Ransom Cartel Ransomware Creator Gets 16 Years in US Prison

A federal court in Virginia has sentenced the man behind one of the decade's most prolific ransomware-as-a-service operations to 16 years in prison. Maksim Silnikau, a 40-year-old Belarusian national, created and administered the Ransom Cartel ransomware operation. His affiliates struck at least 18 companies in the United States and abroad between 2021 and 2023. The Justice Department announced the sentence on August 5, 2026.

The convictions cover conspiracy to commit offenses against the United States, conspiracy to commit wire fraud, and aggravated identity theft. They close an investigation that began with an arrest in a Spanish seaside town and ended near the Belarusian border. Prosecutors traced Silnikau's forum activity back to at least 2005, more than fifteen years before the Ransom Cartel ransomware brand appeared.

Inside the Ransom Cartel ransomware business

Silnikau started building the malware in May 2021 and launched it publicly that December. He recruited affiliates through underground forums, offering a share of proceeds for carrying out intrusions. He supplied the tools they needed, including stolen credentials, details on compromised machines, and encryption software.

A hidden web portal held the operation together. Affiliates logged in to manage attacks, message each other, negotiate with victims, and split revenue after a payment landed. Silnikau ran that portal and handled much of the victim communication himself. He also worked with initial access brokers who sold ready-made footholds inside corporate networks.

Money moved through cryptocurrency mixers to frustrate tracing. Court filings describe a defendant who guarded operational security at every stage. Most Ransom Cartel ransomware affiliates needed little technical depth, because the operation handed them working tools and live targets.

Eighteen victims and $6.7 million in losses

Between 2021 and 2023, affiliates deployed the Ransom Cartel ransomware against at least 18 organizations. Targets sat in California, New York, and Nebraska, along with several countries outside the United States. The attackers stole corporate data before encrypting systems. They then demanded payment for decryption keys and for a promise to keep the stolen files offline.

Prosecutors put attempted extortion at a minimum of $5.2 million. Identified losses across the known victims passed $6.7 million. The real figure runs higher, because some organizations never reported what happened to them.

One August 2022 attack hit a medical technology startup developing robotic surgical systems and stalled its operations for two months. In May 2023, Ransom Cartel ransomware affiliates struck infrastructure servinga cluster of law firms. One firm paid $125,000 after nearly a month of disruption, and another handed over $300,000. Combined losses from those two incidents reached roughly $2.2 million.

A criminal record that starts with Reveton

The sentencing covers Ransom Cartel, but Silnikau's name appears in ransomware history well before it. Investigators link him to Reveton, credited as the first operation to sell ransomware access as a service. Reveton locked victims out of their machines and displayed messages posing as police. At its peak the scheme pulled in roughly $400,000 a month.

A separate indictment in New Jersey covers a malvertising campaign that ran from October 2013 through March 2022. That operation pushed the Angler Exploit Kit through advertising networks dressed up to look legitimate. Angler scanned browsers and plug-ins for unpatched flaws, then delivered malware to anyone it found vulnerable. At its height the kit accounted for roughly 40% of all exploit kit infections.

Prosecutors charged two co-defendants in that case, Volodymyr Kadariya and Andrei Tarasov. German authorities arrested Tarasov but released him after six months, and he returned to Russia. That prosecution remains separate from the Virginia sentencing.

Arrest, escape, and extradition

Spanish Guardia Civil officers arrested Silnikau at an apartment in Estepona on July 18, 2023. British and American investigators supported the operation. He did not stay put. While awaiting extradition, he slipped away from Spanish authorities and headed for home.

Police caught him as he tried to cross from Poland into Belarus. He then consented to extradition, and Polish authorities sent him to face prosecution in the Eastern District of Virginia. The flight attempt featured prominently in the government's sentencing filing.

Researchers noticed early on that the Ransom Cartel ransomware encryptor shared code with REvil. Several obfuscation features present in REvil never made it into the newer build. That gap pointed to a developer who had worked close to REvil without holding its complete source.

What the sentence signals

Sixteen years sits at the heavier end of terms handed down in ransomware cases. The court treated Silnikau as the operator of a criminal enterprise rather than as a programmer. Prosecutors have leaned on that framing more often over the past two years, and sentences have climbed with it.

For businesses, the practical value sits in the attack chain rather than the courtroom. Stolen credentials and broker-sold network access fed Ransom Cartel ransomware campaigns from the first intrusion. Both remain cheap and widely traded today. Multi-factor authentication, credential monitoring, and tight control over remote access still close the doors these affiliates walked through.

Arrests do not kill the model. Affiliates scatter and resurface under new brands, and the tooling outlives its authors. But a 16-year sentence changes the calculation for anyone weighing the same career, and it gives investigators a template for the next Ransom Cartel ransomware case.