Malware

Ransom Cartel

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

7 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1583Acquire InfrastructureEvidence1

The same document preserves the advertisement his conspiracy posted to a Russian-language cybercrime forum on May 4, 2021, seeking access to corporate networks anywhere outside the Commonwealth of Independent States.

Initial Access

2 techniques

T1078Valid AccountsEvidence2

He built the business around them: the locking software, the stolen credentials he bought from initial access brokers, and a hidden panel where affiliates monitored attacks, negotiated with victims and split proceeds.

T1133External Remote ServicesEvidence1

Silnikau reportedly held a central role in the ransomware-as-a-service operation, recruiting affiliates, working with initial access brokers who supplied access to compromised corporate networks...

Persistence

2 techniques

T1078Valid AccountsEvidence2

T1133External Remote ServicesEvidence1

Silnikau reportedly held a central role in the ransomware-as-a-service operation, recruiting affiliates, working with initial access brokers who supplied access to compromised corporate networks...

Privilege Escalation

1 technique

T1078Valid AccountsEvidence2

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence1

Ransom Cartel launched publicly in December 2021 and shared code similarities with the REvil ransomware encryptor. However, the lack of some of REvil's obfuscation features led researchers to believe that it may have been created by a former core member of the operation...

T1078Valid AccountsEvidence2

Exfiltration

1 technique

T1537Transfer Data to Cloud AccountEvidence1

During the attacks, the threat actors stole corporate data and demanded payments in exchange for decryption keys or promises that the stolen information would not be publicly leaked.

Impact

2 techniques

T1486Data Encrypted for ImpactEvidence2

T1657Financial TheftEvidence1

During the attacks, the threat actors stole corporate data and demanded payments in exchange for decryption keys or promises that the stolen information would not be publicly leaked.

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

security weekNews

Aug 6, 2026

Belarusian Ransom Cartel Mastermind Gets 16 Years in Prison - SecurityWeek

Ransomware operation used to target organizations, steal victim data, encrypt systems, and demand payment in exchange for decryption keys or a promise not to publish stolen information.

the hacker newsNews

Aug 6, 2026

Ransom Cartel Creator Gets 16 Years in Prison for Operating Ransomware-as-a-Service

A ransomware-as-a-service operation run by Maksim Silnikau that provided locking software, used stolen credentials bought from initial access brokers, and operated a hidden affiliate panel for monitoring attacks, negotiating with victims, and splitting proceeds.

bleeping computerNews

Aug 5, 2026

Ransom Cartel ransomware creator sentenced to 16 years in prison

A ransomware-as-a-service operation used to encrypt victims' computers, steal corporate data, extort victims for decryption keys or non-leak promises, and manage affiliate attacks through a dedicated portal.

cert eu threat intelNews

Apr 9, 2024

Cyber Brief 24-09 - August 2024

Ransomware-as-a-Service (RaaS) operation involved in extortion and data encryption attacks.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping7

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Ransom Cartel

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

7 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1583Acquire InfrastructureEvidence1

Initial Access

2 techniques

T1078Valid AccountsEvidence2

T1133External Remote ServicesEvidence1

Silnikau reportedly held a central role in the ransomware-as-a-service operation, recruiting affiliates, working with initial access brokers who supplied access to compromised corporate networks...

Persistence

2 techniques

T1078Valid AccountsEvidence2

T1133External Remote ServicesEvidence1

Silnikau reportedly held a central role in the ransomware-as-a-service operation, recruiting affiliates, working with initial access brokers who supplied access to compromised corporate networks...

Privilege Escalation

1 technique

T1078Valid AccountsEvidence2

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence1

T1078Valid AccountsEvidence2

Exfiltration

1 technique

T1537Transfer Data to Cloud AccountEvidence1

During the attacks, the threat actors stole corporate data and demanded payments in exchange for decryption keys or promises that the stolen information would not be publicly leaked.

Impact

2 techniques

T1486Data Encrypted for ImpactEvidence2

T1657Financial TheftEvidence1

During the attacks, the threat actors stole corporate data and demanded payments in exchange for decryption keys or promises that the stolen information would not be publicly leaked.

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

security weekNews

Aug 6, 2026

Belarusian Ransom Cartel Mastermind Gets 16 Years in Prison - SecurityWeek

Ransomware operation used to target organizations, steal victim data, encrypt systems, and demand payment in exchange for decryption keys or a promise not to publish stolen information.

the hacker newsNews

Aug 6, 2026

Ransom Cartel Creator Gets 16 Years in Prison for Operating Ransomware-as-a-Service

bleeping computerNews

Aug 5, 2026

Ransom Cartel ransomware creator sentenced to 16 years in prison

cert eu threat intelNews

Apr 9, 2024

Cyber Brief 24-09 - August 2024

Ransomware-as-a-Service (RaaS) operation involved in extortion and data encryption attacks.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping7

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.