US Charges Sanctioned Russian Cybercriminal Group Leader

The District Court for the Northern District of Texas on Oct. 1 unsealed an indictment against Russian citizen Aleksandr Ryzhenkov, the "second-in-command" of the Russian cybercriminal group Evil Corp., for using the BitPaymer ransomware variant against various U.S. individuals to "hold their sensitive data for ransom," DOJ announced.

Ryzhenkov was sanctioned this week by the Office of Foreign Assets Control, along with various other members of Evil Corp. (see 2410010015).

Starting in at least 2017, Ryzhenkov allegedly gained access to the information on the victims' computers, then used the strain of ransomware to encrypt the files, "rendering them inaccessible," DOJ said. The conspirators left a note on the victims' computers with a ransom demand and payment instructions. Ryzhenkov and the co-conspirators were alleged to have used various methods of intrusion into the computer systems, including "phishing campaigns, malware, and taking advantage of vulnerabilities in computer hardware and software."