Romanian national Daniel Christian Hulea has been sentenced to 20 years in prison for his role in the notorious NetWalker ransomware operation. Following his arrest in Cluj, Romania, and subsequent extradition to the United States, Hulea pleaded guilty to computer fraud and wire fraud conspiracy charges.

The NetWalker ransomware group, operational since 2019, targeted numerous critical institutions worldwide, including healthcare facilities, educational institutions, law enforcement agencies, and emergency services. The group notably exploited the COVID-19 pandemic to attack healthcare organizations.

Court documents reveal that Hulea and a co-conspirator acquired approximately 1,595 bitcoins (valued at $21.5 million) from ransomware victims. Along with his prison sentence, Hulea must pay nearly $15 million in restitution and forfeit $21.5 million in assets, including interests in an Indonesian company and a luxury resort in Bali.

This sentencing follows the 2022 conviction of Canadian NetWalker affiliate Sebastien Vachon-Desjardins, who also received a 20-year prison term for attacks resulting in tens of millions in damages.

NetWalker operated as a Ransomware-as-a-Service (RaaS) platform, offering affiliates 60-75% of ransom payments. The group collected an estimated $25 million in just five months during 2020. Their operations were significantly disrupted in 2021 when U.S. authorities seized their websites and payment infrastructure.

Recent security analysis suggests possible links between the defunct NetWalker operation and the emerging Alpha ransomware, indicating potential code reuse or rebranding by other cyber criminals.