Yevgeniy Igorevich Polyanin

Polyanin is believed to be in Russia, possibly in Barnaul, and is one of many Sodinokibi/REvil ransomware affiliates.

Yevgeniy Igorevich Polyanin is wanted for his alleged involvement in ransomware attacks and money laundering activities.  It is alleged that, through the use and deployment of Sodinokibi and REvil ransomware, Polyanin left electronic notes in the form of a text file on victims’ computers.  The notes included web addresses for the victims to visit and have their files decrypted.  Upon visiting these web addresses, victims were given the ransom amount demanded and provided a virtual currency address to use to pay the ransom.  If a victim paid the ransom amount, Polyanin provided the decryption key, and the victims then were able to access their files.  If a victim did not pay the ransom, Polyanin typically posted the victims’ exfiltrated data or claimed he sold the exfiltrated data to third parties.  Polyanin has been charged in an indictment filed in the United States District Court for the Northern District of Texas, Dallas, Texas, with conspiracy to commit fraud and related activity in connection with computers, substantive counts of intentional damage to protected computers, and conspiracy to commit money laundering.