Russian sentenced to jail for his part in ransomware attacks

A 26-year-old Russian citizen has been sentenced to 81 months in prison for his part in helping major cybercrime groups to extort tens of millions of dollars.

Aleksei Volkov was involved in dozens of ransomware attacks throughout the US, causing more than $9 million in actual losses and over $24 million in intended losses.

He assisted major cybercrime groups, including the Yanluowang ransomware group, charging up to $1,000 for access to business networks, as well as a percentage of the profits.

He had at least eight confirmed victims, two of which paid hackers a total of around $1.5 million to unlock their systems; Volkov's cut of this was more than $256,000.

Volkov operated as an initial access broker, gaining unauthorized access to computer networks and systems, and then selling it on to other cyber threat actors such as ransomware groups. These groups used that access to encrypt victims' data and then made ransom demands, to be paid in Bitcoin, of between $300,000 and $15 million.

"The conspirators demanded that the victims pay them a ransom in cryptocurrency – sometimes in the tens of millions of dollars – in exchange for restoring the victims' access to the data and promising not to publicly disclose the hack or release victims' stolen data on a 'leak' website," said the Department of Justice.

"In some cases, the victims paid the ransom, and in others the conspirators posted the victims' confidential data on the leak site. If the victims paid the ransom, Volkov received a share of the money."

Between July 2021 and November 2022, Volkov helped the Yanluowang ransomware gang with initial access and also launched distributed denial-of-service (DDoS) attacks. The victims included US banks, telecommunications companies, and engineering firms in Pennsylvania, California, Michigan, Illinois, Georgia, and Ohio.

The Yanluowang ransomware group was first spotted in October 2021 by Symantec's Threat Hunter Team, and had been operational since August that year. But the group disbanded at the end of 2022 when its leak site was hacked, and thousands of messages on the group's discussion channels were uploaded to a website.

After an investigation by the FBI, Volkov, also known as chubaka.kor, was arrested in Rome in January 2024, and extradited to the US. There, last November, he pleaded guilty to unlawful transfer of a means of identification, trafficking in access information, access device fraud, and aggravated identity theft, as well as two counts of computer fraud and conspiracy to commit money laundering.

He agreed to pay more than $9 million to his known victims to compensate them for their actual losses, and also to forfeit the equipment he used for his crimes.