Russian Access Broker Sentenced to 81 Months for Yanluowang Ransomware Role
Summary
Aleksei Volkov was sentenced to 81 months after pleading guilty to helping Yanluowang ransomware operators access company networks. The DOJ says attacks caused over $9 million in losses; Volkov agreed to pay more than $9 million in restitution.
Key points
- Russian national Aleksei Volkov, 26, was sentenced to 81 months in prison.
- Volkov pleaded guilty to helping co-conspirators hack company networks, steal data, deploy ransomware, and demand ransom.
- He acted as an initial access broker, obtaining access to targeted organizations’ systems and passing it to other operation members.
- The DOJ said the attacks caused more than $9 million in losses, while the operators attempted to extort $24 million.
- Volkov was arrested in Rome by Italian police, extradited to the US, and agreed to pay more than $9 million in restitution.
- The Yanluowang group was active in 2021 and 2022; Cisco previously attributed a 2022 attack to an initial access broker with ties to UNC2447 and Lapsus$.
Article Details
- Event Type
- Criminal sentencing for ransomware-related cybercrime
- Impact
- Aleksei Volkov was sentenced to 81 months in prison after pleading guilty to participating in ransomware attacks involving network intrusions, data theft, ransomware deployment, and ransom demands. The DOJ said the attacks caused more than $9 million in losses and involved attempted extortion of $24 million; Volkov agreed to pay more than $9 million in restitution.
Threat Actors
Aleksei VolkovThe DOJ said Volkov served as an initial access broker for ransomware attacks. He pleaded guilty to participating in intrusions, data theft, ransomware deployment, and ransom demands, and was sentenced to 81 months in prison.LAPSUS$Cisco's mid-2022 information reportedly attributed the attack against Cisco to an initial access broker with ties to Lapsus$.UNC2447Cisco's mid-2022 information reportedly attributed the attack against Cisco to an initial access broker with ties to the Russia-linked threat actor UNC2447.YanluowangThe article identifies Yanluowang as a ransomware group active in 2021 and 2022 and says Volkov was accused of participating in its attacks.
Malware
Countries
RussiaInformation shared by the networking giant in mid-2022 attributed the attack to an initial access broker with ties to the Russia-linked threat actor UNC2447 and to Lapsus$.United StatesFollowing his indictment, Volkov was arrested by Italian police in Rome and later extradited to the US to stand trial.