Department of Justice says ransomware group exploited Russian government database

A US court has found Latvian hacker Denis Zolotarjovs guilty of a ransomware attack and sentenced him to more than eight years in prison.

The Justice Department accused the hacker of belonging to Russia’s notorious ransomware gang Karakurt. Karakurt is a ransomware gang led by former leaders of the Akira and Conti ransomware gangs, which were sanctioned by the US Treasury for their ties to Russian intelligence.

Prosecutors say Karakurt members targeted U.S. government agencies, disrupted 911 emergency notification systems and stole children’s health information. The Justice Department said Zolotarjovs was responsible for “escalating the pressure” on victims who resisted the gang’s ransom demands.

While Zolotardzhov’s conviction is notable in itself, the ransomware gang used its access to Russian government databases and ties to law enforcement to blackmail its victims, U.S. prosecutors said in a press release, further highlighting the links between the cybercriminals’ activities and the Russian state.

Security researchers have long accused the Russian government of shielding ransomware gangs and malicious hackers from Western law enforcement, including by refusing to extradite citizens accused of hacking. U.S. officials have said in recent years that Russia has become a “safe haven” for cybercriminals, saying the ransomware threat is one of the biggest national security challenges facing the United States.

According to the Justice Department, the Karakurt ransomware group “fueled corruption” in the Russian government. These connections with officials allowed gang leaders to avoid paying taxes to the state, and the gang regularly paid bribes to officials to exempt members from Russian military service.

Russia’s Ministry of Foreign Affairs did not respond to TechCrunch’s request for comment.

According to the Department of Justice, the Karakurt gang targeted more than 54 companies and victims paid at least $15 million in ransoms. Karakurt does not appear to be an active ransomware gang. In some operations, owners and names may be changed to avoid sanctions.

Mr. Zolotarjovs was arrested in Georgia in 2023 and extradited to the United States in August 2024. He later pleaded guilty.

(h/t @realhackhistory.org)