Karakurt Extortion Negotiator Deniss Zolotarjovs Sentenced to 8.5 Years
Summary
Deniss Zolotarjovs was sentenced to 8.5 years in the U.S. after pleading guilty to wire-fraud and money-laundering conspiracy. The FBI linked him to at least six extortion cases, where stolen personal and children's health data was used to pressure victims.
Key points
- Zolotarjovs was extradited to the United States, pleaded guilty in July 2025, and was sentenced to 8.5 years in prison.
- According to court documents, he acted as a Karakurt “cold case” negotiator, reviving stalled extortion efforts against victim companies.
- The article says he analyzed stolen personal and health information, including children's health data, to increase pressure on victims.
- The FBI linked him to at least six extortion cases against U.S. organizations between August 2021 and November 2023.
- The Department of Justice cited more than $56 million in losses across 13 companies and estimated total losses could reach hundreds of millions; it said the figures were uncertain and incomplete.
- The article reports that two former Sygnia and DigitalMint employees were separately sentenced for targeting U.S. companies in BlackCat (ALPHV) attacks.
Article Details
- Event Type
- U.S. sentencing of Deniss Zolotarjovs after he pleaded guilty to conspiracy to commit wire fraud and money laundering for his role as a “cold case” negotiator for the Karakurt extortion operation.
- Impact
- The FBI linked Zolotarjovs to at least six extortion cases against U.S. organizations between August 2021 and November 2023. The article reports that attacks on 13 companies caused over $56 million in losses, including approximately $2.8 million in ransom payments; the government estimated total losses for the period could be in the hundreds of millions, while noting underreporting and incomplete loss statements. A government entity’s 911 system was reportedly forced offline.
People
Threat Actors
AkiraNamed by the article as a ransomware group associated with attacks against victim organizations linked to Zolotarjovs.ALPHVAlternate name explicitly given by the article for BlackCat, whose ransomware attacks were the subject of separate sentences for two former employees.BlackCatThe article identifies BlackCat as a ransomware operation involved in attacks for which two former employees were sentenced. The article also gives ALPHV as an alternate name.ContiThe article identifies Conti as a ransomware group and says Karakurt was led by former Conti leaders; it also associates Zolotarjovs with attacks by Conti.Deniss ZolotarjovsThe article reports that he pleaded guilty to conspiracy to commit wire fraud and money laundering and served as a “cold case” negotiator for Karakurt, helping revive extortion demands against victims.KarakurtThe article identifies Karakurt as an extortion operation whose members compromised company systems, stole data, and demanded ransom under threat of disclosure or sale.RoyalNamed by the article as a ransomware group associated with attacks against victim organizations linked to Zolotarjovs.SchoolBoysNamed by the article as a ransomware group associated with attacks against victim organizations linked to Zolotarjovs.Sforza_cesariniOnline alias explicitly attributed by the article to Deniss Zolotarjovs, who served as a “cold case” negotiator for Karakurt.TommyLeaksNamed by the article as a ransomware group associated with attacks against victim organizations linked to Zolotarjovs.
Countries
GeorgiaDeniss Zolotarjovs was arrested in Georgia, extradited to the U.S., pleaded guilty in July 2025, and sentenced to 8.5 years.Russia35-year-old Deniss Zolotarjovs (ÐениÑÑ ÐолоÑаÑÑвÑ) of Moscow, Russia, was arrested in Georgia, Eastern Europe, in December 2023, and pleaded guilty in July 2025 to conspiracy to commit wire fraud andUnited StatesA Latvian national, Deniss Zolotarjovs, was extradited to the United States and sentenced to 8.5 years for acting as a “cold case” negotiator for the Karakurt extortion group.