US imprisons Russian botnet operator linked to US-targeted ransomware attacks

Security Affairs reports that the U.S. Department of Justice announced that Russian national Ilya Angelov has been sentenced to two years in prison, fined $100,000, and ordered to pay $1.6 million in money judgment over his co-management of the TA551 cybercrime operation, also known as Mario Kart, which launched a botnet used in ransomware attacks against U.S. organizations.

TA551 built and ran a malware botnet that leveraged spam email attachments, with access to infected computers then sold to other threat actors who later conducted ransomware attacks and blocked victims from the systems while demanding cryptocurrency payments for restoration. Between 2018 and 2019, TA551 provided the BitPaymer operation with access to its botnet.

"The FBI has identified over 70 U.S. corporations that were infected with ransomware by one organization linked to Angelov's group, resulting in over $14 million in extortion payments. Another group that distributed ransomware paid Angelov's group over a million dollars for access to the Mario Kart botnet," said the Justice Department.