Ransomware Mastermind Sentenced to 2 Years in Prison for Botnet Crimes
Russian National Sentenced to Two Years in Prison for Role in BitPaymer Ransomware Attacks
A significant development in the ongoing battle against cybercrime, a Russian national has been sentenced to two years in prison for his involvement in a high-profile ransomware operation.
Ilya Angelov, a 40-year-old Russian national, admitted to managing a botnet used to launch BitPaymer ransomware attacks against 72 US companies.
According to court documents, Angelov traveled to the United States to plead guilty and face charges after the Russian invasion of Ukraine in February 2022.
He was part of a Russian cybercriminal operation tracked by the FBI as “Mario Kart” and by various cybersecurity companies as TA551, Shathak, GOLD CABIN, Monster Libra, ATK236, and G0127.
The Operation’s Activities
Angelov and his co-manager recruited members and oversaw the operation’s malicious activities, which included:
- Developing malware,
- Distributing spam,
- Customizing malware to evade security software.
The gang distributed malware through a massive spam campaign, sending up to 700,000 emails per day, which resulted in the infection of approximately 3,000 computers per day at the height of the operation.
The cybercrime gang sold access to infected devices to other cybercriminals, including affiliates involved in Ransomware-as-a-Service (RaaS) operations.
These attackers locked victims out of their computer networks and demanded extortion payments, commonly in cryptocurrency, to restore access.
The FBI identified over 70 US corporations that were infected with ransomware, resulting in over $14 million in extortion payments.
The Impact of the Operation
Alelov’s accomplices received another $1 million from the IcedID cybercrime gang between late 2019 and August 2021 for access to their bots.
However, the resulting damage is still unknown.
This case highlights the global nature of cybercrime and the need for international cooperation to combat these threats.
Law enforcement agencies have taken steps to disrupt cybercrime operations, including the arrest of a 26-year-old Russian national, Aleksey Olegovich Volkov, who pleaded guilty to acting as an initial access broker (IAB) for Yanluowang ransomware attacks.
This conviction demonstrates the commitment of law enforcement to hold individuals accountable for their role in cybercrime operations.