Maksim Silnikau, a 40-year-old Belarusian national identified by U.S. authorities as the creator and leader of the Ransom Cartel ransomware operation, has been sentenced to 16 years in prison. Silnikau, who used online aliases such as J.P. Morgan, targa, xxx, and lansky, was active on Russian-speaking cybercrime forums for nearly two decades and was previously described by the U.K. National Crime Agency as a highly prolific cybercriminal.
Ransom Cartel, a ransomware-as-a-service (RaaS) platform, emerged in late 2021 and primarily targeted businesses in the United States and internationally. Prosecutors stated that Silnikau recruited accomplices via underground forums, providing them with stolen credentials, access to compromised networks, and the necessary ransomware tools to encrypt victim systems. He also allegedly managed the group's clandestine online infrastructure, facilitating coordination among members, ransom negotiations with victims, and the distribution of illicit proceeds.
Between 2021 and 2023, Ransom Cartel affiliates reportedly conducted attacks against at least 18 organizations, including businesses located in California, New York, and Nebraska. These attacks involved exfiltrating sensitive data before encrypting systems, with demands for payment either for a decryption key or a pledge to withhold the stolen information from publication.
Cybersecurity researchers have noted technical similarities between Ransom Cartel and the defunct REvil ransomware, a prominent cybercrime group that largely disappeared after international law enforcement pressure in 2021. It remains unconfirmed whether Ransom Cartel represents a direct successor to REvil or an independent operation utilizing leaked or repurposed malware. Prosecutors claim that Ransom Cartel's operations were significantly disrupted following Silnikau's arrest.
Silnikau was apprehended in Spain in July 2023 and subsequently extradited to the U.S. via Poland to face multiple cybercrime charges in the Eastern District of Virginia. His alleged co-conspirators, Vladimir Kadariya, 38, a Belarusian-Ukrainian national, and Andrei Tarasov, 33, a Russian national, have been charged in absentia in the U.S.
Beyond Ransom Cartel, Silnikau is also believed to have developed the Angler exploit kit, a widely used cybercrime tool in the mid-2010s. This software was distributed through malicious online advertisements, silently infecting visitors to legitimate websites and reportedly generating tens of millions of dollars annually.
Furthermore, prosecutors allege that Silnikau, along with Kadariya and Tarasov, established what they describe as the first RaaS business model in 2011. This product, named Reveton, enabled less skilled cybercriminals to launch ransomware attacks for a fee. Using Reveton, the group is estimated to have extorted approximately $400,000 per month from victims between 2012 and 2014.
