[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$frKR2Vsccv7DEt_OllkPdY-2Lu_8BRXvPiYkSjCEpXUQ":3},{"article":4,"iocs":48,"watch_terms":52,"solutions":53,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"893f4798-facf-4533-a219-4e629735725e","Ransom Cartel ransomware creator sentenced to 16 years in prison","ransom-cartel-ransomware-creator-sentenced-to-16-years-in-prison-0426f4","Maksim Silnikau, the creator and administrator of the Ransom Cartel ransomware operation, was sentenced to 16 years in prison for his role in ransomware attacks against at least 18 companies worldwide. [...]","Maksim Silnikau, a 40-year-old Belarusian national and creator of the Ransom Cartel ransomware operation, was sentenced to 16 years in prison for orchestrating attacks against at least 18 companies worldwide between 2021 and 2023. The ransomware-as-a-service operation, which demanded approximately $5.2 million in ransom payments, caused confirmed losses exceeding $6.7 million and disrupted critical operations at healthcare and legal organizations. Silnikau, who had been active in cybercrime forums since 2005, was arrested in Spain in July 2023 and ultimately extradited to the United States after attempting to flee to Belarus.","Ransom Cartel ransomware creator Maksim Silnikau sentenced to 16 years in U.S. prison.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fransom-cartel-ransomware-creator-sentenced-to-16-years-in-prison\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2024\u002F01\u002F18\u002Fdoj-header.jpg","2026-08-05T23:00:50+00:00","2026-08-06T00:00:25.322429+00:00",9,[17,20,23],{"name":18,"type":19},"Maksim Silnikau","threat_actor",{"name":21,"type":22},"Ransom Cartel","campaign",{"name":24,"type":19},"REvil","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":25,"icon":27,"name":28,"slug":29},null,"Ransomware","ransomware",[31,36,38,43],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":37},{"id":25,"icon":27,"name":28,"slug":29},{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49],{"type":50,"value":21,"context":51},"malware","Ransomware-as-a-service operation active 2021–2023, shared code similarities with REvil",[],{"controls":54,"vendors":142},[55,84,113],{"slug":56,"name":57,"problem":58,"products":59},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":85,"name":86,"problem":87,"products":88},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":114,"name":115,"problem":116,"products":117},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[118,126,134],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"veeam","Veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",[],{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":158},"ransom-cartel-creator-sentenced-raas-operations-demand-stronger-ransomware-defenses","Ransom Cartel Creator Sentenced: RaaS Operations Demand Stronger Ransomware Defenses","Maksim Silnikau's Ransom Cartel operation demonstrates how Ransomware-as-a-Service (RaaS) platforms lower the barrier for cybercriminals to launch devastating attacks at scale, targeting critical sectors like healthcare and legal services. The operation caused over $6.7 million in confirmed losses across at least 18 organizations, highlighting how ransomware disproportionately impacts industries with low downtime tolerance. While the 16-year sentence marks a significant law enforcement victory, the years-long campaign underscores that organizations cannot rely solely on prosecution as a deterrent. Proactive defenses — including resilient backups, rapid incident response, and employee awareness — remain the most effective means of reducing ransomware impact before an attack succeeds.",[148,149,150,151,152,153,154,155,156,157],"CIS Control 11 – Data Recovery","CIS Control 17 – Incident Response Management","CIS Control 12 – Network Infrastructure Management","NIST CSF RS.RP-1 – Response Planning","NIST CSF RC.RP-1 – Recovery Planning","NIST SP 800-184 – Guide for Cybersecurity Event Recovery","NIST SP 800-83 – Guide to Malware Incident Prevention and Handling","HIPAA 45 CFR § 164.308(a)(7) – Contingency Plan (for healthcare targets)","GDPR Article 32 – Security of Processing","ITIL 4 – Service Continuity Management",{}]