A federal judge in Alexandria, Virginia, sentenced Maksim Silnikau to 16 years in prison on August 5 for creating and running Ransom Cartel, the ransomware-as-a-service operation he stood up in 2021.
Between 2021 and 2023, Ransom Cartel conspirators attacked at least 18 companies, including firms in California, New York and Nebraska, and others abroad, according to the Justice Department.
Silnikau, a 40-year-old Belarusian national who worked under the handles “J.P. Morgan,” “lansky” and “xxx,” did not carry out most of those intrusions himself.
He built the business around them: the locking software, the stolen credentials he bought from initial access brokers, and a hidden panel where affiliates monitored attacks, negotiated with victims and split proceeds. He ran a ratings system that rewarded the productive ones, and pushed ransom payments through cryptocurrency mixers.
Sixteen years run past the 13 years and seven months handed to Yaroslav Vasinskyi in 2024 for more than 2,500 REvil attacks and over $700 million in ransom demands. It also settles only half the case: a second federal prosecution in New Jersey is unresolved, and the two men charged alongside him there remain at large.
Prosecutors charged seven counts in Virginia and announced convictions on three. The announcement carries no restitution or forfeiture figure and does not say whether he pleaded guilty or was convicted at trial.
Accounts of when Ransom Cartel began have never lined up: prosecutors date the operation to May 2021, while Palo Alto Networks’ Unit 42 did not observe it until mid-January 2022.
The indictment, returned in June 2023 and unsealed in 2024, closes the gap. Silnikau ran the operation under another name from May 2021, renamed it “Ransom Cartel” in late 2021, then tried to publicize it on security news sites.
The same document preserves the advertisement his conspiracy posted to a Russian-language cybercrime forum on May 4, 2021, seeking access to corporate networks anywhere outside the Commonwealth of Independent States. They screened by victim size and set a floor on what they would pay: “Revenue: from $10 million. Prices from $100 and up.”
The last charged act falls on April 25, 2023, when he negotiated terms for supplying computers to be locked, three months before the July 2023 arrest that prosecutors say stalled Ransom Cartel’s growth. Poland extradited him to the United States in August 2024.
Unit 42 has never called Ransom Cartel a rebrand of REvil. Its 2022 analysis found the operators held the original REvil source code but apparently not the obfuscation engine that gang used. The researchers speculated only that the groups were linked at some point. Neither the indictment nor the sentencing release mentions REvil.
Silnikau was separately charged in New Jersey alongside Volodymyr Kadariya and Andrei Tarasov over the Angler Exploit Kit malvertising scheme, which ran from 2013 to 2022. The Virginia announcement says nothing about it.
The Secret Service still lists Tarasov as wanted, and the State Department is offering up to $2.5 million for information leading to Kadariya’s arrest or conviction.
