DoJ Sentences Russian Initial Access Broker to 6 Years in Prison

The Department of Justice this week announced it has sentenced a Russian citizen who served as an initial access broker and facilitated numerous attacks by the Yanluowang ransomware group.

Aleksei Volkov, 26, of St. Petersburg, was sentenced to almost seven years in prison, the DoJ said Monday. As an initial access broker, Volkov sniffed out vulnerabilities in various organization networks and systems before selling that access to cybercriminals. Through this process, between 2021 and 2022 Volkov helped facilitate dozens of ransomware attacks in the U.S., which caused over $9 million in actual losses (and over $24 million in intended losses).  

“The defendant in this case helped set in motion cybercrime attacks targeting dozens of U.S. companies and organizations, including ones by the notorious Yanluowang ransomware group,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division, in a statement. “The Department of Justice will continue to pursue cybercriminals like Mr. Volkov wherever they operate and ensure that they face consequences for their actions.”

Yanluowang, which began operations in August 2021, is known for targeting organizations worldwide, including those in the financial, manufacturing, and engineering sectors. In the U.S., organizations across multiple states - including Michigan, California, and Pennsylvania – were hit by Yanluowang in attacks linked back to Volkov’s assistance. 

In 2022, the ransomware gang’s chat, builder, and decryption source were leaked, revealing details about its inner workings and tactics.

While we see many U.S. indictments of ransomware operators and affiliates, these are often difficult to follow up on due to the nature of safe haven countries. However, actual prison sentences like this one against Volkov hold much more weight as they have direct ramifications on cybercriminals, as well as indirect impacts on their relationships, connections, and ultimately operations.

Volkov was initially arrested in Rome, Italy, and was extradited to the U.S. He pleaded guilty in November to charges via two indictments, which included unlawful transfer of a means of identification, trafficking in access information, access device fraud, and aggravated identity theft; conspiracy to commit computer fraud and conspiracy to commit money laundering.

He also agreed to pay full restitution to known victims, which includes paying at least $9,167,198.19 to compensate them for their actual losses.