Maksim Silnikau, a 40-year-old Belarusian national and the creator of the Ransom Cartel ransomware group, has been sentenced to 16 years in prison in the United States. He was convicted of conspiracy to commit offenses against the US, conspiracy to commit wire fraud, and aggravated identity theft.

Laut Anklagebehörde war Silnikau, alias „J.P. Morgan“, „xxx“ und „lansky“, seit mindestens 2005 in russischsprachigen Cyberkriminalitätsforen aktiv. Von 2011 bis 2016 war er zudem Mitglied der berüchtigten Cyber-Crime-Website Direct Connection, bis die Seite nach der Festnahme des Administrators vom Netz genommen wurde.

In May 2021, Silnikau created the Ransom Cartel ransomware operation and began recruiting cybercriminals through underground forums. He supplied members with stolen credentials, information about compromised computers, and ransomware tools used to encrypt victims' systems. He also operated a hidden website where affiliates could manage attacks, communicate with each other, negotiate ransom payments with victims, and distribute profits.

Between 2021 and 2023, Ransom Cartel affiliates carried out ransomware attacks against at least 18 companies worldwide. During the attacks, the group stole corporate data and demanded ransom payments in exchange for decryption keys or promises not to leak the stolen information.

Federal prosecutors said the group attempted to extort at least $5.2 million from victims. Known losses exceeded $6.7 million, although officials believe the true amount is higher because some attacks were never reported.

Silnikau wurde im Juli 2023 in Spanien festgenommen, entkam jedoch, während er auf die Auslieferung wartete. Später wurde er gefasst, als er versuchte, nach Weißrussland zurückzukehren, von Polen in die USA ausgeliefert und im Eastern District of Virginia strafrechtlich verfolgt.

A hacker behind the Snowflake breach pleads guilty

Ein kanadischer Mann hat sich schuldig bekannt wegen seiner Rolle bei der schwerwiegenden Kompromittierung des Cloud-Speicherunternehmens Snowflake, die mindestens 165 Unternehmen betraf. Der 26-jährige Connor Riley Moucka gestand vor einem US-Bundesgericht Computerbetrug, Telekommunikationsbetrug, erweiterten Identitätsdiebstahl und Verschwörung. Er wird am 27. Oktober verurteilt und drohen ihm bis zu 32 Jahre Haft.

Prosecutors said Moucka and his partners used stolen login details to break into Snowflake customer accounts between February and October 2024. They stole billions of files from companies including AT&T, Ticketmaster, Neiman Marcus and Santander.

Zu den gestohlenen Daten gehörten Bankunterlagen, Passnummern, Führerscheinnummern und Sozialversicherungsnummern. Die Hacker forderten Lösegeld und drohten mit der Online-Veröffentlichung der Daten, falls die Unternehmen die Zahlung verweigerten.

Authorities said the group made about $2.5 million in ransom payments, while Moucka also earned nearly $500,000 by selling stolen data on cybercrime forums. The attacks caused an estimated $9.5 million in losses for victims.

Moucka was arrested in Canada in November 2024 and extradited to the United States in July 2025. Authorities said the hackers gained access by using stolen customer login credentials rather than exploiting a weakness in Snowflake's systems.

Two arrested in Pakistan in connection to Tycoon2FA phishing service

Two Pakistani nationals suspected of developing the Tycoon2FA phishing platform have been arrested in Pakistan after a joint investigation by the Singapore Police Force (SPF), Pakistan's National Cyber Crime Investigation Agency (NCCIA), and Interpol.

Tycoon2FA was a phishing-as-a-service platform that allowed cybercriminals to create fake websites to steal login details and bypass multi-factor authentication. The platform leveraged more than 24,000 domains and has been linked to more than 96,000 phishing victims worldwide. In March 2026, a joint effort seized over 300 domains linked to the service’s core infrastructure.

Die jüngsten Festnahmen fanden am 25. Juni und 1. Juli 2026 statt, nachdem Ermittler Erkenntnisse über die Aktivitäten der Gruppe weitergegeben hatten. Bei Razzien in Islamabad, Faisalabad und Sialkot wurden Computer, Server, Mobilgeräte und Speichermedien beschlagnahmt, während vier weitere Verdächtige aus Pakistan flüchteten und nun Gegenstand von Interpol-Red-Notice-Anfragen sind. Die Behörden geben zudem an, dass die Erlöse aus der Operation in Immobilien in Islamabad investiert wurden, deren Beschlagnahmung nun angestrebt wird.

Ehemaliger FBI-Agent wegen Kryptowährungsdiebstahl im Wert von 925.000 $ angeklagt

A former FBI supervisory special agent has been charged after prosecutors accused him of stealing cryptocurrency using wallet recovery phrases obtained during FBI investigations.

Laut Strafanzeige soll sich Patrick Steven Yaroch die Seed-Phrasen von Wallets, die bei Ermittlungen der Bundesbehörden identifiziert wurden, eingeprägt und genutzt haben, um auf die Gelder zuzugreifen. Den Behörden zufolge führte er zwischen Ende 2024 und Anfang 2025 rund 10 bis 12 Überweisungen durch.

Authorities recovered about $925,426 in cryptocurrency linked to the case, although prosecutors said that may not represent the full amount allegedly taken. They also found about $165,582 in Yaroch's Kraken account.

Court documents say Yaroch admitted to making "very poor decisions" and told investigators he acted out of frustration because the FBI could not seize the wallets. The FBI placed him on leave before firing him, and investigators later recovered electronic devices, a Trezor hardware wallet, and a handwritten seed phrase during a search of his home.

Yaroch wurde am 31. Juli festgenommen und steht unter Anklage wegen zwischenstaatlichen Transports von Diebesgut und Hehlerei.

Demo anfordern

ImmuniWeb kann Ihnen helfen, Datenpannen zu verhindern und regulatorische Anforderungen zu erfüllen.

A scammer indicted in a $14M travel agency fraud scheme

A man from Côte d’Ivoire has been indicted in connection with a $14 million fraud scheme that targeted travel agencies. US prosecutors have charged 30-year-old Koffi Dongo Parfait Teya with conspiracy to commit wire fraud, and unauthorized use of an access device.

According to the indictment, Teya and his associates sent phishing emails pretending to be from an airline reservation service. The emails claimed travel agencies needed a security update and directed employees to fake websites that looked like the real login page. Once employees entered their usernames and passwords, the group allegedly used the stolen credentials to book airline tickets and charge the costs to the agencies' accounts.

Den Behörden zufolge verursachte das Betrugsmanöver Verluste in Höhe von etwa 14 Millionen US-Dollar und betraf rund 430 Reisebüros.

Teya was arrested in Côte d’Ivoire with the help of local law enforcement. Authorities say the man will not be extradited to the United States. Instead, Teya is expected to be charged in Côte d'Ivoire.