A court in the Southern District of Indiana sentenced Russian citizen Aleksei Volkov, 26, to 81 months in prison Monday for assisting major cybercrime groups including the Yanluowang ransomware group in attacks that caused over $9 million in actual losses and over $24 million in intended losses across the United States.

Volkov, of St. Petersburg, Russia, operated as an "initial access broker"—a specialist who gains unauthorized access to corporate networks and sells that access to other threat actors, according to court documents. His buyers used the access to deploy ransomware that encrypted victims' data, then demanded cryptocurrency payments—"sometimes in the tens of millions of dollars"—in exchange for restoring access and not publishing stolen data on leak sites.

On November 25, 2025, Volkov pleaded guilty to four counts from the Southern District of Indiana indictment—unlawful transfer of a means of identification, trafficking in access information, access device fraud, and aggravated identity theft—plus two counts from the Eastern District of Pennsylvania indictment for conspiracy to commit computer fraud and conspiracy to commit money laundering. Police in Rome, Italy, had arrested Volkov before his extradition to the United States.

As part of his plea agreement, Volkov admitted that he and co-conspirators "demanded tens of millions of dollars in ransom and received millions," with Volkov receiving a share of cryptocurrency ransom payments. The court ordered him to pay full restitution including almost $9.2 million to known victims and to forfeit equipment used in his crimes.



Ransomware and crypto

Ransomware, often leveraging cryptocurrency for payment, remains a challenge for the crypto space. Per Chainalysis’ 2026 Crypto Crime Report, on-chain ransomware payments totaled $820 million in 2025, down 8% year-on-year, while claimed attacks increased by 50% and the median ransom payment grew 368% year-over-year to nearly $60,000.

In recent months, ransomware developers have turned to blockchain smart contracts as a distribution channel, including the DeadLock ransomware strain that leverages Polygon smart contracts for proxy server address rotation and distribution, and EtherHiding, which targets BNB Smart Chain and Ethereum smart contracts.

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。