Global ransomware group negotiator involved in $56 million cyberattacks sentenced to 8.5 years in prison

CINCINNATI - A Latvian national was sentenced in federal court here today to 102 months in prison for his role as a negotiator in one of the most notorious ransomware groups in the world, known as Karakurt, TommyLeaks and SchoolBoys Ransomware.

Deniss Zolotarjovs, 35, was arrested overseas in December 2023 and transferred to the United States' custody in August 2024. He pleaded guilty in July 2025 to conspiring to commit both money laundering and wire fraud.

Ransomware is a type of cybercrime that typically involves an intrusion into a victim's network to steal and/or encrypt the victim's data via malware, followed by an extortion demand seeking the payment of a ransom in cryptocurrency. The attacks identified in this case included client records like Social Security numbers, addresses, dates of birth, home addresses, healthcare information and the shutdown of a government entity's 911 system.

"Ransomware groups disrupt victims' lives, cruelly extracting money through psychological manipulation and fear. And they create lingering security issues," said U.S. Attorney Dominick S. Gerace II for the Southern District of Ohio. "Cybercriminals might think they are invulnerable by hiding behind anonymizing tools and complex cryptocurrency patterns while they attack American victims from non-extradition countries. But Zolotarjovs's prosecution shows that federal law enforcement also has a global reach, and we will hold accountable bad actors like Zolotarjovs, who will now spend significant time in prison."

"With this sentence, a cruel, ruthless, and dangerous international cybercriminal is now behind bars," said Assistant Attorney General A. Tysen Duva of the Justice Department's Criminal Division. "Deniss Zolotarjovs helped his ransomware gang profit from hacks of dozens of companies, and even on a government entity whose 911 system was forced offline. He also used stolen children's health information to increase his leverage to extort victim payments. The Criminal Division will continue to investigate and prosecute international hackers and extortionists from around the world, no matter where they live or operate."

"Cybercriminals like Deniss Zolotarjovs may try to hide in the shadows, but the FBI will find them," stated FBI Cincinnati Special Agent in Charge Jason Cromartie. "This case demonstrates the relentless pursuit by our FBI special agents, working with partners across the globe, to hold this criminal accountable for the millions of dollars he extorted from U.S. organizations."

During Zolotarjovs's involvement in the ransomware conspiracy from June 2021 through March 2023, the group had at least 53 victims and caused more than $56 million in actual losses. Victim companies and clients of victim companies were located in the Southern District of Ohio.

According to court documents, Zolotarjovs was an essential part of the conspiracy in which data was stolen and then used for extortion. Online chats show that Zolotarjovs was personally involved in directly negotiating with victim companies and in strategizing on the extortion threats with coconspirators. Zolotarjovs did not personally execute cyber penetrations against victim companies. Rather, Zolotarjovs's role was to analyze the data that was stolen and conduct or advise on ransom negotiations.

For example, Zolotarjovs helped escalate the pressure on a pediatric healthcare victim company who was refusing to promptly pay a ransom by deliberately leveraging "patient lists and histories.". Zolotarjovs also recommend publishing pediatric patient data on the darkweb to punish the victim company for not complying with the organization's demands.

The defendant would receive 10 percent of the ransom payments he negotiated. He was paid in cryptocurrency, which was then moved through multiple wallets before the funds were ultimately exchanged for Russian rubles.

Dominick S. Gerace II, United States Attorney for the Southern District of Ohio; A Tysen Duva, Assistant Attorney General of the Department of Justice's Criminal Division; and Jason Cromartie, Special Agent in Charge, Federal Bureau of Investigation (FBI), Cincinnati Division; announced the sentence imposed today by Senior U.S. District Court Judge Michael R. Barrett.

Law enforcement leaders commended the FBI offices in Cleveland, San Diego, Richmond and Salt Lake City for their vital roles in the investigation and officials in Georgia for their role in the extradition. The Justice Department's Office of International Affairs provided significant assistance in securing Zolotarjovs's extradition from Georgia.

Assistant Deputy Criminal Chief Timothy S. Mangan, Assistant United States Attorney Matthew C. Singer and Department of Justice Computer Crime & Intellectual Property Section Trial Attorney Benjamin A. Bleiberg and Senior Counsel Bryce B. Rosenbower are representing the United States in this case.

# # #