A federal judge in Alexandria, Virginia, on August 5 sentenced Maksim Silnikau, a 40-year-old Belarusian national, to 16 years in prison for creating and running Ransom Cartel, the ransomware-as-a-service operation he stood up in 2021. Prosecutors said the conspirators attacked at least 18 companies in the United States and abroad between 2021 and 2023, building a business that paired custom locking software, stolen credentials, and an affiliate panel for managing ransom negotiations.
How Maksim Silnikau Built Ransom Cartel Into a RaaS Business
Silnikau, operating under the handles “J.P. Morgan,” “lansky,” and “xxx,” set up Ransom Cartel in 2021 and advertised on a Russian-language cybercrime forum the same year, seeking access to corporate networks outside the CIS region. The criminal equivalent of a franchise model: affiliates bought stolen credentials from initial-access brokers, used the locking software, and monitored and negotiated with victims through a hidden panel, splitting proceeds and taking the money out through crypto-mixer payouts.
The Indictment’s Screening Criteria and the $10 Million Revenue Floor
The unsealed indictment shows Silnikau screened potential targets by victim size with a stated floor of “$10 million revenue” and offered “prices from $100.” Prosecutors charged seven counts in Virginia and announced convictions on three, though the announcement did not state whether he pleaded guilty or was convicted at trial.
The REvil Connection That Prosecutors Never Called a Rebrand
According to Unit 42’s research, Ransom Cartel’s operators held the original REvil source code but apparently not its obfuscation engine, and researchers speculated about a link without ever calling it a rebrand. Neither the indictment nor the sentencing mentions REvil, leaving the relationship between the two strains technically open.
Why the 16-Year Sentence Leaves the Ransom Cartel Case Unfolding
The sentence of 16 years exceeds the 13-year, 7-month term given to Yaroslav Vasinskyi, a REvil actor sentenced earlier, marking one of the more serious penalties a RaaS operator has received. Poland extradited Silnikau to the United States, and the last charged act involved negotiating terms for supplying computers to be locked.
The Unresolved New Jersey Prosecution and Two Fugitive Co-Defendants
The Virginia outcome settles only half of the broader case. A second federal prosecution in New Jersey over the Angler Exploit Kit malvertising operation, active for roughly a decade, remains unresolved, with co-defendants Volodymyr Kadariya and Andrei Tarasov still at large. The Secret Service lists Tarasov as wanted, and the State Department has offered up to a reward for information leading to Kadariya.
What the Ransom Cartel Sentencing Signals to RaaS Operators
The 16-year sentence sends a clear signal to operators who treat ransomware as a business: the effort to dismantle the affiliate-based ecosystem relies not only on network takedown but on criminal accountability that is successful. The case also shows how far the U.S. Justice Department and its partners, including the FBI and the Secret Service, will reach — with Poland’s cooperation on extradition — to bring a single founder to court.
The nature of the case draws attention to the broader pattern of ransomware operators: sentencing is only part of the dismantling process, and the unresolved New Jersey case shows that accountability for the supporting criminal infrastructure is still under construction. Ransom Cartel began in May 2021 under a different name, was renamed “Ransom Cartel” later that year, and prosecutors credited Silnikau’s July 2023 arrest with stalling its growth; the 16-year term now puts a price on that founder role. For defenders, the legal deterrent is being built alongside technical defenses, and law-enforcement action has become an independent lever against the RaaS model that produced more than a dozen corporate victims.
