“I want to be very clear: In our mind, this is not related to what is happening with Russia and Ukraine,” the official added.
The DarkSide hacking group, another ransomware gang suspected of being based in Russia, was linked to the attack on Colonial Pipeline. The attack, and an ensuing panic among consumers, led to gas shortages in several U.S. states amid a temporary shutdown of the pipeline.
The arrests followed months of negotiations between the Biden administration and Russian officials around the ransomware attack and other cybersecurity concerns, and the FSB said Friday that its actions were tied to “the appeal of competent U.S. authorities.” These efforts included a meeting between President Joe Biden and Russian President Vladimir Putin last year in Geneva and follow up conversations by phone.
The arrests took place the same day hackers defaced and disabled dozens of Ukrainian government websites, with experts suspecting Russia to be behind the attack.
The administration official stressed that while the arrests were “welcome,” they drew a clear line in the sand between the administration’s view of the actions in Russia and the Ukrainian website defacements.
The individuals arrested will remain in Russia, rather than being extradited to the United States. The administration will be watching next steps there closely, the senior official said.
“Our expectation is that Russia announced arrests and that Russia would be pursuing legal action within its own justice systems,” the official said, adding that it is “our expectation that they be brought to justice.”