Ransom Cartel Ransomware Creator Sentenced to 16 Years in Prison

Maksim Silnikau, the creator and administrator of the Ransom Cartel ransomware operation, has been sentenced to 16 years in prison for his role in attacks against at least 18 companies worldwide.

The US Department of Justice announced the sentence on August 5. The 40-year-old Belarusian national was convicted of conspiracy to commit offences against the United States, conspiracy to commit wire fraud, and aggravated identity theft.

Prosecutors said Ransom Cartel ransomware targeted organisations in several US states and other countries between 2021 and 2023. The operation allegedly attempted to extort at least $5.2 million, while 18 known victims suffered more than $6.7 million in total losses.

Long history in cybercrime forums

According to the Justice Department, Silnikau had been active on Russian-speaking cybercrime forums since at least 2005.

He reportedly used several online aliases, including J.P. Morgan, xxx, and lansky. He was also a member of the Direct Connection cybercrime forum between 2011 and 2016, before authorities shut the site down after arresting its administrator.

Court documents say Silnikau began developing Ransom Cartel ransomware in May 2021. He then recruited other cybercriminals through underground forums to take part in attacks.

The operation followed the ransomware-as-a-service model. In this structure, a central group develops and manages the malware while affiliates carry out intrusions against victim organisations.

Affiliates received tools, credentials and a payment platform

Silnikau allegedly supplied affiliates with tools and information used during attacks. This included stolen credentials for compromised systems and ransomware designed to encrypt victim computers.

He also ran an affiliate website that reportedly helped members manage attacks, communicate with one another, negotiate ransom demands, and distribute proceeds after victims paid.

Prosecutors said Silnikau played a central role in the wider operation. He allegedly recruited affiliates, worked with initial access brokers who provided entry into corporate networks, communicated with victims, and handled ransom payments.

Authorities also said he moved ransom payments through cryptocurrency mixers in an effort to make the funds harder to trace.

Ransom Cartel attacks caused long disruptions

Between 2021 and 2023, Ransom Cartel ransomware affiliates attacked at least 18 businesses around the world. Known victims included organisations in California, New York, and Nebraska.

During the attacks, affiliates allegedly stole corporate data and then demanded payment in return for a decryption key or a promise not to publish the stolen information.

One reported incident in August 2022 disrupted a medical technology startup developing robotic surgical technology for two months.

In another series of attacks in May 2023, the group targeted infrastructure used by several law firms. The disruptions reportedly lasted from a few days to several months.

One law firm paid a ransom worth $125,000 after almost a month of disruption. Another halted operations for nearly a month before paying $300,000.

Prosecutors said the losses tied to those attacks totalled roughly $2.2 million.

Links to REvil ransomware

Ransom Cartel launched publicly in December 2021 and attracted attention because its encryptor shared code similarities with REvil ransomware.

However, researchers noted that it lacked some of REvil’s obfuscation features. This led to theories that a former core REvil member may have developed it without access to the operation’s complete source code.

Silnikau was first arrested in Spain in July 2023 during an international law enforcement operation. He later fled while awaiting extradition to the United States.

Authorities captured him while he was reportedly attempting to cross from Poland into Belarus. He later agreed to extradition and was transferred to the United States to face prosecution in the Eastern District of Virginia.