Ransom Cartel Boss Gets 16 Years After $6.7M Extortion Spree

Key points

• Maksim Silnikau, 40, a Belarusian national, was sentenced on Wednesday to 16 years in a US federal prison for running the Ransom Cartel ransomware operation.
• The US Department of Justice says Silnikau built the crew in May 2021 and hit at least 18 companies across California, New York, Nebraska and abroad through 2023.
• Prosecutors put attempted extortion at $5.2 million and confirmed victim losses at more than $6.7 million.
• Silnikau was first arrested in Spain on 18 July 2023, fled while awaiting extradition, and was recaptured trying to cross from Poland into Belarus.
• Ransom Cartel's code overlapped with the older REvil ransomware, suggesting a former REvil insider was behind it.

The man who built the Ransom Cartel gang is going to prison for 16 years. A US federal judge in the Eastern District of Virginia handed down the sentence on Wednesday.

Maksim Silnikau, 40, ran a ransomware operation. That is a criminal business that locks a company's computer files with software called ransomware, then demands money to unlock them. His group also stole company data first, so victims who refused to pay could be threatened with having their secrets published.

Who is Maksim Silnikau?

A Belarusian citizen who spent nearly two decades on Russian-language crime forums under the handles "J.P. Morgan," "xxx," and "lansky." The US Department of Justice says he had been active on those forums since at least 2005 and belonged to the closed "Direct Connection" forum until police shut it down in 2016.

He pleaded to conspiracy to commit offences against the United States, conspiracy to commit wire fraud, and aggravated identity theft.

What did Ransom Cartel actually do?

It broke into companies, encrypted their files, stole their data, and demanded payment. Silnikau launched the brand publicly in December 2021 and recruited helpers, called affiliates, through underground forums. He gave them stolen passwords, the encryption software, and a private website to run attacks and split the ransom money.

Between 2021 and 2023, affiliates hit at least 18 companies in California, New York, Nebraska and several other countries. First reported by BleepingComputer, the campaign attempted to squeeze at least $5.2 million from victims. Confirmed losses across the 18 known victims topped $6.7 million, and prosecutors say the real figure is higher because some victims never reported the attacks.

Two cases stand out. In August 2022, the gang shut down a medical technology startup working on robotic surgical tools for two months. In May 2023, they hit a shared system used by several law firms. One firm paid $125,000 after nearly a month offline. Another paid $300,000 after almost a month of downtime. Combined losses in the law firm attacks reached about $2.2 million.

Was this a rebrand of REvil?

Probably a spin-off. Researchers who examined Ransom Cartel's code found it shared chunks with REvil, a notorious Russian-speaking ransomware crew that collapsed in 2021. But Ransom Cartel lacked some of REvil's more advanced tricks for hiding from antivirus tools. That gap suggested a former REvil member had built it from scratch, without the full source code.

Silnikau sat at the centre of the business. He recruited affiliates, worked with brokers who sold stolen access to corporate networks, spoke to victims, and moved the ransom payments. He also ran the cryptocurrency through mixing services, which shuffle coins between many wallets to make them harder to trace.

How was he caught?

Spanish police arrested him on 18 July 2023 in a coordinated international operation. He then fled while waiting to be extradited to the United States. Polish officers grabbed him again as he tried to cross into Belarus. He eventually agreed to extradition and was flown to Virginia to face trial.