Loading story…
A U.S. federal court sentenced Russian national Aleksei Volkov, 26, to 81 months in prison for acting as an initial access broker who helped major cybercrime groups, including the Yanluowang ransomware operation, compromise U.S. companies and other organizations. Prosecutors said Volkov gained unauthorized access to victim networks and sold that access to ransomware operators, who then deployed malware, encrypted systems, stole data, and extorted victims through cryptocurrency ransom demands.
The U.S. Department of Justice said the campaign caused more than $9 million in actual losses and more than $24 million in intended losses. Volkov was indicted in Indiana and Pennsylvania, arrested in Rome, extradited from Italy to the United States, and later pleaded guilty after the cases were consolidated. As part of the plea, he admitted hacking victim networks, stealing data, helping co-conspirators deploy ransomware, and sharing in ransom proceeds; he was also ordered to pay at least $9,167,198.19 in restitution and forfeit equipment used in the crimes.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
U.S. prosecutors charged Angelo Martino as a third negotiator tied to BlackCat/ALPHV ransomware attacks, alleging he helped pressure at least 10 victims into paying higher ransoms while working for DigitalMint. Authorities also seized nearly $9.2 million in cryptocurrency and other assets connected to the case.
The Southern District of Indiana sentenced Volkov to 81 months in prison for assisting major cybercrime groups, including the Yanluowang ransomware gang. He was also ordered to pay at least $9,167,198.19 in restitution and forfeit equipment used in the crimes.
Volkov pleaded guilty after the Indiana and Pennsylvania cases were consolidated. In his plea, he admitted to hacking victim networks, stealing data, enabling ransomware deployment through co-conspirators, and sharing in ransom proceeds.
After being charged, Volkov was arrested in Rome and transferred from Italy to the United States to face prosecution. The extradition enabled the U.S. cases against him to proceed.
U.S. prosecutors charged Volkov in separate cases in the Southern District of Indiana and the Eastern District of Pennsylvania for his role in intrusions and ransomware-enabling activity. The cases were later consolidated.
Aleksei Volkov acted as an initial access broker, hacking into victim networks and selling that access to cybercrime groups including the Yanluowang ransomware gang. The resulting intrusions led to data theft, ransomware deployment, and extortion against numerous U.S. companies and organizations, causing more than $9 million in actual losses and more than $24 million in intended losses.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
12 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecyberscoop.com
Open sourcesecurityaffairs.com
Open sourceitpro.com
Open sourcejustice.gov
Open sourcedatabreaches.net
Open sourceinfosec.pub
Open sourceismg-cdn.nyc3.cdn.digitaloceanspaces.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Aleksei Olegovich Volkov, a Russian national, pleaded guilty in the United States to charges related to his role as an initial access broker (IAB) for the Yanluowang ransomware group. Volkov provided access to at least seven U.S. organizations between July 2021 and November 2022, enabling the deployment of ransomware that resulted in ransom demands ranging from $300,000 to $15 million. He received a percentage of the ransom payments, including $94,259 from a $500,000 ransom and $162,220 from a $1 million ransom, and was ordered to pay nearly $9.2 million in restitution to affected organizations. Volkov's activities were uncovered through digital forensics, including chat logs, cryptocurrency records, and social media accounts, and he was extradited to the U.S. after being apprehended in Rome. The indictment and plea agreement detail Volkov's collaboration with co-conspirators, his use of aliases such as "chubaka.kor," and his involvement in negotiating ransom payments and providing network credentials to the Yanluowang group. The attacks affected a range of U.S. businesses, including engineering firms, banks, and telecommunications providers, with some victims able to restore from backups and avoid ransom payments. Volkov faces up to 53 years in prison for charges including access device fraud, aggravated identity theft, and conspiracy to commit money laundering and computer fraud.
Jun 29, 2026Aleksei Olegovich Volkov, a Russian national operating under the alias 'chubaka.kor', pleaded guilty to hacking into U.S. companies and selling network access to ransomware groups, specifically those deploying the Yanluowang ransomware. Volkov used various techniques to compromise employee accounts, escalate privileges, and then brokered access to other cybercriminals, facilitating ransomware attacks on at least seven U.S. organizations, including a bank, a telecommunications company, and an engineering firm. Court documents reveal that two of the victims paid ransoms totaling $1.5 million in Bitcoin, with Volkov receiving a portion of the proceeds. Volkov's activities spanned from July 2021 to November 2022, after which the Yanluowang group ceased operations following a hack and leak of their internal data. He was arrested in 2024 after relocating to Rome and subsequently extradited to the United States, where he now faces up to 50 years in prison and fines up to $1 million, along with restitution to victims. The case highlights the significant role of initial access brokers in enabling ransomware operations and the ongoing law enforcement efforts to disrupt such cybercriminal supply chains.
Jun 29, 2026
U.S. prosecutors announced two significant ransomware case outcomes: Armenian national **Karen Serobovich Vardanyan** pleaded guilty to conspiracy and computer fraud for helping compromise U.S. organizations and deploy **Ryuk** ransomware, while Florida resident **Angelo Martino** was sentenced to **70 months** for assisting the **BlackCat/ALPHV** gang. Court records say Vardanyan provided initial access to victim networks between November 2019 and April 2020, with victims including a Michigan company, a technology firm in Wilsonville, Oregon, and a Texas school. Prosecutors linked Vardanyan and his co-conspirators to roughly **1,610 bitcoin** in ransom payments, valued at about **$15 million** at the time. Vardanyan was arrested in Kyiv in April 2025, extradited to the United States in 2025, and now faces up to **15 years in prison**, fines of **$250,000 per charge**, and more than **$1.1 million** in restitution; sentencing is scheduled for September 2026. In the separate BlackCat/ALPHV case, Martino was convicted for abusing his position as a ransomware negotiator to share confidential victim negotiation information with attackers, and his co-conspirators **Ryan Goldberg** and **Kevin Martin** had already received four-year prison terms. The cases underscore continued U.S. efforts to disrupt both ransomware operators and the support networks that enable extortion campaigns.
Jul 12, 2026