A federal judge in the Eastern District of Virginia sentenced Maksim Silnikau, 40, a Belarusian national, to 16 years in prison on August 5, 2026.

The charge sheet covers Ransom Cartel, the ransomware-as-a-service operation Silnikau stood up in 2021 and ran until 2023. Prosecutors identified at least 18 victim organizations, including firms in California, New York and Nebraska plus others abroad, $5.2 million in attempted extortion and more than $6.7 million in identified losses. The Justice Department noted the real total is almost certainly higher, because some victims never reported.

Ransom Cartel is the smallest thing on his record.

Angler, Reveton, and Nearly Twenty Years of Continuity

Silnikau operated on Russian-speaking cybercrime forums for close to two decades under the handles “J.P. Morgan,” “targa,” “lansky” and “xxx.” Investigators describe him as one of the most prolific Russian-speaking cybercriminals of the period, and the case file supports it.

Reveton (2011–2014) was the scareware scheme that locked victims’ screens with a fake law-enforcement notice demanding a fine for imaginary offenses. It generated approximately $400,000 a month at its peak. It is also the direct ancestor of modern ransomware: the same coercion model, the same payment mechanism, the same reliance on a victim who does not know whether the message is real.

Angler (mid-2010s) was one of the most widely deployed exploit kits ever built — the drive-by infection infrastructure that fed malware to millions of machines via compromised advertising and hacked websites. If you worked in security defense in 2015, you spent time on Angler whether you knew who was behind it or not.

Ransom Cartel (2021–2023) was the ransomware-as-a-service iteration.

Three business models across three eras of the criminal economy, all run by the same operator, all monetizing the same underlying capability: mass access to victim machines, converted to cash by whatever extortion mechanism the market currently rewards.

The Sentence Is Long Because the Record Is Long

Sixteen years is at the high end of what US courts have handed down in ransomware cases. For comparison, we covered Noah Urban’s 10-year sentence in the Scattered Spider prosecutions and the AlphV/BlackCat sentencings of Ryan Goldberg and Kevin Martin earlier this year.

Silnikau got substantially more, and the reason is not the size of Ransom Cartel. Eighteen victims and $6.7 million is a mid-tier RaaS operation by 2026 standards — smaller than a single quarter of Qilin’s output. The sentence reflects the two decades behind it.

That is a meaningful signal for how these prosecutions now work. Courts are sentencing the career, not the count. An operator who can be tied to a continuous criminal record spanning Reveton through Angler through RaaS is not being treated as a defendant in a ransomware case; he is being treated as long-term organized crime infrastructure.

How He Was Caught

Silnikau was arrested in Spain in July 2024 and extradited to the United States via Poland.

Two co-defendants remain charged in absentia: Vladimir Kadariya, 38, a Belarusian-Ukrainian national, and Andrei Tarasov, 33, a Russian national. Neither is in custody.

That ratio — one in prison, two beyond reach — is the standing reality of these cases, and it is the same one that just played out in the Snowflake prosecutions, where Connor Moucka pleaded guilty while John Binns remains outside US custody. Enforcement reaches operators who travel, and Silnikau’s mistake was Spain. Kadariya and Tarasov appear not to have made it.

We traced this pattern across the full year in the 2026 cybercrime arrest wave: the arrests that land are geography-dependent, not capability-dependent. Nothing about Silnikau’s tradecraft failed. He entered a jurisdiction with an extradition treaty.

What a 16-Year Sentence Actually Removes

Ransom Cartel shut down in 2023. Angler was dismantled a decade ago. Reveton has been dead since 2014.

By the time Silnikau was sentenced, none of the operations he ran were still generating victims. That is normal — the interval between arrest and sentencing in these cases runs to years — but it should temper any reading of this as a disruption event. It is a punishment event.

The disruption value is deterrent and informational. A 16-year sentence establishes a ceiling that Russian-speaking forum operators can see, and the case file establishes that investigators can build a continuous attribution chain across twenty years and three distinct criminal enterprises run under four handles. The second point is the one that should worry the ecosystem more. Handle rotation and business-model pivots have historically been effective at breaking attribution. In this case they did not.

What the sentence does not remove is a single active operation. Ransom Cartel’s affiliates went somewhere in 2023. Everyone who bought access through Angler learned the model. The capability Silnikau monetized three separate times still exists, distributed across an ecosystem that no longer depends on any individual operator’s survival — which is precisely the resilience we described in the self-reinforcing supply chain cybercrime economy.

Sixteen years is the right sentence. It is not a solution.

Sources