The **U.S. Department of Justice (DOJ)** announced the sentencing of **Maksim Silnikau**, the mastermind behind the **Ransom Cartel** ransomware operation, to 16 years in prison. The Belarusian national, aged 40, was convicted on charges including conspiracy to commit offenses against the United States, conspiracy to commit wire fraud, and aggravated identity theft. ### A History of Cybercrime **Silnikau's** involvement in Russian-speaking cybercrime forums dates back to at least 2005, where he operated under aliases such as "J.P. Morgan," "xxx," and "lansky." He was also a member of the **Direct Connection** cybercrime website between 2011 and 2016, a site that was eventually shut down following the arrest of its administrator. ### The Rise of Ransom Cartel According to court documents, **Silnikau** began developing the **Ransom Cartel** operation in May 2021. He actively recruited other cybercriminals through underground forums, providing them with the necessary tools and information for intrusions, including stolen credentials and encryption software. He also managed an affiliate website, a central hub for members to coordinate attacks, negotiate ransom demands, and distribute revenue shares post-payment. ### Global Impact and Financial Toll Between 2021 and 2023, **Ransom Cartel** affiliates targeted at least 18 companies globally, including organizations in California, New York, Nebraska, and various international locations. The attackers exfiltrated corporate data and demanded ransoms for decryption keys or to prevent public leaks of stolen information. Federal prosecutors stated that the operation attempted to extort at least $5.2 million from its victims. The **DOJ** identified over $6.7 million in losses from 18 known victims, though the actual total is likely higher due to unreported incidents. Notable attacks included a disruption of a medical technology startup developing robotic surgical technology in August 2022, which lasted two months. In May 2023, the group targeted infrastructure used by several law firms, causing business disruptions for weeks to months. One law firm paid a $125,000 ransom, while another paid $300,000 after nearly a month of halted operations. Combined losses from these specific attacks amounted to approximately $2.2 million. ### Technical Links and Operational Structure **Ransom Cartel** publicly launched in December 2021 and exhibited code similarities with the notorious **REvil** ransomware encryptor. Researchers speculate that it might have been developed by a former core member of **REvil** who lacked access to the complete source code, given the absence of some of **REvil's** obfuscation features. **Silnikau's** central role in the ransomware-as-a-service (RaaS) operation involved recruiting affiliates, collaborating with initial access brokers for network access, communicating with victims, and managing ransom payments. He also employed cryptocurrency mixers to obscure the financial trail, making it harder for law enforcement to trace the funds. ### International Pursuit and Extradition **Silnikau** was initially arrested in Spain on July 18, 2023, as part of an international law enforcement effort. However, he fled while awaiting extradition to the United States. He was subsequently apprehended attempting to cross from Poland into his native Belarus. Prosecutors noted in their sentencing filing, "The defendant fled Spanish authorities while awaiting extradition to the United States and was apprehended while trying to cross from Poland to his native Belarus." **Silnikau** eventually consented to extradition and was transferred from Poland to the United States to face prosecution in the Eastern District of Virginia.