Ransomware Cartel Creator Gets 16 Years as Threats Evolve

The fight against ransomware reached a milestone this week when a federal judge in Alexandria, Virginia, sentenced Maksim Silnikau, a 40-year-old Belarusian national, to 16 years in prison for creating and operating the Ransom Cartel ransomware-as-a-service (RaaS) operation. The sentence, handed down on August 5, 2026, sends one of the strongest signals yet that cybercriminals face real consequences — even as the threat landscape continues to shift beneath defenders’ feet.

The Ransom Cartel Case: A Landmark Sentence

Silnikau, who operated under the aliases “J.P. Morgan,” “lansky,” and “xxx,” built Ransom Cartel into a full-fledged criminal enterprise beginning in 2021. According to the Justice Department, between 2021 and 2023, the group’s conspirators attacked at least 18 companies across California, New York, Nebraska, and abroad.

What made Ransom Cartel effective was its business model. Silnikau did not personally carry out most intrusions. Instead, he:

• Built the locking software that encrypted victims’ files and rendered systems inoperable
• Purchased stolen credentials from initial access brokers to feed affiliates entry points
• Operated a hidden panel where affiliates monitored attacks, negotiated with victims, and split proceeds
• Ran a ratings system that rewarded the most productive affiliates with better deals
• Laundered payments through cryptocurrency mixers to obscure the money trail

The 16-year sentence surpasses the 13 years and seven months given to Yaroslav Vasinskyi in 2024 for carrying out more than 2,500 REvil attacks and demanding over $700 million in ransom. However, the case is only half closed: a second federal prosecution in New Jersey remains unresolved, and two co-conspirators — Volodymyr Kadariya and Andrei Tarasov — are still at large, with the State Department offering up to $2.5 million for information leading to Kadariya’s arrest.

Ransomware-as-a-Service: The Industrialization of Cybercrime

The Ransom Cartel case highlights a troubling trend: the professionalization and industrialization of ransomware. The RaaS model separates the technical work of building malware from the operational work of breaching networks. Creators like Silnikau function as software vendors, while affiliates act as the sales and deployment arm. This division of labor lowers the barrier to entry and multiplies the number of attacks a single strain can generate.

Affiliates were screened by victim revenue — Ransom Cartel’s forum advertisement specified “Revenue: from $10 million. Prices from $100 and up.” This targeting ensured that only organizations capable of paying substantial ransoms were pursued, maximizing return on effort.

INC Ransomware and the SonicWall Zero-Day Campaign

While the Ransom Cartel sentencing made headlines, another threat actor was simultaneously demonstrating how ransomware groups are adapting their tactics. INC Ransomware has emerged as the dominant actor exploiting zero-day vulnerabilities in SonicWall SMA 1000 appliances, according to security researchers.

What sets INC apart is its aggressive post-exploitation pressure tactics. After compromising a network through the SonicWall flaw, the group has been directly calling victims by phone to accelerate ransom negotiations. This blend of technical exploitation and psychological pressure represents a significant escalation in how ransomware operators coerce payment.

The tactic underscores a broader shift: ransomware groups are no longer relying solely on encryption to force payment. They combine data theft, doxxing threats, DDoS attacks, and now direct phone contact to create a multi-channel pressure campaign against victims.

Microsoft Defender: Stopping Ransomware in 128 Seconds

On the defensive side, Microsoft announced that its Defender endpoint protection platform can now disrupt ransomware operations in as little as 128 seconds — roughly two minutes from detection to containment. The company demonstrated this capability against the QNET ransomware strain, showing that automated response can outpace human attackers when properly configured.

This development is significant because the window between initial compromise and encryption deployment has been shrinking. Agentic ransomware — AI-assisted attacks that automate reconnaissance, lateral movement, and encryption — are compressing the time defenders have to react. Microsoft’s 128-second disruption claim suggests that equally automated defensive tools can close that gap.

Kernel-Level Evasion and OT Defense Challenges

Security researchers have also warned about kernel-level evasion techniques that ransomware operators are increasingly adopting. By operating at the kernel level, attackers can bypass traditional endpoint detection and response (EDR) solutions, making infections harder to spot before encryption begins.

This is particularly alarming for operational technology (OT) environments — industrial control systems, manufacturing networks, and critical infrastructure. These systems often run legacy software that cannot be easily patched, and the convergence of IT and OT networks means ransomware can leap from corporate email to factory floor with devastating consequences.

Practical Steps for Ransomware Prevention and Recovery

Organizations cannot rely solely on law enforcement takedowns or automated defenses. A layered, proactive approach remains essential:

Strengthen Your Perimeter

• Patch all network appliances — firewalls, VPN concentrators, and SMA devices — immediately when vendors release updates. The SonicWall zero-day exploited by INC Ransomware is a stark reminder that edge devices are prime targets
• Enforce multi-factor authentication on every remote access point, including vendor and contractor accounts
• Segment networks so that a compromise in one zone cannot cascade across the entire organization

Build Resilient Backups

• Maintain offline, immutable backups that ransomware cannot reach or encrypt. Test restoration regularly — a backup you cannot restore is not a backup
• Follow the 3-2-1 rule: three copies of data, on two different media, with one stored offsite
• Consider snapshot-based backup systems that can roll back to pre-encryption states within minutes

Prepare an Incident Response Plan

• Develop and rehearse a ransomware incident response playbook. Know who to call, what to isolate, and when to involve law enforcement
• Establish relationships with forensic firms, legal counsel, and ransomware negotiation specialists before an attack occurs
• Report incidents to the FBI and CISA. Law enforcement can sometimes recover decryptors, as they did in multiple cases involving REvil and other strains

The Road Ahead

The sentencing of the Ransom Cartel creator is a victory, but it is not a solution. The RaaS model means that taking down one operator does not eliminate the malware — affiliates can regroup under new banners, as has happened repeatedly since the original Conti and DarkSide takedowns. Meanwhile, INC Ransomware’s exploitation of zero-day vulnerabilities and phone-based pressure tactics shows that attackers are continuously innovating.

Defenders are innovating too. Microsoft’s 128-second disruption capability and new file resilience tools that stop encryption before it starts represent meaningful progress. But the asymmetry of cyber warfare favors the attacker: they need to succeed once, while defenders must succeed every time.

The most resilient organizations will be those that combine automated detection, tested recovery procedures, and human vigilance into a single, cohesive defense. No single tool — whether a 16-year prison sentence or a 128-second AI response — will end ransomware. But together, they are making the crime riskier, costlier, and harder to execute.

---

Edited by Palawan @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous