extradition3 articles
Russian Hacker Extradited Over Excel Macro Campaign That Hit 80,000 Freelance Platform Users
A Russian national, Searzhudin Tamirlanovich Aktulaev, has been extradited from Cyprus and charged in the US for orchestrating a malware campaign in 2016–2017 that used around 255 fake accounts on a freelance platform to send malicious Excel attachments to approximately 80,000 users. The attachments tricked recipients into running macros that installed two remote access tools — TVRAT and DarkVNC — giving attackers covert control of victims' computers and enabling theft of credentials and personal data. The case highlights the ongoing abuse of freelance and job-hunting platforms as attack vectors, a tactic also currently employed by state-sponsored groups such as North Korea's Lazarus and Russia's Sandworm.
Ransom Cartel Kingpin Gets 16 Years While Half His Crew Remains at Large
Maksim Silnikau, a 40-year-old Belarusian national, was sentenced to 16 years in prison for creating and operating Ransom Cartel, a ransomware-as-a-service operation that targeted at least 18 companies between 2021 and 2023. He built the criminal enterprise by providing locking software, stolen credentials, and an affiliate management system, routing ransom payments through cryptocurrency mixers. A separate federal case in New Jersey related to the Angler Exploit Kit malvertising scheme remains unresolved, with two co-defendants still at large.
Armenia Locks Up Russian Tourist Named Aleksandr Ermakov. Problem: There Are Two of Them.
Armenia has detained a Russian tourist, Aleksandr Yuryevich Ermakov, at Yerevan's airport on a US extradition request targeting a REvil ransomware suspect of the same name, but his lawyers argue Washington has the wrong man. The US and allied governments actually want Aleksandr Gennadievich Ermakov, a sanctioned cybercriminal linked to the hack of Australian health insurer Medibank and convicted in Russia for co-writing the SugarLocker ransomware, who is currently serving a sentence barring him from leaving Russia. The mix-up may stem from the US warrant omitting the patronymic that distinguishes the two men, with the detained man's lawyers noting that no fingerprints or full passport data have been produced to confirm his identity.