Ransom Cartel Creator Sentenced to 16 Years: Defending Against Ransomware-as-a-Service Operations

On August 5, a federal judge in Alexandria, Virginia sentenced Maksim Silnikau to 16 years in prison for creating and operating Ransom Cartel, a ransomware-as-a-service (RaaS) operation he stood up in 2021. According to the Justice Department, between 2021 and 2023 Ransom Cartel conspirators attacked at least 18 companies — including firms in California, New York, and Nebraska — as well as victims abroad.

A 16-year sentence is a significant win for law enforcement, and it removes one operator from the ecosystem. But let's be clear-eyed about what this does and doesn't change for defenders: the RaaS model Silnikau commercialized is now the dominant structure of the ransomware economy. The affiliates who deployed Ransom Cartel encryptors didn't go to prison with him. The initial access brokers who sold them entry didn't either. The tooling, playbooks, and affiliate networks persist, rebrand, and resurface under new names — the same cycle we watched with REvil, Conti, LockBit, and BlackCat/ALPHV.

This post breaks down the RaaS attack chain as Ransom Cartel executed it, and delivers the detection content and hardening steps your SOC should already have in place — because the next Ransom Cartel is already operating.

What Happened

Silnikau built Ransom Cartel in 2021 as an encryption-based cybercrime-as-a-service platform. The RaaS model works like a franchise:

• The operator (Silnikau) develops and maintains the encryptor, the victim negotiation/ leak infrastructure, and payment handling.
• Affiliates purchase or rent access to the tooling and conduct the actual intrusions — gaining initial access, escalating privileges, exfiltrating data, and deploying the encryptor.
• Revenue is split between operator and affiliate, typically 70-80% to the affiliate.

This division of labor is precisely what makes RaaS so dangerous: it lowers the skill barrier for affiliates while letting skilled developers scale their malware across dozens of concurrent intrusion campaigns. Ransom Cartel's 18+ confirmed victims across multiple U.S. states and foreign countries in roughly two years illustrates that scale.

Notably, Silnikau is not a new name to investigators — he has been linked to cybercrime activity stretching back over a decade, including earlier ransomware and exploit-kit operations. His sentencing reflects years of international investigative work, and it demonstrates that long-game attribution does eventually land. But attribution is not prevention. Your environment has to withstand the affiliate-level intrusion regardless of who wrote the encryptor.

Technical Analysis: The RaaS Intrusion Lifecycle

Because RaaS operations separate intrusion from encryption, defenders get two distinct windows to detect and disrupt an attack — and most organizations only prepare for the second one (the encryption event), which is too late. Ransom Cartel intrusions, consistent with the broader RaaS ecosystem, follow this chain:

Phase 1 — Initial Access (Affiliate)

• Phishing with malicious attachments or links
• Exploitation of internet-facing remote services (RDP, VPN appliances, unpatched edge devices)
• Purchased access from initial access brokers (IABs) — valid credentials, webshells, or established beaconing implants

Phase 2 — Establishment and Escalation

• Deployment of commodity loaders and C2 frameworks (Cobalt Strike remains the workhorse)
• Credential theft via LSASS memory dumping (Mimikatz-style tooling, comsvcs.dll MiniDump abuse)
• Valid account abuse and pass-the-hash for lateral movement over SMB/RDP/WinRM

Phase 3 — Impact Preparation (The Critical Detection Window)

This is where affiliates prepare the environment for mass encryption, and it generates the highest-fidelity, lowest-noise detection signals in the entire chain:

• Shadow copy deletion — vssadmin delete shadows /all /quiet, wmic shadowcopy delete, or bcdedit tampering with recovery options
• Backup discovery and destruction — enumeration and deletion of backup catalogs, Veeam/Commvault service tampering
• Security tool disabling — attempts to stop or kill AV/EDR services, often via net stop, sc stop, or bring-your-own-vulnerable-driver (BYOVD) techniques
• Data staging and exfiltration — large archive creation (7z/RAR) followed by outbound transfer to attacker infrastructure (double-extortion leverage)

Phase 4 — Encryption and Extortion

• Mass file enumeration and renaming with a consistent extension
• Ransom note drops (README, HOW_TO_DECRYPT, or branded note filenames) across encrypted directories
• Wallpaper/registry changes and victim notification; threat of data publication on the leak site

Defensive implication: If your detection strategy begins at Phase 4, you are detecting your own failure. Phases 2 and 3 produce hours-to-days of observable behavior before a single file is encrypted. That's your window.

Exploitation Status

No CVE is associated with this news item, and none is required — RaaS operations are technique-driven, not vulnerability-driven. Ransom Cartel intrusions relied on the standard affiliate playbook of credential abuse, exposed services, and commodity tooling. The threat is confirmed, active, and ongoing across the broader RaaS ecosystem even as this specific operation's creator begins his sentence.

Detection & Response

The following detections target the highest-fidelity behaviors in the RaaS impact-preparation phase. They are tuned to fire on genuinely suspicious activity — test them in your environment and baseline against legitimate administrative tooling before deploying at high severity.

Sigma Rules

---
title: Shadow Copy Deletion via Command Line
title_fr: Suppression des clichés instantanés via ligne de commande
id: 3c9a1f7e-2b84-4d51-9e6a-7f2c8d1a5b33
status: experimental
description: Detects deletion of Volume Shadow Copies or tampering with boot recovery options, a hallmark ransomware impact-preparation behavior observed across RaaS operations including Ransom Cartel-style intrusions.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/08/06
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
      - '\wbadmin.exe'
      - '\diskshadow.exe'
  selection_cli:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'delete catalog'
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
      - 'delete shadows /all'
  condition: selection_img and selection_cli
falsepositives:
  - Legitimate backup or storage administration; rare on end-user systems
level: high
---
title: Ransom Note Mass Creation Pattern
id: 8d2e4b61-5a9c-47f3-b18d-2e6c9a4f7d12
status: experimental
description: Detects creation of files with common ransomware note naming patterns, indicating an active encryption event consistent with RaaS affiliate deployment.
references:
  - https://attack.mitre.org/techniques/T1486/
author: Security Arsenal
date: 2026/08/06
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - 'HOW_TO_DECRYPT'
      - 'DECRYPT_INSTRUCTION'
      - 'RECOVER_FILES'
      - 'README_FOR_DECRYPT'
      - 'RESTORE_FILES_INFO'
      - 'HOW_TO_RESTORE'
  condition: selection
falsepositives:
  - Security testing, red team exercises, sandbox detonation
level: critical
---
title: Security Service Tampering via net or sc
title_fr: Altération des services de sécurité via net ou sc
id: 5f7b2c94-1d38-4e6a-a25c-9b3d7e1f8a46
status: experimental
description: Detects attempts to stop or disable security, backup, or database services frequently targeted by ransomware affiliates prior to encryption.
references:
  - https://attack.mitre.org/techniques/T1562.001/
author: Security Arsenal
date: 2026/08/06
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\net.exe'
      - '\net1.exe'
      - '\sc.exe'
  selection_action:
    CommandLine|contains:
      - 'stop'
      - 'disable'
  selection_target:
    CommandLine|contains:
      - 'vss'
      - 'veeam'
      - 'backup'
      - 'sql'
      - 'defender'
      - 'sentinel'
      - 'sophos'
      - 'msserver'
  condition: selection_img and selection_action and selection_target
falsepositives:
  - Legitimate service administration by IT staff; correlate with admin change windows
level: high

KQL — Microsoft Sentinel / Defender

This query hunts for the impact-preparation chain: shadow copy deletion, recovery tampering, and security service stops within a rolling window, scored by host to surface machines exhibiting multiple ransomware precursor behaviors.

let Lookback = 7d;
let RansomwarePrecursors = dynamic(["delete shadows", "shadowcopy delete", "recoveryenabled no", "bootstatuspolicy ignoreallfailures", "delete catalog"]);
DeviceProcessEvents
| where Timestamp > ago(Lookback)
| extend CmdLower = tolower(ProcessCommandLine)
| extend IsShadowTamper = CmdLower has_any (RansomwarePrecursors)
| extend IsServiceTamper = (FileName in~ ("net.exe", "net1.exe", "sc.exe") and CmdLower has "stop" and CmdLower has_any ("veeam", "backup", "vss", "sophos", "defender", "sentinel"))
| where IsShadowTamper or IsServiceTamper
| summarize
    ShadowTamperEvents = countif(IsShadowTamper),
    ServiceTamperEvents = countif(IsServiceTamper),
    Commands = make_set(strcat(FileName, " :: ", ProcessCommandLine), 10),
    Accounts = make_set(AccountName),
    FirstSeen = min(Timestamp),
    LastSeen = max(Timestamp)
  by DeviceName, DeviceId
| extend RiskScore = (ShadowTamperEvents * 40) + (ServiceTamperEvents * 25)
| where RiskScore >= 25
| order by RiskScore desc;

For environments ingesting Sysmon via SecurityEvent, mirror the logic against Event ID 4688 process creation with command-line auditing enabled. Note that 4688 requires explicit command-line logging via GPO — verify this before assuming coverage.

Velociraptor VQL

This artifact hunts endpoints for processes exhibiting ransomware precursor behavior — shadow copy tampering, backup tooling interference, and suspicious encryption-adjacent command lines — useful during an active IR sweep across a fleet.

-- Hunt for ransomware impact-preparation process execution across endpoints
SELECT Pid,
       Ppid,
       Name,
       Exe,
       CommandLine,
       Username,
       CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(delete shadows|shadowcopy delete|recoveryenabled no|bootstatuspolicy|delete catalog)'
   OR (Name =~ '(?i)^(net1?|sc)\.exe$'
       AND CommandLine =~ '(?i)(stop|disable)'
       AND CommandLine =~ '(?i)(veeam|backup|vss|sophos|defender|sentinel|sql)')

Run this as a hunt across your fleet during any suspected ransomware precursor alert. Positive hits on multiple hosts within a short timeframe strongly suggest coordinated affiliate staging and should trigger your IR playbook immediately — you are likely hours, not days, from encryption.

Remediation & Verification Script

The following PowerShell audits key ransomware resilience controls on a Windows host: shadow copy availability, Controlled Folder Access status, and service health for backup/security tooling. Run it as part of your hardening baseline verification.

# Ransomware resilience audit — run elevated
# 1. Verify Volume Shadow Copies exist and are recent
Write-Host "=== Shadow Copy Status ===" -ForegroundColor Cyan
Get-CimInstance Win32_ShadowCopy | Select-Object DeviceObject, InstallDate, VolumeName | Format-Table -AutoSize
$shadows = Get-CimInstance Win32_ShadowCopy
if (-not $shadows) { Write-Host "WARNING: No shadow copies present. Verify System Protection is enabled." -ForegroundColor Red }

# 2. Check System Protection state on OS volume
Write-Host "`n=== System Protection ===" -ForegroundColor Cyan
try {
    $sp = Get-ComputerRestorePoint -ErrorAction Stop | Select-Object -Last 1
    Write-Host "Last restore point: $($sp.CreationTime)"
} catch { Write-Host "No restore points found." -ForegroundColor Yellow }

# 3. Verify Controlled Folder Access (ransomware protection) state
Write-Host "`n=== Controlled Folder Access ===" -ForegroundColor Cyan
$cfa = Get-MpPreference
switch ($cfa.EnableControlledFolderAccess) {
    1 { Write-Host "Controlled Folder Access: ENABLED" -ForegroundColor Green }
    2 { Write-Host "Controlled Folder Access: AUDIT MODE only" -ForegroundColor Yellow }
    default { Write-Host "Controlled Folder Access: DISABLED — enable via Set-MpPreference -EnableControlledFolderAccess Enabled" -ForegroundColor Red }
}

# 4. Audit backup and security service health
Write-Host "`n=== Critical Service Health ===" -ForegroundColor Cyan
$services = @('VSS','WinDefend','Sense','VeeamBackupSvc','wbengine')
foreach ($svc in $services) {
    $s = Get-Service -Name $svc -ErrorAction SilentlyContinue
    if ($s) { Write-Host ("{0,-20} {1}" -f $s.Name, $s.Status) }
}

# 5. Confirm ASR rule for credential theft from LSASS is enforced
Write-Host "`n=== ASR: LSASS Credential Theft Rule ===" -ForegroundColor Cyan
$asrRule = '9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2'
$asrState = (Get-MpPreference).AttackSurfaceReductionRules_Actions
$ids = (Get-MpPreference).AttackSurfaceReductionRules_Ids
$idx = [array]::IndexOf($ids, $asrRule)
if ($idx -ge 0 -and $asrState[$idx] -eq 1) { Write-Host "LSASS ASR rule: BLOCK mode" -ForegroundColor Green }
else { Write-Host "LSASS ASR rule: not enforced — enable to disrupt Mimikatz-style dumping" -ForegroundColor Red }

Remediation and Hardening Priorities

There is no patch for RaaS — there is only posture. Prioritize these controls in order of impact against the intrusion chain described above:

1. Immutable, tested backups. Follow the 3-2-1 model with at least one copy offline or immutable (object lock / WORM). Test restoration quarterly — an untested backup is a hypothesis, not a control. Affiliates specifically enumerate and destroy accessible backup infrastructure; isolated backup credentials are non-negotiable.

2. Eliminate exposed remote access. RDP must never be internet-facing. Enforce MFA on all remote access (VPN, RDP gateways, VDI, SaaS admin portals) — phishing-resistant MFA (FIDO2) where possible. Most RaaS initial access is purchased valid credentials, not zero-days.

3. Protect shadow copies and recovery options. Restrict vssadmin, wmic, bcdedit, and wbadmin execution via AppLocker or WDAC to approved administrative accounts. Alert on their use everywhere else. Enable Controlled Folder Access in block mode after an audit-mode pilot.

4. Deploy and tune EDR with tamper protection. Ensure your EDR cannot be disabled by local administrators. Monitor for service-stop attempts against security tooling (the Sigma rule above).

5. ASR rules for credential theft and Office abuse. Enforce the LSASS credential-theft ASR rule in block mode (verified in the script above) and block Office child process creation. These two rules break the most common affiliate escalation and delivery techniques.

6. Segment and constrain lateral movement. Tier your administration model; prevent workstation-to-workstation SMB; isolate backup infrastructure on its own segment with dedicated credentials. Slow the affiliate down and your Phase 2/3 detections buy you response time.

7. Rehearse the IR playbook. Ransom Cartel affiliates moved from access to encryption in days. Your containment decisions — isolate host vs. isolate segment vs. shut down — must be pre-authorized and rehearsed, not improvised at 3 a.m.

The Bottom Line

Sixteen years for Silnikau is real accountability, and international law enforcement deserves credit for sustained pressure on RaaS operators. But the market structure he exploited — affiliates, access brokers, bulletproof infrastructure, cryptocurrency laundering — outlives any individual prosecution. The organizations that survived Ransom Cartel-era intrusions intact weren't lucky; they detected the staging behavior before encryption and had recoverable backups when they didn't. Build for the model, not the operator. The next brand name is already recruiting affiliates.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub