cyber.hendryadrian.com
Security News · thecyberexpress.com

Mario Kart Botnet Operator Sentenced to 61 Months for Selling Access to Ransomware Groups

· Original article ↗

Summary

A U.S. court sentenced Illya Angelov to 61 months for operating the Mario Kart botnet, which prosecutors said infected about 3,000 computers daily and sold backdoor access used by ransomware groups targeting 72 companies.

Key points

  • Prosecutors said the Mario Kart operation ran from 2017 to 2021, sending about 700,000 emails and infecting roughly 3,000 computers daily.
  • The botnet provided a backdoor for uploading software; operators sold access to other criminal groups that typically used it for ransomware extortion.
  • Prosecutors attributed victims across 72 companies in 31 U.S. states to the operation.
  • Angelov pleaded guilty to conspiracy to commit wire fraud and was sentenced to 61 months in prison, a $100,000 fine, and a $1.6 million money judgment.
  • The sentence reflected Angelov’s cooperation and voluntary surrender; prosecutors sought 61 months despite advisory guidelines calling for more than 12 years.
  • The case is part of a DOJ effort to target botnet operators and access brokers supplying infrastructure to ransomware groups.

Article Details

Event Type
Federal sentencing of Illya Angelov for operating the Mario Kart botnet and selling access to compromised computers.
Impact
The operation reportedly infected approximately 3,000 computers daily and sold backdoor access used by criminal groups in ransomware extortion schemes affecting 72 companies across 31 U.S. states. Angelov received a 61-month sentence, a $100,000 fine, and a $1.6 million money judgment.

MITRE ATT&CK

T1105 · Ingress Tool TransferThe botnet backdoor enabled additional malicious software to be uploaded to victims' computers.T1486 · Data Encrypted for ImpactThe article says customers used the access to deploy ransomware that encrypted victims' data.T1566.001 · Spearphishing AttachmentThe Mario Kart operation distributed malware-infected files as email attachments in spam messages.

Threat Actors

Aleksei VolkovThe article reports that Volkov was sentenced for supplying network access to the Yanluowang ransomware group.Illya AngelovAngelov pleaded guilty to conspiracy to commit wire fraud for operating the Mario Kart botnet and selling access to compromised computers.Mario KartThe FBI name for the criminal organization that operated a botnet, distributed malware, and sold backdoor access to other criminal groups.Vitlalii Alexandrovich BalintBalint provided essential coding for Mario Kart and was sentenced to 20 months in prison for his role in the operation.Vyacheslav Igorevich PenchukovThe article identifies Penchukov as a member of a group that negotiated payment to Angelov and another individual for access to Mario Kart.YanluowangThe article identifies Yanluowang as a ransomware group supplied with network access by Aleksei Volkov.

Malware

Mario KartA federal court sentenced Russian national Illya Angelov for operating the Mario Kart botnet that infected thousands of computers daily and sold backdoor access to ransomware groups, victimizing 72 companies across 31

Countries

SwitzerlandAngelov was sentenced four years after an associate, Vyacheslav Igorevich Penchukov, was arrested in Switzerland and later extradited to the U.S.United KingdomAt the time of his travel and surrender, he was living in the United Kingdom, a country from which the U.S.United Statesof computers daily and sold backdoor access to ransomware groups, victimizing 72 companies across 31 U.S.