved the use of SharpRhino, which upon execution, established persistence and provided remote access to the attackers, e	2

Miscellaneous Associations

Other elements of context that could aid in the identification of relevance

Ransomware

Cybercrime

Ransom

Russia

Analyst Notes & Discussion

Be the first to leave your mark here! Log in to share your views and vote.

Associated Malware

To see the evidence that has resulted in these malware associations, create a free account

Alias Description	Association Type	Votes
The Lockbit Malware is associated with Wazawaka. LockBit is a malicious software, or malware, known for its damaging and exploitative functions. It infiltrates systems via dubious downloads, emails, or websites, often without the user's knowledge, and can steal personal information, disrupt operations, or hold data hostage for ransom. The LockBit	Unspecified	6
The Babuk Malware is associated with Wazawaka. Babuk is a form of malware, specifically ransomware, that infiltrates computer systems and encrypts files, rendering them inaccessible to the user. It typically infects systems through suspicious downloads, emails, or websites, often without the user's knowledge. Once inside, it can disrupt operatio	Unspecified	3
The Hive Malware is associated with Wazawaka. Hive is a form of malware, specifically ransomware, designed to exploit and damage computer systems. It infiltrates systems through suspicious downloads, emails, or websites, often without the user's knowledge. Once inside, Hive can steal personal information, disrupt operations, or hold data hostag	Unspecified	2

Associated Threat Actors

To see the evidence that has resulted in these threatActor associations, create a free account

Alias Description	Association Type	Votes
The Vasiliev Threat Actor is associated with Wazawaka. Mikhail Vasiliev, a dual Russian-Canadian national known by various online aliases such as "Ghostrider," was a key threat actor involved in the global LockBit ransomware campaign. Alongside fellow members like Ruslan Magomedovich Astamirov, and others including Sungatov, Kondratyev, and Mikhail Pavl	Unspecified	2
The threatActor Mikhail Pavolovich Matveev is associated with Wazawaka.	Unspecified	2

Source Document References

Information about the Wazawaka Threat Actor was read from the documents corpus below. This display is limited to 20 results, create a free account to see more

Source Link	CreatedAt	Title
Krebs on Security	5 months ago	The Not-So-Secret Network Access Broker x999xx
Krebs on Security	7 months ago	U.S. Charges Russian Man as Boss of LockBit Ransomware Group
BankInfoSecurity	7 months ago	LockBitSupp's Identity Revealed: Dmitry Yuryevich Khoroshev
Trend Micro	9 months ago	LockBit Attempts to Stay Afloat with a New Version
CERT-EU	9 months ago	LockBit affiliates arrested in Ukraine, Poland \| #hacking \| #cybersecurity \| #infosec \| #comptia \| #pentest \| #ransomware \| National Cyber Security Consulting
CERT-EU	9 months ago	Law enforcement leaves taunting post for cyber criminals after locking notorious ransomware gang out of their own website \| #hacking \| #cybersecurity \| #infosec \| #comptia \| #pentest \| #ransomware \| National Cyber Security Consulting
Krebs on Security	9 months ago	Feds Seize LockBit Ransomware Websites, Offer Decryption Tools, Troll Affiliates
CERT-EU	9 months ago	Feds Seize LockBit Ransomware Websites, Offer Decryption Tools, Troll Affiliates – GIXtools
CERT-EU	9 months ago	US indicts two Russian nationals in LockBit ransomware case \| #hacking \| #cybersecurity \| #infosec \| #comptia \| #pentest \| #ransomware \| National Cyber Security Consulting
CERT-EU	9 months ago	Police arrest LockBit ransomware members, release decryptor in global crackdown
CERT-EU	a year ago	District of New Jersey \| Russian National Charged with Ransomware Attacks Against Critical Infrastructure \| #ransomware \| #cybercrime \| National Cyber Security Consulting
CSO Online	2 years ago	Russian national indicted for ransomware attacks against the US
CERT-EU	a year ago	One of the FBI's Most Wanted Hackers Is Trolling the US Government \| #hacking \| #cybersecurity \| #infosec \| #comptia \| #pentest \| #hacker \| National Cyber Security Consulting
CERT-EU	2 years ago	Alleged Babuk Ransomware ‘Wazawaka’ Hacker Indicted in US \| #hacking \| #cybersecurity \| #infosec \| #comptia \| #pentest \| #ransomware – National Cyber Security Consulting
CERT-EU	a year ago	Infamous Russian hacker mocks the FBI by selling t-shirts featuring his most wanted poster
CERT-EU	2 years ago	Who wants to be a millionaire by giving a tip to FBI about this hacker?
Flashpoint	a year ago	COURT DOC: Russian National Arrested and Charged with Conspiring to Commit LockBit Ransomware Attacks Against U.S. and Foreign Businesses
CERT-EU	a year ago	FBI Most-Wanted Russian Hacker Reveals Why He Burned His Passport \| #hacking \| #cybersecurity \| #infosec \| #comptia \| #pentest \| #hacker \| National Cyber Security Consulting
CERT-EU	2 years ago	Russian national charged with ransomware attacks against critical infrastructure
BankInfoSecurity	2 years ago	RA Group Using Babuk Ransomware Source Code in Fresh Attacks