Ransom Cartel Kingpin Gets 16 Years While Half His Crew Remains at Large
A federal judge in Alexandria, Virginia handed Maksim Silnikau a 16-year prison sentence on 5 August for building and running Ransom Cartel, the ransomware-as-a-service operation he launched in 2021. The 40-year-old Belarusian, who operated under the handles "J.P. Morgan", "lansky" and "xxx", was extradited from Poland last August.
Silnikau was not the one personally breaking into networks. His role was structural: he built the platform, sourced stolen credentials from access brokers, and maintained the backend panel where affiliates tracked attacks, haggled with victims and divided the proceeds. He rated affiliates by performance, effectively running a franchise model for extortion. Ransom payments were routed through cryptocurrency mixers.
Between 2021 and 2023, Ransom Cartel affiliates hit at least 18 organisations across California, New York, Nebraska and several countries abroad.
The sentence beats the 13 years and 7 months handed to Yaroslav Vasinskyi in 2024 for the REvil operation, which involved more than 2,500 attacks and over $700 million in ransom demands. So Silnikau now holds the dubious record, at least among those who have actually been caught and sentenced.
That said, this is only half the story. A separate federal case in New Jersey is still unresolved, and the two co-defendants charged alongside him there remain free. Prosecutors brought seven counts in Virginia and announced convictions on three. The Justice Department's announcement includes no restitution figure and does not specify whether Silnikau pleaded guilty or went to trial.
The timeline of Ransom Cartel has always been slightly murky. The indictment, returned in June 2023 and unsealed in 2024, clarifies it a bit. Silnikau operated under a different name from May 2021, rebranded to "Ransom Cartel" later that year, then reportedly tried to drum up press coverage on security news sites. The indictment even preserves the original recruitment post placed on a Russian-language cybercrime forum on 4 May 2021, which specified targets outside the Commonwealth of Independent States, set a minimum victim revenue of $10 million, and advertised network access prices starting at $100.
Palo Alto Networks' Unit 42 did not spot the operation until mid-January 2022, which explains why external timelines never quite matched what prosecutors were describing.
Unit 42's 2022 analysis found that Ransom Cartel operators had access to REvil's source code but apparently lacked the obfuscation engine that gang used. The researchers suggested some kind of historical connection between the two groups without making any firm claim. Neither the indictment nor the sentencing announcement mentions REvil at all.
The last criminal act listed in the charges dates to 25 April 2023, when Silnikau negotiated terms for supplying machines to be encrypted. He was arrested in July 2023, three months later, which prosecutors say effectively stalled Ransom Cartel's expansion.
Silnikau also faces separate charges in New Jersey alongside Volodymyr Kadariya and Andrei Tarasov over the Angler Exploit Kit malvertising scheme, which ran from 2013 to 2022. That case is not mentioned in the Virginia sentencing announcement. The Secret Service still lists Tarasov as wanted. The State Department is offering up to $2.5 million for information leading to Kadariya's arrest or conviction.