Skip to content

Secure IT

Stay Secure. Stay Informed.

Primary Menu
  • Home
  • Sources
    • Krebs On Security
    • Security Week
    • The Hacker News
    • Schneier On Security
  • Home
  • The Hacker News
  • U.S. Sentences Russian Hacker to 6.75 Years for Role in $9M Ransomware Damage
  • The Hacker News

U.S. Sentences Russian Hacker to 6.75 Years for Role in $9M Ransomware Damage

[email protected] The Hacker News Published: March 24, 2026 | Updated: March 30, 2026 3 min read
1 views

Ravie LakshmananMar 24, 2026Cybercrime / Network Security

A 26-year-old Russian citizen has been sentenced in the U.S. to 6.75 years (81 months) in prison for his role in assisting major cybercrime groups, including the Yanluowang ransomware crew, in conducting numerous attacks against U.S. companies and other organizations.

According to the U.S. Department of Justice (DoJ), Aleksei Olegovich Volkov facilitated dozens of ransomware attacks across the U.S., causing more than $9 million in actual losses and over $24 million in intended losses. Volkov was arrested on January 18, 2024, in Italy and extradited to the U.S. to face charges. He pleaded guilty to the crimes in November 2025.

Volkov is said to have served as an initial access broker responsible for obtaining unauthorized access to computer networks and systems belonging to various organizations and selling that access to other criminal groups, including ransomware actors. This was accomplished by exploiting vulnerabilities or finding ways to access the networks without authorization.

“Volkov’s co-conspirators then used the access Volkov provided to infect the affected computer networks and systems with malware,” the DoJ said. “This malware encrypted the victims’ data and prevented the victims from accessing it, damaging their business operations.”

“The conspirators then demanded that the victims pay them a ransom in cryptocurrency — sometimes in the tens of millions of dollars — in exchange for restoring the victims’ access to the data and promising not to publicly disclose the hack or release victims’ stolen data on a ‘leak’ website.”

Every time a victim paid a ransom, Volkov received a share of the illicit proceeds. He was charged with unlawful transfer of a means of identification, trafficking in access information, access device fraud, and aggravated identity theft, in addition to two counts of computer fraud and conspiracy to commit money laundering.

As part of the guilty plea, the defendant has agreed to pay full restitution to victims, including at least $9,167,198 to known victims to compensate them for their actual losses, along with forfeiting the tools used to pull off the crimes.

U.S. Charges Third Ransomware Negotiator Linked to BlackCat Attacks

The disclosure comes as U.S. prosecutors have charged a third individual with acting as a negotiator for the BlackCat (aka ALPHV) ransomware gang, helping the threat actors extort higher payouts from at least 10 victims. The 41-year-old man, Angelo Martino (previously identified only as “Co-Conspirator 1”), worked as a ransomware negotiator for DigitalMint.

Authorities have confiscated nearly $9.2 million in five types of cryptocurrency (Bitcoin, Monero, Ripple, Solana, and Stellar) from 21 wallets controlled by Martino, in addition to seizing luxury vehicles and properties. He faces up to 20 years in prison. Two other incident responders, Ryan Clifford Goldberg and Kevin Tyler Martin, pleaded guilty to their roles as BlackCat affiliates in December 2025.

In a statement shared with The Record, DigitalMint said the actions were in violation of the company’s policy and ethical standards, and that it had terminated both Martino and Martin after their behavior came to light.

“DigitalMint condemns these individuals’ criminal behavior, which is a clear violation of our values, our ethical standards, and the law,” it said. “Our firm and industry both exist to support organizations suffering from the impacts of a cyberattack, and this runs completely counter to what we stand for.”

About The Author

[email protected] The Hacker News

See author's posts

Original post here

What do you feel about this?

  • The Hacker News

Post navigation

Previous: Citrix Urges Patching Critical NetScaler Flaw Allowing Unauthenticated Data Leaks
Next: TeamPCP Hacks Checkmarx GitHub Actions Using Stolen CI Credentials

Author's Other Posts

Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication micro.jpg

Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication

September 6, 2026 0 0
Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner rev.jpg

Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner

September 6, 2026 0 0
Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores adobe-exploit.jpg

Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores

September 5, 2026 0 0
Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials jet.jpg

Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials

September 5, 2026 0 0

Related Stories

micro.jpg
  • The Hacker News

Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication

[email protected] The Hacker News September 6, 2026 0 0
rev.jpg
  • The Hacker News

Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner

[email protected] The Hacker News September 6, 2026 0 0
adobe-exploit.jpg
  • The Hacker News

Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores

[email protected] The Hacker News September 5, 2026 0 0
jet.jpg
  • The Hacker News

Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials

[email protected] The Hacker News September 5, 2026 0 0
vmware-host.jpg
  • The Hacker News

Critical VMware Workstation and Fusion Flaw Lets VM Admins Execute Host Code

[email protected] The Hacker News September 5, 2026 0 0
trezor.jpg
  • The Hacker News

Trezor Says ShipMonk Breach Exposed 67,000 U.S. Customers’ Data It Said Was Deleted

[email protected] The Hacker News September 5, 2026 0 0

Trending Now

Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication micro.jpg 1

Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication

September 6, 2026 0 0
Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner rev.jpg 2

Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner

September 6, 2026 0 0
Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores adobe-exploit.jpg 3

Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores

September 5, 2026 0 0
Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials jet.jpg 4

Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials

September 5, 2026 0 0

Connect with Us

Social menu is not set. You need to create menu and assign it to Social Menu on Menu Settings.

Trending News

Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication micro.jpg 1
  • The Hacker News

Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication

September 6, 2026 0 0
Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner rev.jpg 2
  • The Hacker News

Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner

September 6, 2026 0 0
Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores adobe-exploit.jpg 3
  • The Hacker News

Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores

September 5, 2026 0 0
Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials jet.jpg 4
  • The Hacker News

Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials

September 5, 2026 0 0
Critical VMware Workstation and Fusion Flaw Lets VM Admins Execute Host Code vmware-host.jpg 5
  • The Hacker News

Critical VMware Workstation and Fusion Flaw Lets VM Admins Execute Host Code

September 5, 2026 0 0
Trezor Says ShipMonk Breach Exposed 67,000 U.S. Customers’ Data It Said Was Deleted trezor.jpg 6
  • The Hacker News

Trezor Says ShipMonk Breach Exposed 67,000 U.S. Customers’ Data It Said Was Deleted

September 5, 2026 0 0
Thousands of OpenAI Agents Quietly Turned an Abandoned Wiki Into Their Coordination Channel agents-openai.jpg 7
  • The Hacker News

Thousands of OpenAI Agents Quietly Turned an Abandoned Wiki Into Their Coordination Channel

September 5, 2026 0 0

You may have missed

micro.jpg
  • The Hacker News

Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication

[email protected] The Hacker News September 6, 2026 0 0
rev.jpg
  • The Hacker News

Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner

[email protected] The Hacker News September 6, 2026 0 0
adobe-exploit.jpg
  • The Hacker News

Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores

[email protected] The Hacker News September 5, 2026 0 0
jet.jpg
  • The Hacker News

Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials

[email protected] The Hacker News September 5, 2026 0 0
Copyright © 2026 All rights reserved. | MoreNews by AF themes.