A U.S. federal court in Virginia has sentenced Maksim Silnikau, the 40-year-old Belarusian founder and administrator of the Ransom Cartel ransomware-as-a-service (RaaS) operation, to 16 years in prison. Silnikau, also known by the aliases J.P. Morgan, lansky, and xxx, was convicted for his role in creating and running the ransomware strain, which launched in 2021.
According to court documents and a press release from the Department of Justice, Silnikau’s Ransom Cartel conspirators conducted ransomware attacks on at least 18 companies globally between 2021 and 2023. These victims included businesses located in California, New York, and Nebraska, as well as in other countries. The attackers typically exfiltrated data and then demanded ransom payments in exchange for decryption keys or a promise not to publish the stolen information.
Silnikau’s RaaS model provided affiliates with the necessary infrastructure, including stolen credentials and ransomware software. He also operated a hidden website where affiliates could monitor ongoing attacks, negotiate with victims, and divide the proceeds. The indictment revealed that the operation targeted companies with revenues of at least $10 million, indicating a strategic focus on victims capable of paying substantial ransoms.
Silnikau’s involvement in cybercrime predates Ransom Cartel. He was active on Russian-speaking cybercrime forums as early as 2005 and was a member of the notorious Direct Connection cybercrime website from 2011 until its shutdown in 2016 following the arrest of its administrator.
The growth of the Ransom Cartel operation was halted by Silnikau’s arrest in July 2023. He was subsequently extradited from Poland to the U.S. in August 2024 to face charges in the Eastern District of Virginia.
While this sentencing addresses Silnikau’s role in Ransom Cartel, he also faces an unresolved prosecution in New Jersey related to the Angler Exploit Kit malvertising scheme, which operated from 2013 to 2022. In that case, his alleged co-defendants, Volodymyr Kadariya and Andrei Tarasov, remain at large. The Secret Service lists Tarasov as wanted, and the State Department offers a $2.5 million reward for information leading to Kadariya.
Cybersecurity researchers, including Palo Alto Networks Unit 42, have previously explored potential connections between Ransom Cartel and the REvil ransomware group, noting that Ransom Cartel operators appeared to possess REvil's original source code but lacked its obfuscation engine. However, neither the indictment nor the sentencing announcement in the Virginia case mentioned any link to REvil.
