Maksim Silnikau, creator and administrator of the Ransom Cartel, has been sentenced to 16 years in prison in the US. The case sheds light on how an organized ransomware operation combined stolen credentials, collaborators, and data extortion.
According to the U.S. Department of Justice, the 40-year-old Belarusian was convicted of conspiracy to commit crimes against the United States, wire fraud, and aggravated identity theft. The announcement was issued on August 5, 2026, by the U.S. Attorney's Office for the Eastern District of Virginia.
See also: Ransomware continues to exploit legitimate monitoring tools
How the Ransom Cartel Worked
Court documents state that Silnikau began developing the Ransom Cartel in May 2021, and the group went public in December of that year. He used underground forums to recruit other criminals, provide stolen credentials, and have tools to encrypt victims' computers.
The group’s infrastructure operated as an organized service. Associates could manage attacks, communicate with victims, negotiate ransom demands, and share the proceeds. Early access intermediaries delivered compromised corporate networks, reducing the time required for each intrusion.
Silnikau's activities did not begin with the Ransom Cartel. US authorities say he participated in Russian-language cybercrime forums as early as 2005 and was a member of the Direct Connection platform from 2011 to 2016. His long presence in such networks also explains his ability to connect different roles into a single operation.
Researchers have noted similarities between the Ransom Cartel code and the REvil encryptor. This is an assessment by the research community, not a forensic finding. However, the similarity shows how often ransomware groups recycle techniques, tools, and human networks after the dismantling of a previous operation.
According to BleepingComputer, the attackers stole corporate data and demanded money for both the decryption keys and a promise not to make the files public. The payments were made through cryptocurrency mixing services to make it difficult to trace the money.
See also: How ransomware groups target critical infrastructure
At least 18 companies among the victims
From 2021 to 2023, Ransom Cartel associates attacked at least 18 companies around the world. Known cases involved organizations in California, New York, Nebraska and other states, with authorities estimating the actual number of incidents to be higher.
In August 2022, an attack disrupted the operations of a medical technology startup developing robotic surgery systems for about two months. In May 2023, a group of law firms faced outages ranging from a few days to several months. One firm paid a ransom of $125,000, while another suspended operations for almost a month before paying $300,000.
Prosecutors estimated that the group attempted to extort at least $5.2 million and that the losses from the 18 known victims exceeded $6.7 million. The figure likely understates the damage because some businesses did not report their attacks.
The concept and the message for businesses
Silnikau was arrested in Spain on July 18, 2023, as part of an international operation. He later escaped while awaiting extradition, was recaptured while trying to cross from Poland to Belarus, and was eventually extradited to the United States. He used the aliases “JP Morgan,” “xxx,” and “lansky” on forums, among others.
The case shows that ransomware is not based on just one malicious program, but on a chain of roles that includes access theft, negotiation, and financial management. The SecNews technical team recommends that enterprises implement multi-factor authentication, network segmentation, isolated backups, and constant monitoring of accounts with elevated privileges.
☁️ Keep safe copies with Proton Drive
Encrypted cloud storage from Proton — protect your files from ransomware, corruption, and data loss with end-to-end encryption.
- ✔ End-to-end encrypted files & backups
- ✔ Version history — recover files after ransomware
- ✔ Free space — sync across all devices
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
See also: International pressure on cybercrime forums
The 16-year sentence is a significant blow to one of the leaders of the Ransom Cartel, but the infrastructure and partners in the ransomware ecosystem often move quickly, so early detection and proven recovery remain as critical as installing security updates.
