The story of "J. P. Morgan" stretches from an elite hacker to a prime suspect

[Friend]

In Spain, Maxim Silnikov was arrested and extradited to the United States, who is accused of creating a Ransom Cartel ransomware distribution campaign and organizing a large-scale malicious advertising scheme that operated from 2013 to 2022.

Maxim Silnikov, 38, who goes by the pseudonyms "J. P. Morgan", "xxx" and "lansky" on hacker forums, has attracted the attention of intelligence agencies for his involvement in major cyber attacks. According to the UK intelligence services, Silnikov and his accomplices are elite cybercriminals who used strict measures to ensure their own security on the network in order to avoid capture.

In the latest case, Silnikov is accused of creating and managing the Ransomware-as-a-Service (RaaS) scheme, which was actively used to attack companies and individuals. Silnikov's important role was played by negotiating with Initial Access Brokers (IAB), which provided access to compromised corporate networks, as well as managing communications with victims and processing ransoms. Silnikov was involved in laundering money from ransoms through cryptocurrency mixers to hide traces of financial transactions and complicate the work of law enforcement agencies.

In addition, Silnikov was responsible for creating Reveton, a Trojan that blocked access to Windows and demanded a ransom for unlocking it. The malware posed as a tool of law enforcement agencies. The Trojan blocked the computer under the pretext of detecting child pornography and copyrighted materials. From its launch in 2011 to 2014, Reveton brought in about $400,000 a day to various cybercriminals.

Silnikov's malvertising activities (from October 2013 to March 2022) also proved to be large-scale and disruptive. Silnikov's task was to develop and distribute malicious ads that seemed harmless, but in fact redirected users to sites with viruses and malware.

The following tools were used in the malvertising campaign::

* Angler Exploit Kit (AEK): designed to exploit vulnerabilities in web browsers and plug-ins installed in them in order to deliver additional payloads to compromised devices.

* Locker malware: a "lightweight" ransomware program that prevents the victim from accessing their data, often requiring a fee to restore access.

* Scareware: They send fake alerts to the victim's computer, prompting the user to download malware or provide personal information to cybercriminals.

At its peak, the Angler Exploit Kit accounted for 40% of all exploit infections in the world and brought criminals about $34 million a year. More than 500 million users worldwide became victims of the attacks.

Silnikov also participated in the development and maintenance of a technical infrastructure, a traffic distribution system (TDS), to better manage and detect malicious campaigns.

During the international operation, NCA employees, together with colleagues from Ukraine, Portugal and Singapore, conducted searches, seized more than 50 terabytes of data and installed the infrastructure used to manage ransomware. The collected data will be used for further investigations and prosecution of other members of the criminal group.

Maxim Silnikov faces a sentence for fraud, computer crimes, identity theft and other crimes. If convicted on all charges, Silnikov could face up to 100 years in prison, although the actual sentence is likely to be shorter due to the possibility of serving multiple sentences at the same time.

Operation Ransom Cartel, launched in December 2021, shares many similarities with the REvil grouping code. Palo Alto Networks specialists reported a suspicious connection between Ransom Cartel and REvil. According to the study, Ransom Cartel started its operations just 2 months after the collapse of REvil. Then experts noted that Ransom Cartel operators have access to the source code of the REvil cryptographer, but they do not have an obfuscation mechanism in their arsenal, which is used to encrypt strings and hide API calls.

In 2019, a member of the cybercrime group that distributed the Reveton ransomware was sentenced in the UK to 6 years in prison and a fine of $355,000. According to the investigation, the 25-year-old student has been associated with the notorious Lurk group for 6 years.

• Source: https://www.justice.gov/opa/media/1363391/dl?inline
• Source: https://www.justice.gov/opa/media/1363386/dl?inline
• Source: https://www.nationalcrimeagency.gov...fic-cybercrime-groups-arrested-and-extradited

a.k.a Maksym Silnikov
a.k.a "targa"
a.k.a "klm"
a.k.a "lansky"
a.k.a "xxx"
a.k.a 'J.P.MORGAN,"

----

In the United States, the first court hearing was held in the case of 38-year-old Maxim Silnikov, whom the British National Crime Agency calls "one of the most famous Russian-speaking cybercriminals in the world." He may spend the rest of his life in prison. But it is possible that it will be released in two years.

According to the prosecution, together with two accomplices, natives of Belarus and Russia, in 2011 Silnikov created the first-ever ransomware program Reveton. He sold it to criminals, who then used the product for its intended purpose. It is believed that with the help of Reveton in the period from 2012 to 2014, about $400 thousand was extorted from victims every month.

It is claimed that Silnikov was also behind the creation of a set of Angler exploits used to inject malicious code into online advertising. At the peak of its popularity, Angler accounted for about half of such virus infections. In total, about 100 thousand devices were affected, and the annual turnover of criminals was about $34 million.

Silnikov is also accused of creating the Ransom Cartel ransomware virus, which he used to demand a ransom from at least one California-based company.

In July, Silnikov was detained in Spain and extradited to Poland, from where he was sent to the United States in early August. Both of his accomplices were also brought to justice. All of them will definitely have to serve at least two years in prison. Also, the defendants face a total of up to 57 years in prison each under various articles. However, the final verdict has not yet been passed.

• Source: https://www.justice.gov/opa/pr/lead...are-schemes-extradited-poland-face-cybercrime

They were detained in Estepona.

This is 38-year-old Maxim Silnikov with the online pseudonyms JP Morgan, xxx and lansky. He was hunted for a long time: Silnikov was considered one of the most productive Russian-speaking hackers on the planet. He will now stand trial in the United States.

The report of the US Department of Justice also includes alleged accomplices of Silnikov: 38-year-old citizen of Belarus (also with a Ukrainian passport) Vladimir Kadyrov and 33-year-old Russian Andrey Tarasov.

MAKSIM SILNIKAU,
a.k.a “Maksym Silnikov,”
a.k.a “Maksim Silnikov,”
a.k.a “Maxsim Andreyevich Silnikov,”
a.k.a “Maksym Mykolaiets,”
ANDREI TARASOV, and
VOLODYMYR KADARIYA,
a.k.a “Volodymyr Kadaria,”
a.k.a “Vladimir Kadaria”

 

[Friend]

Russian-speaking "cyber armymen" are at war with America

In Orthodox Russia, in such cases, they said that the hand of the giver would not fail, but in our country it is time to repeat that the arrests and accusations of Russian-speaking cybercriminals come if not in a powerful stream, then in a rather turbulent stream.
Last week, it was reported that on August 9, 38-year-old Maxim Silnikau, aka Maksim Silnikau and aka Maksim Mykolayets, a citizen of Belarus and Ukraine, was extradited from Warsaw to New York.

Let's dwell on the Russian interpretation of his surname and note that Silnikov was detained in July 2023 in Spain, from where he was extradited to Poland, and the Poles did not hesitate to extradite him to the Americans. It should also be noted that on August 13, that is, after Silnikov was delivered to the United States, the British National Crime Agency (NCA) reported on its account on the social network X (formerly Twitter) that on the Internet Maxim acted under the pseudonyms "JP Morgan", "xxx" and "lansky", and he and his accomplices were called "elite cybercriminals" who had been followed since 2015 and tracked down, that, in particular, from 2012 to 2014, the suspects extorted 400 thousand dollars from their victims. The NCA called Silnikov himself "one of the world's most notorious Russian-speaking cybercriminals."

It is known about Silnikov-Silnikau-Mykolayets that he lived in Minsk, where he studied first at the gymnasium, and then at the National Technical University and left the country, where he was wanted for evading military service, in 2013, apparently becoming the Ukrainian Mykolayets. How and why his surname sounded in the Romanian-Moldavian way is not known. It is known that he is divorced and has two children. His accomplices are 33-year-old Russian citizen Andrei Tarasov and 38-year-old Vladimir Kadaria, like him, a citizen of Belarus and Ukraine, where Kadaria is on a passport in the name of Andriy Kovalev. In 2008, a criminal case was opened against Kadaria in Minsk under the article "Theft of property by modifying computer information." Kadaria called this case fabricated and claimed that he was being prosecuted for political reasons, but in 2022 he was detained in Kyrgyzstan at the request of the Belarusian authorities and in 2023 extradited to Minsk, from where they do not intend to extradite to the United States yet. Nothing is known about Tarasov.

In the United States, Maxim Silnikov is charged by two federal prosecutors at once - the state of New Jersey and the Eastern District of Virginia, but he was taken to Newark, and the charge was presented on August 9 by New Jersey federal magistrate judge Jessica Allen, who then decided to leave Silnikov in custody, although he is not listed in the database of federal prisons. The New Jersey indictment alleges that from October 2013 to March 2022, Silnikov, Kadaria, and Tarasov committed cybercrimes related to the transmission of the Angler software package and other network fraud malware to the computers of millions of unsuspecting Internet users through adware applications (so-called "malvertising") and other means. It also explains that "at the peak of its popularity, Angler accounted for 40 percent of all infections with such kits, affecting about 100 thousand programs per year, and an estimated annual turnover of about $34 million." In Virginia, one Silnikov is accused of being the creator and administrator of the Ransom Cartel ransomware strain and related ransomware operations since May 2021.

In a press release, the federalThe head of the New Jersey Attorney's Office, Philip Sellinger, repeated this accusation and clarified that cybercriminals persuaded their victims to "click" on legitimate ads, and this "click" gave the fraudsters access to the victims' personal data. The fraudsters sold this data to other cybercriminals, while hiding their identity from law enforcement agencies with pseudonyms and network nicknames. First Deputy Minister of Justice Lisa Monaco, his second deputy for criminal affairs Nicole Argentire, deputy director of the Secret Service and deputy director of the FBI responded with equal indignation to the arrest and delivery to the United States of Maxim Silnikov-Silnikau-Mykolayets. In addition to the above-mentioned American law enforcement officers, the already mentioned British NCA and the Crown Prosecution Service took part in the investigation and received gratitude; the Spanish Civil Guard, the Public Prosecutor's Office and the Ministry of Justice; the criminal police of Portugal and Germany, as well as the Central Bureau for Combating Cybercrime of Poland and, of course, the Ukrainian prosecutor's office and the SBU.

"One of the types of malware (software) in the distribution of which Silnikov and others allegedly played a leading role was the Angler Exploit Kit, which targeted the vulnerability of web browsers and related plug-ins," the indictment says. - Sometimes, during the operation of this scam, Angler Exploit Kit was the leading means by which cybercriminals delivered malware to compromised electronic devices. The defendants and their accomplices allegedly ensured the delivery of a "scareware" advertisement that transmitted false messages claiming to have detected a virus or other problem with the victim's computer. The cybercriminals then "attempted to trick the victim into buying or downloading dangerous software, providing remote access to the device, or revealing personal identification or financial information." The prosecution further points out that the defendants have been deceiving advertising firms for many years into running malvertising campaigns involving dozens of virtual and fictitious individuals who posed as legitimate advertising organizations. They also developed and used sophisticated technology and computer code to refine their mal-ads, malware, and computer infrastructure to hide the malicious nature of their ads.

According to the New Jersey federal prosecutor's office, "Silnikov, Kadaria, Tarasov, and their co-conspirators employed several strategies to profit from their widespread system of hacking and wire fraud, "including by using accounts on predominantly Russian cybercrime forums to sell other cybercriminals access to the affected internet users' compromised devices (so called 'downloads' or 'bots'), as well as information stolen from victims and recorded in 'logs', such as banking information and login credentials, to enable further attempts to trick affected internet users or deliver additional malware to their devices." The prosecution threatens three defendants with imprisonment for up to 27 years, and if you add up the episodes, then more than 100 years, but until the court's decision, they are all innocent. I repeat that only Silnikov is really on trial, in Kadaria and Tarasov are virtual, but, as the federal prosecutor's office never tires of repeating, our justice has long arms.

In particular, these hands are trying to get to two Russians, 35-year-old Denis Degtyarenko and 40-year-old Yulia Pakratova, aka Yaroslav or Yulian Zhuravlev, who were added to the cybersecurity sanctions list by our Office of the Treasury Department (OFAC) a month ago. OFAC calls them leaders of Russia's Revived Cyber Army (CARR), a group that Treasury Secretary Brian Nelson, who oversees terrorism and financial intelligence, has called "an unacceptable threat to citizens" that could lead to "potentially dangerous consequences." The Ministry of Finance accuses Degtyarenko and Pankratova of posing a threat to the important infrastructure of the United States, since, according to OFAC, since 2022, the "cyber army" has been conducting pro-Russian cyberattacks in Ukraine, as well as in word and deed against the governments and companies of the countries that supported Kyiv after the start of the Special Military Operation.

Since the end of 2023, CARR has launched cyberattacks on the control systems of critical industrial infrastructure in the United States and Europe. In January 2024, this Russian army of cybercriminals claimed responsibility for overflowing water tanks in the state of Texas, resulting in the loss of tens of thousands of gallons. CARR also violated the supervisory control and data collection (SCADA) system of an unspecified American energy company. CARR activists in Russia include Dmitry Khoroshev, known on the Internet as LockBitSupp, the leader of the LockBit ransomware group, as well as Ivan Kondratiev and Artur Sungatov, leaders of LockBit subsidiaries. According to our Department of Justice, LockBit has attacked more than 2,500 victims worldwide and is alleged to have received more than half a billion dollars in ransom. On January 23, 2024, our US Treasury Department, in coordination with the authorities of Australia and the United Kingdom, found Russian Alexander Yermakov responsible for the hacker penetration in October 2022 of one of Australia's largest private insurance companies, Medibank. "The United States," Brian Nelson said, "has taken and will continue to take action, using the full range of our means, to hold these and others accountable for their malicious cyber activities."