Belarusian cybercriminal behind Ransom Cartel gets 16-year prison sentence

A Belarusian cybercriminal who U.S. authorities say was  the creator and leader of the Ransom Cartel ransomware operation was sentenced to 16 years in prison on Wednesday.

Maksim Silnikau, 40, who used the online aliases "J.P. Morgan," "targa," "xxx," and "lansky," had been active on Russian-speaking cybercrime forums for nearly two decades. Britain's National Crime Agency previously described him as one of the world's most prolific Russian-speaking cybercriminals.

He developed and administered Ransom Cartel, a ransomware-as-a-service platform that emerged in late 2021 and targeted businesses in the U.S. and abroad.

Prosecutors said Silnikau recruited accomplices through underground forums and provided them with stolen credentials, access to compromised networks, and ransomware tools used to encrypt victims' systems. He also allegedly operated the group's hidden online infrastructure, allowing members to coordinate attacks, negotiate ransom payments with victims, and distribute criminal proceeds.

According to court documents, Ransom Cartel affiliates carried out attacks against at least 18 organizations between 2021 and 2023, including businesses in California, New York, and Nebraska. The hackers stole sensitive data before encrypting victims' systems and demanded payment either for a decryption key or a promise not to publish the stolen information.

Cybersecurity researchers have previously said Ransom Cartel shared technical similarities with the now-defunct REvil ransomware, operated by the prolific cybercrime group that largely disappeared in 2021 after a wave of international law enforcement pressure. It remains unclear whether the newer group was a direct successor to REvil or a separate operation built on leaked or reused malware.

Prosecutors claimed Ransom Cartel's operations were significantly disrupted after Silnikau's arrest in July 2023.

Silnikau is also believed to be responsible for developing the Angler exploit kit, one of the most widely used cybercrime tools of the mid-2010s. The software was distributed through malicious online advertisements that silently infected visitors to legitimate websites, generating tens of millions of dollars annually.

Silnikau was arrested in Spain in 2024 and later extradited to the U.S. through Poland to face multiple cybercrime charges in the Eastern District of Virginia.

His alleged co-conspirators, Belarusian-Ukrainian Vladimir Kadariya, 38, and Russian national Andrei Tarasov, 33, were charged in absentia in the U.S. Together with Silnikau, they created what prosecutors described as the first ransomware-as-a-service business model in 2011, a product called Reveton that allowed low-skilled cybercriminals to launch ransomware attacks for a fee.

Using Reveton, the group extorted approximately $400,000 a month from victims between 2012 and 2014.