Botnet Manager Sentenced to Two Years for Role in BitPaymer Attacks
Summary
Ilya Angelov was sentenced to two years after admitting his phishing botnet was used in BitPaymer attacks against 72 U.S. companies. The FBI linked related activity to over $14 million in extortion payments.
Key points
- Ilya Angelov pleaded guilty to managing a phishing botnet used to deliver malware and support BitPaymer ransomware attacks against 72 U.S. companies.
- The FBI identified over 70 U.S. corporations infected with ransomware by an organization linked to Angelov’s group, with more than $14 million in extortion payments.
- The Mario Kart/TA551 operation’s spam campaigns could send 700,000 emails daily and infect about 3,000 computers per day at their peak.
- The group sold access to infected devices to other cybercriminals; IcedID paid Angelov and associates about $1 million for botnet access, though the resulting damage is unknown.
- Aleksey Volkov was sentenced to nearly seven years for acting as an initial access broker for Yanluowang ransomware attacks.
Article Details
- Event Type
- Criminal sentencing following a guilty plea for managing a phishing botnet used in ransomware attacks.
- Impact
- Ilya Angelov was sentenced to two years in prison after admitting that the botnet was used in BitPaymer attacks against 72 U.S. companies. The FBI attributed more than $14 million in extortion payments to attacks linked to the operation. At its peak, its campaigns could send 700,000 emails and infect approximately 3,000 computers per day. Angelov's crew reportedly received about $1 million from IcedID operators for botnet access; the resulting damage is not known. Aleksey Olegovich Volkov was separately sentenced to nearly seven years after pleading guilty to acting as an initial access broker for Yanluowang ransomware attacks.
MITRE ATT&CK
Threat Actors
Aleksey Olegovich VolkovVolkov pleaded guilty to acting as an initial access broker for Yanluowang ransomware attacks and was sentenced to nearly seven years in prison.ATK236Alternate name used by threat analysts for the operation tracked by the FBI as Mario Kart and also tracked as TA551.G0127Alternate name used by threat analysts for the operation tracked by the FBI as Mario Kart and also tracked as TA551.Gold CabinAlternate name used by threat analysts for the operation tracked by the FBI as Mario Kart and also tracked as TA551.IcedIDThe source identifies IcedID as a cybercrime gang that paid Angelov and his accomplices about $1 million for botnet access; it also describes IcedID as a banking trojan.Ilya AngelovAngelov pleaded guilty to managing a phishing botnet used to distribute malware and enable BitPaymer ransomware attacks. The source says he used the online handles “milan” and “okart.”LockeanThe source describes Lockean as a ransomware operation with which TA551 collaborated.Mario KartName used by the FBI for the Russian cybercriminal operation whose phishing botnet was managed by Ilya Angelov and used to distribute malware and enable ransomware attacks.MilanOnline handle used by Ilya Angelov, whom the source says pleaded guilty to managing a phishing botnet used in ransomware attacks.Monster LibraAlternate name used by threat analysts for the operation tracked by the FBI as Mario Kart and also tracked as TA551.OkartOnline handle used by Ilya Angelov, whom the source says pleaded guilty to managing a phishing botnet used in ransomware attacks.ShathakAlternate name used by threat analysts for the operation tracked by the FBI as Mario Kart and also tracked as TA551.TA551Threat analysts tracked the operation as TA551; the source also identifies it by the names Mario Kart, Shathak, GOLD CABIN, Monster Libra, ATK236, and G0127.Trickbot GroupThe source describes the TrickBot gang as having partnered with TA551 in phishing campaigns that deployed Conti ransomware.Wizard SpiderThe source gives Wizard Spider as another name for the TrickBot gang, which it says partnered with TA551 in phishing campaigns.YanluowangRansomware operation for which Aleksey Olegovich Volkov pleaded guilty to acting as an initial access broker.
Malware
BitpaymerA Russian national, Ilya Angelov, was sentenced to two years in prison after admitting that the phishing botnet he managed was used to deliver malware and enable BitPaymer ransomware attacks against 72 U.S.ContiTA551 operators also partnered with the notorious TrickBot gang (Wizard Spider) in phishing campaigns that deployed Conti ransomware on targets’ compromised systems.DoppelPaymera collaborator in the Lockean ransomware operation, helping its affiliates drop ProLock, Egregor, and DoppelPaymer ransomware payloads on devices infected with the Qbot/QakBot banking trojan.EgregorTA551 as a collaborator in the Lockean ransomware operation, helping its affiliates drop ProLock, Egregor, and DoppelPaymer ransomware payloads on devices infected with the Qbot/QakBot banking trojan.IcedIDcampaigns that infected thousands of machines, sold access to ransomware affiliates (including ties to IcedID and TrickBot partners), and led to over $14 million in extortion payments.ProLockalso flagged TA551 as a collaborator in the Lockean ransomware operation, helping its affiliates drop ProLock, Egregor, and DoppelPaymer ransomware payloads on devices infected with the Qbot/QakBot banking trojan.Qbot/QakBotaffiliates drop ProLock, Egregor, and DoppelPaymer ransomware payloads on devices infected with the Qbot/QakBot banking trojan.TrickBotthat infected thousands of machines, sold access to ransomware affiliates (including ties to IcedID and TrickBot partners), and led to over $14 million in extortion payments.