Loading story…
Belarusian national Maksim Silnikau was sentenced in federal court in Alexandria, Virginia, to 16 years in prison for creating and operating the Ransom Cartel ransomware-as-a-service operation. U.S. prosecutors said Silnikau launched the scheme in May 2021, later rebranding it as Ransom Cartel, and recruited affiliates through underground Russian-language forums while seeking access to non-CIS corporate networks. He allegedly supplied stolen credentials, encryption tools, and a hidden management panel, and coordinated attacks and ransom negotiations through infrastructure he controlled.
Authorities said Ransom Cartel affiliates attacked at least 18 companies in the United States and abroad between 2021 and 2023, stealing corporate data and attempting to extort at least $5.2 million, with known victim losses exceeding $6.7 million. Prosecutors also said Silnikau worked with initial access brokers and laundered ransom proceeds through cryptocurrency mixers. He was arrested in Spain in 2023, briefly fled while awaiting extradition, was later captured near the Poland-Belarus border, and extradited to the United States; a separate federal case in New Jersey tied to the Angler Exploit Kit and co-defendants Volodymyr Kadariya and Andrei Tarasov remains pending.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
14 events from the most recent confirmed update back to the earliest known activity.
On August 5, a federal judge in Alexandria, Virginia, sentenced Maksim Silnikau to 16 years in prison for conspiracy offenses tied to creating and operating Ransom Cartel. The Justice Department said the group attacked at least 18 companies between 2021 and 2023 and caused more than $6.7 million in known victim losses.
After being extradited from Poland, Maksim Silnikau made his initial appearance in Newark, New Jersey to face cybercrime charges in New Jersey and Virginia. The Justice Department said the cases covered both the long-running malvertising scheme and the Ransom Cartel ransomware operation.
After fleeing while awaiting extradition and later being apprehended near the Poland-Belarus border, Silnikau was extradited from Poland to the United States in August 2024. He was sent to face prosecution in the Eastern District of Virginia.
The indictment against Silnikau was unsealed in 2024, making details of the Ransom Cartel case public. The filing described the operation's origins, advertising, and affiliate structure.
One source notes that Yaroslav Vasinskyi received a sentence of 13 years and seven months in 2024 for more than 2,500 REvil attacks and over $700 million in ransom demands. The reference uses this as a comparison point for Silnikau's sentence.
Silnikau was arrested in Spain on July 18, 2023, as part of an international law enforcement operation. Prosecutors later said the arrest stalled Ransom Cartel's growth.
The indictment in the Virginia case was returned in June 2023. It charged Silnikau's role in creating and operating the Ransom Cartel ransomware-as-a-service scheme.
In May 2023, Ransom Cartel attacked infrastructure used by a group of law firms. The disruptions lasted from several days to multiple months, and two firms paid ransoms of $125,000 and $300,000 after prolonged outages.
The last charged act in the conspiracy occurred on April 25, 2023, when Silnikau negotiated terms for supplying computers to be locked. This marked the latest specific act cited in the indictment.
In an October 2022 report, Unit 42 assessed that Ransom Cartel likely had access to older versions of REvil source code based on substantial overlaps in malware configuration, encryption workflow, ransom notes, and file footer format. The report also documented the group's tactics, including use of compromised credentials, credential theft tools, and encryption of Windows and Linux ESXi systems.
In August 2022, a Ransom Cartel attack disrupted a medical technology startup developing robotic surgical technology for two months. The incident was cited by prosecutors as part of the group's victim impact.
Prosecutors said the operation was renamed Ransom Cartel in late 2021, and one source states it launched publicly in December 2021. Researchers later noted code similarities with REvil.
An indictment preserved a May 4, 2021 advertisement on a Russian-language cybercrime forum seeking access to corporate networks outside the CIS. The post set victim-size criteria and said access prices started at $100.
Court documents said Maksim Silnikau began developing the ransomware operation in May 2021, initially under another name. Prosecutors said he recruited affiliates and built the service around ransomware tooling and stolen access.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
14 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcecyberveille.ch
Open sourcecyberscoop.com
Open sourcesecurityaffairs.com
Open sourcebleepingcomputer.com
Open sourcejustice.gov
Open sourcejustice.gov
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The United States sentenced **Yaroslav Vasinskyi** (`Rabotnik`), a Ukrainian affiliate of the **Sodinokibi/REvil** ransomware operation, to **13 years and 7 months** in prison for his role in more than **2,500 attacks** that collectively sought over **$700 million** in ransom payments. Prosecutors said the scheme encrypted victim networks, threatened to leak stolen data, and used cryptocurrency exchangers and mixing services to launder proceeds; the court also ordered more than **$16 million** in restitution. U.S. authorities said related forfeiture actions recovered assets including **39.89138522 Bitcoin** and **$6.1 million**, and credited cooperation with Polish authorities for Vasinskyi’s extradition and prosecution. In a separate but related enforcement action, **Deniss Zolotarjovs**, a Latvian national tied to the **Karakurt** extortion operation and linked by investigators to the broader **Conti** ecosystem, was sentenced to **102 months** in prison after U.S. prosecutors accused him of helping pressure victims with stolen data, reviving unresolved extortion cases, and laundering cryptocurrency. Authorities said the Russian-linked group targeted more than **54 companies worldwide**, including victims whose stolen records included sensitive medical information, and generated losses exceeding **$56 million** across 13 victims with roughly **$13 million** more paid by 41 additional companies. The cases underscore sustained cross-border law enforcement action against ransomware and data-extortion actors operating through Russia-linked criminal networks.
Jun 29, 2026
A U.S. federal court sentenced Russian national **Aleksei Volkov**, 26, to **81 months in prison** for acting as an initial access broker who helped major cybercrime groups, including the **Yanluowang** ransomware operation, compromise U.S. companies and other organizations. Prosecutors said Volkov gained unauthorized access to victim networks and sold that access to ransomware operators, who then deployed malware, encrypted systems, stole data, and extorted victims through cryptocurrency ransom demands. The U.S. Department of Justice said the campaign caused more than **$9 million in actual losses** and more than **$24 million in intended losses**. Volkov was indicted in Indiana and Pennsylvania, arrested in Rome, extradited from Italy to the United States, and later pleaded guilty after the cases were consolidated. As part of the plea, he admitted hacking victim networks, stealing data, helping co-conspirators deploy ransomware, and sharing in ransom proceeds; he was also ordered to pay at least **$9,167,198.19** in restitution and forfeit equipment used in the crimes.
Jun 29, 2026
A U.S. court sentenced Latvian national **Deniss Zolotarjovs** to **102 months in prison** for his role in a Russia-linked ransomware and data-extortion organization run by former **Conti** members and operating under brands including **Karakurt**, **Royal**, **TommyLeaks**, **SchoolBoys Ransomware**, and **Akira**. Prosecutors said Zolotarjovs acted as a primary negotiator and extortion specialist from June 2021 to August 2023, researching victims, analyzing stolen data, setting ransom pressure points, and taking a share of proceeds. He was arrested in Georgia in December 2023, extradited to the United States in August 2024, and later pleaded guilty to conspiracy to commit **wire fraud** and **money laundering**. The Justice Department said the group targeted more than **54 companies**, collected roughly **$15 million to $16 million** in confirmed ransom payments, and caused at least **$56 million** in documented losses across 13 victims, with total damage likely reaching **hundreds of millions of dollars**. Authorities said the operation exposed highly sensitive personal data, including children’s medical records stolen from a pediatric healthcare provider that were later used to threaten victims and even sent to hundreds of patients, while another attack forced a U.S. government entity’s **911 emergency system** offline. Court filings and reporting also said the syndicate relied on front companies, corrupt contacts, and access to Russian government databases, underscoring the professionalized and well-connected structure behind the extortion campaign.
Jun 29, 2026