Latvian Karakurt Negotiator Sentenced for Conti-Linked Ransomware Extortion

A U.S. court sentenced Latvian national Deniss Zolotarjovs to 102 months in prison for his role in a Russia-linked ransomware and data-extortion organization run by former Conti members and operating under brands including Karakurt, Royal, TommyLeaks, SchoolBoys Ransomware, and Akira. Prosecutors said Zolotarjovs acted as a primary negotiator and extortion specialist from June 2021 to August 2023, researching victims, analyzing stolen data, setting ransom pressure points, and taking a share of proceeds. He was arrested in Georgia in December 2023, extradited to the United States in August 2024, and later pleaded guilty to conspiracy to commit wire fraud and money laundering.

The Justice Department said the group targeted more than 54 companies, collected roughly $15 million to $16 million in confirmed ransom payments, and caused at least $56 million in documented losses across 13 victims, with total damage likely reaching hundreds of millions of dollars. Authorities said the operation exposed highly sensitive personal data, including children’s medical records stolen from a pediatric healthcare provider that were later used to threaten victims and even sent to hundreds of patients, while another attack forced a U.S. government entity’s 911 emergency system offline. Court filings and reporting also said the syndicate relied on front companies, corrupt contacts, and access to Russian government databases, underscoring the professionalized and well-connected structure behind the extortion campaign.