The Ransom Cartel ransomware operation, developed and managed by Maksim Silnikau starting in May 2021, targeted at least 18 companies globally, stealing data and demanding ransoms for decryption or non-disclosure. The operation functioned as ransomware-as-a-service, with Silnikau recruiting affiliates and initial access brokers, providing tools and stolen credentials, and managing communications and payments through cryptocurrency mixers. The group caused estimated losses exceeding $6.7 million, with some victims paying ransoms up to $300,000. Silnikau was arrested in 2023, fled extradition, was recaptured, and sentenced to 16 years in prison in the United States for conspiracy, wire fraud, and identity theft related to these attacks.

The ransomware attacks disrupted business operations for extended periods, including a medical technology startup and multiple law firms, causing financial losses estimated at over $6.7 million among known victims. Victims faced data theft, operational downtime, and ransom payments. The operation's affiliate model and use of cryptocurrency mixers complicated law enforcement efforts to trace funds. The sentencing of the operator disrupts the ransomware-as-a-service infrastructure behind these attacks.

This threat actor has been apprehended and sentenced, which disrupts the Ransom Cartel ransomware operation. No specific patch or remediation applies to this threat. Organizations should continue to follow best practices for ransomware defense and incident response. There is no vendor advisory or patch related to this threat actor or ransomware variant.