Russian Cybercriminal Sentenced to Two Years for Botnet Role
Summary
Ilya Angelov, who pleaded guilty to helping administer a botnet used to facilitate ransomware attacks, was sentenced to two years in federal prison, fined $100,000 and ordered to pay a $1.6 million money judgment.
Key points
- The DOJ announced that Angelov, also known as “Milan” and “Okart,” received a 24-month federal prison sentence.
- Court documents say Angelov pleaded guilty and had been in custody since 2023.
- The DOJ said his group built a botnet from 2017 to 2021 by distributing malware through spam email attachments and selling access for ransomware deployment.
- The FBI tracked the group as Mario Kart; it is also known as TA-551 and Shathak, among other names.
- The DOJ cited ransomware attacks facilitated by the botnet against more than 70 U.S. corporations and $14 million in ransom payments.
- Angelov was also fined $100,000 and received a $1.6 million money judgment allowing the government to seize assets tied to criminal proceeds.
Article Details
- Event Type
- Criminal sentencing of a cybercriminal for administering a botnet used to facilitate ransomware attacks.
- Impact
- Ilya Angelov received a two-year federal prison sentence, a $100,000 fine, and a $1.6 million money judgment. The DOJ said the botnet facilitated ransomware attacks against more than 70 US corporations, with $14 million in ransom payments.
Threat Actors
Aleksei VolkovThe article reports that he was sentenced to 81 months in prison for his role in ransomware attacks.ATK236Name used by the cybersecurity community for the threat group tracked by the FBI as Mario Kart, which the article says included Ilya Angelov.G0127Name used by the cybersecurity community for the threat group tracked by the FBI as Mario Kart, which the article says included Ilya Angelov.Gold CabinName used by the cybersecurity community for the threat group tracked by the FBI as Mario Kart, which the article says included Ilya Angelov.Ilya AngelovPleaded guilty to his role in administering a botnet used to facilitate ransomware attacks and was sentenced to two years in federal prison.Mario KartName used by the FBI to track the threat group that the article says included Ilya Angelov and administered a botnet used to facilitate ransomware attacks.MilanOnline alias of Ilya Angelov, whom the DOJ said played a role in administering a botnet used to facilitate ransomware attacks.Monster LibraName used by the cybersecurity community for the threat group tracked by the FBI as Mario Kart, which the article says included Ilya Angelov.OkartOnline alias of Ilya Angelov, whom the DOJ said played a role in administering a botnet used to facilitate ransomware attacks.ShathakName used by the cybersecurity community for the threat group tracked by the FBI as Mario Kart, which the article says included Ilya Angelov.TA-551Name used by the cybersecurity community for the threat group tracked by the FBI as Mario Kart, which the article says included Ilya Angelov.
Malware
EmotetTA-551 was known to distribute malware such as Emotet, IcedID, Qbot, and Ursnif.IcedIDTA-551 was known to distribute malware such as Emotet, IcedID, Qbot, and Ursnif.QbotTA-551 was known to distribute malware such as Emotet, IcedID, Qbot, and Ursnif.UrsnifTA-551 was known to distribute malware such as Emotet, IcedID, Qbot, and Ursnif.