428/69 Friday, August 7, 2026
The U.S. Department of Justice (DOJ) disclosed that Maksim Silnikau, a 40-year-old Belarusian national who created and operated the Ransom Cartel ransomware operation, has been sentenced to 16 years in prison for ransomware attacks against at least 18 companies worldwide. Silnikau was convicted of conspiracy to commit an offense against the United States, conspiracy to commit wire fraud, and aggravated identity theft. The DOJ stated that Silnikau had been active on Russian-language cybercrime forums since at least 2005, using aliases such as “J.P. Morgan,” “xxx,” and “lansky.” He was also a member of the Direct Connection cybercrime website between 2011 and 2016, before the site was shut down following the arrest of its administrator.
According to court documents, Silnikau began developing Ransom Cartel ransomware in May 2021 and recruited other cybercriminals through underground forums to join the operation. He provided information and tools for intrusions, such as credentials stolen from compromised machines and software used to encrypt victims’ systems. Silnikau also operated an affiliate website for the ransomware operation, which was used to manage attacks, communicate among members, negotiate ransom payments, and divide proceeds after victims paid. Between 2021 and 2023, Ransom Cartel affiliates attacked at least 18 companies worldwide, including organizations in California, New York, Nebraska, and outside the United States. The attackers stole corporate data and demanded ransom payments in exchange for decryption keys or promises not to publish the stolen information.
U.S. prosecutors stated that Ransom Cartel attempted to extort at least USD 5.2 million and caused more than USD 6.7 million in losses among 18 known victims. The actual figures may be higher because some organizations did not report incidents. For example, an attack in August 2022 disrupted a medical technology startup developing robotic surgery technology for two months. In May 2023, the group attacked infrastructure used by a group of law firms, causing business disruptions lasting from several days to several months. One law firm paid a ransom of USD 125,000, while another paid USD 300,000. Ransom Cartel first appeared publicly in December 2021 and shared code similarities with REvil ransomware. Silnikau was first arrested in Spain on July 18, 2023, before fleeing while awaiting extradition to the United States. He was later arrested again while attempting to return to Belarus through Poland, before agreeing to be extradited to face charges in the United States.