Loading story…
The U.S. Department of State is offering up to $2.5 million for information leading to the arrest or conviction of Belarusian national Volodymyr Kadariya, who is accused of participating in a worldwide malware and malvertising operation. Authorities allege the organization distributed the Angler Exploit Kit, other malware and online scams from October 2013 through March 2022. Angler was at times a leading mechanism for delivering malware to compromised devices. Kadariya was indicted in the District of New Jersey on June 14, 2023, on conspiracy to commit wire fraud, conspiracy to commit computer fraud and two substantive wire fraud counts. Andrei Vladimirovich Tarasov and Maksim Silnikau are named as co-defendants in the alleged operation, which infected computers and sold stolen data and access.
Tarasov, known online as Aels and Lavander, was arrested in Germany in July 2023 but released in January 2024 after prosecutors concluded the U.S. charges were insufficiently concrete for extradition. The charges remain outstanding. Intel 471 reported in May 2025 that Tarasov was back in Russia and continued participating in cybercrime and spamming communities, including an earlier sale of compromised Zimbra server access and a May 2025 request for ways to compromise Zimbra servers at scale. His reported location and claims of helping the FBI identify cybercriminals remain partly or wholly unverified, but the reported Zimbra activity indicates continued interest in compromising enterprise email infrastructure.
See the reporting duties and controls this puts on the clock.
21 events from the most recent confirmed update back to the earliest known activity.
Lavander, identified as Aels, posted that he needed a way to hack Zimbra servers at scale.
The forum persona Lavander identified himself as Aels and claimed that he had returned to Russia through Poland and Kaliningrad before flying to Moscow. Intel 471 could not independently reproduce a separate forum claim concerning his border-crossing record.
Silnikau was extradited from Poland to the United States to face criminal proceedings.
The Kammergericht affirmed the decision underlying Tarasov's release.
Tarasov was released after Berlin prosecutors concluded that the U.S. charges were insufficiently concrete to support extradition.
International law enforcement arrested Silnikau in Estepona, Spain.
German police arrested Tarasov in Berlin and detained him in Moabit Prison for approximately six months.
Aels stated on the XSS forum that authorities had approached him about past wrongdoing and a U.S. case, shortly before his arrest.
A New Jersey grand jury indicted Tarasov, Silnikau, and Kadariya over the alleged malvertising operation. The charges included conspiracy to commit wire fraud, conspiracy to commit computer fraud and abuse, and two substantive wire fraud counts.
Aels offered to sell a manual about Microsoft Outlook spamming.
Aels auctioned web-shell access to 758 corporate Zimbra Collaboration Suite email servers, allegedly affecting more than 100,000 email accounts. The compromises reportedly exploited the CVE-2022-37042 authentication-bypass vulnerability.
A separate Eastern District of Virginia indictment alleges that Silnikau administered Ransom Cartel and other ransomware operations beginning in May 2021.
According to the indictment, Tarasov discussed a browser-locking extortion mechanism with Silnikau in June 2017.
Aels offered to sell a Microsoft Word remote-code-execution vulnerability based on a recently disclosed Microsoft Office zero-day.
Prosecutors allege that Tarasov, Maksim Silnikau, and Volodymyr Kadariya operated a malware-distribution scheme from October 2013 through March 2022, targeting millions of computers. The operation allegedly used malicious advertisements to deliver Angler and other malware, then sold compromised access and stolen data.
Around 2010, Andrei Tarasov's Aels persona joined Russian-speaking cybercrime communities and participated in discussions involving carding, malware spamming, vulnerability exploitation, and malicious traffic.
The U.S. State Department offered up to $2.5 million for information leading to Kadariya's arrest or conviction in any country over his alleged involvement in the malware operation.
Following his release in Spain, Silnikau was arrested in Poland before being extradited to the United States.
Spanish authorities released Silnikau following his arrest in Estepona. He was subsequently arrested in Poland.
The XSS persona Tagesanzeiger organized legal-defense donations and circulated a video confirmed by attorney Arkady Bukh, a court document, and a purported Tarasov letter. Intel 471 could not authenticate the letter.
The indictment alleges that Tarasov agreed to develop a $2,500 traffic distribution system for Kadariya. The system would selectively display malicious advertisements to reduce blocking and hinder researchers tracking the campaigns.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Belarusian national **Maksim Silnikau** was sentenced in federal court in Alexandria, Virginia, to **16 years in prison** for creating and operating the **Ransom Cartel** ransomware-as-a-service operation. U.S. prosecutors said Silnikau launched the scheme in **May 2021**, later rebranding it as Ransom Cartel, and recruited affiliates through underground Russian-language forums while seeking access to non-CIS corporate networks. He allegedly supplied stolen credentials, encryption tools, and a hidden management panel, and coordinated attacks and ransom negotiations through infrastructure he controlled. Authorities said Ransom Cartel affiliates attacked at least **18 companies** in the United States and abroad between **2021 and 2023**, stealing corporate data and attempting to extort at least **$5.2 million**, with known victim losses exceeding **$6.7 million**. Prosecutors also said Silnikau worked with initial access brokers and laundered ransom proceeds through cryptocurrency mixers. He was arrested in Spain in 2023, briefly fled while awaiting extradition, was later captured near the Poland-Belarus border, and extradited to the United States; a separate federal case in New Jersey tied to the **Angler Exploit Kit** and co-defendants **Volodymyr Kadariya** and **Andrei Tarasov** remains pending.
Aug 15, 2026
Russian national **Searzhudin Tamirlanovich Aktulaev** was extradited from Cyprus to the United States to face federal charges over an alleged 2016–2017 phishing operation that compromised more than 80,000 computers. Prosecutors allege Aktulaev and co-conspirators created roughly 255 fraudulent accounts on a freelance-employment platform and sent targets malicious Excel attachments designed to persuade them to enable macros. The macro-enabled files allegedly downloaded the **TVRAT** and **DarkVNC** remote-access trojans, allowing the operators to steal victim information and exfiltrate it through U.S.-hosted command-and-control infrastructure. The campaign affected thousands of victims, approximately half in the United States; Aktulaev faces charges including conspiracy, computer-damage offenses, and aggravated identity theft, with potential penalties of up to 20 years in prison.
Sep 4, 2026
Aleksei Olegovich Volkov, a Russian national, pleaded guilty in the United States to charges related to his role as an initial access broker (IAB) for the Yanluowang ransomware group. Volkov provided access to at least seven U.S. organizations between July 2021 and November 2022, enabling the deployment of ransomware that resulted in ransom demands ranging from $300,000 to $15 million. He received a percentage of the ransom payments, including $94,259 from a $500,000 ransom and $162,220 from a $1 million ransom, and was ordered to pay nearly $9.2 million in restitution to affected organizations. Volkov's activities were uncovered through digital forensics, including chat logs, cryptocurrency records, and social media accounts, and he was extradited to the U.S. after being apprehended in Rome. The indictment and plea agreement detail Volkov's collaboration with co-conspirators, his use of aliases such as "chubaka.kor," and his involvement in negotiating ransom payments and providing network credentials to the Yanluowang group. The attacks affected a range of U.S. businesses, including engineering firms, banks, and telecommunications providers, with some victims able to restore from backups and avoid ransom payments. Volkov faces up to 53 years in prison for charges including access device fraud, aggravated identity theft, and conspiracy to commit money laundering and computer fraud.
Jun 29, 2026