Loading story…
The U.S. Department of Justice announced the sentencing of Russian national Ilya Angelov for his role in the TA551 cybercrime operation, also known as Mario Kart. Prosecutors said Angelov co-managed a botnet used to facilitate ransomware attacks against organizations in the United States, further tying TA551 to botnet-enabled intrusions that impacted U.S. victims.
Angelov was sentenced to two years in prison, fined $100,000, and ordered to pay a $1.6 million money judgment. The case marks a public attribution of TA551's infrastructure and operations to ransomware activity, underscoring the legal and financial consequences facing operators who provide botnet access and support for downstream attacks.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
The U.S. Department of Justice announced that Russian national Ilya Angelov was sentenced for his role in the TA551 cybercrime operation, also known as Mario Kart. Prosecutors said he co-managed a botnet used to support ransomware attacks against U.S. organizations; he received a two-year prison sentence, a $100,000 fine, and a $1.6 million money judgment.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
6 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcescworld.com
Open sourcescworld.com
Open sourcescworld.com
Open sourcescworld.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A U.S. federal court sentenced Russian national **Aleksei Volkov**, 26, to **81 months in prison** for acting as an initial access broker who helped major cybercrime groups, including the **Yanluowang** ransomware operation, compromise U.S. companies and other organizations. Prosecutors said Volkov gained unauthorized access to victim networks and sold that access to ransomware operators, who then deployed malware, encrypted systems, stole data, and extorted victims through cryptocurrency ransom demands. The U.S. Department of Justice said the campaign caused more than **$9 million in actual losses** and more than **$24 million in intended losses**. Volkov was indicted in Indiana and Pennsylvania, arrested in Rome, extradited from Italy to the United States, and later pleaded guilty after the cases were consolidated. As part of the plea, he admitted hacking victim networks, stealing data, helping co-conspirators deploy ransomware, and sharing in ransom proceeds; he was also ordered to pay at least **$9,167,198.19** in restitution and forfeit equipment used in the crimes.
Jun 29, 2026
The U.S. Department of Justice disrupted the **Kelihos** botnet, a network of more than 100,000 compromised Windows computers allegedly controlled by Russian national **Peter Yuryevich Levashov** (also known as **Peter Severa**). Authorities said Kelihos had operated since 2010 and was used to send spam, steal passwords and credentials, distribute malware, and support pump-and-dump stock fraud. The FBI linked Levashov to the infrastructure through IP addresses and online account records, while working with CrowdStrike and the Shadowserver Foundation to sinkhole the botnet and cut communications between infected machines and their controllers.
Aug 15, 2026
A U.S. federal jury convicted Russian national **Oleg Koshkin** for operating malware crypter services that helped the **Kelihos** botnet evade antivirus detection and spread malicious payloads. Prosecutors said Koshkin ran sites including **Crypt4U.com**, **Crypt4U.net**, **fud.bz**, and **fud.re**, advertising tools that made malware such as botnets, RATs, keyloggers, stealers, crypto miners, and ransomware fully undetectable. Court evidence showed Kelihos operator **Peter Levashov** paid roughly **$3,000 per month** from 2014 to 2017 for custom high-volume re-crypting, while co-defendant **Pavel Tsurkan** pleaded guilty to aiding malware infections worldwide, including ransomware attacks. The conviction builds on the broader U.S. campaign against Kelihos, a botnet active since at least 2010 that at various points controlled **60,000 to more than 100,000 compromised Windows computers**. Authorities said the botnet was used for spam, credential theft, pump-and-dump stock fraud, denial-of-service activity, and malware distribution before the FBI and partners including **CrowdStrike** and the **Shadowserver Foundation** disrupted it through a sinkholing operation and Levashov’s arrest in Spain. Investigators linked Levashov to the infrastructure through IP and account records, with reporting noting operational security mistakes such as reused credentials that helped expose him.
Aug 15, 2026