Russian cybercriminal sentenced to prison for using a “botnet” to steal millions from American businesses

DETROIT - A Russian national was sentenced yesterday to twenty-four months in prison after having pleaded guilty to managing the operation of a botnet (a network of computers infected by malware and controlled remotely by cybercriminals) that was used to launch ransomware attacks on the networks of dozens of U.S. corporations, announced United States Attorney Jerome F. Gorgon Jr. and Special Agent in Charge Jennifer Runyan of the FBI Detroit Field Division.

Ilya Angelov, 40, of Tolyatti, Russia was sentenced by U.S. District Court Judge Nancy Edmunds, who also fined Angelov $100,000 and entered a money judgment against him in the amount of $1.6 million dollars.

According to court records, between 2017 and 2021, Angelov - who used online monikers including "milan" and "okart" - co-managed the Russia-based cybercriminal group designated by the FBI as Mario Kart. Private security researchers have used other designations for this group, including TA-551, Shathak, GOLD CABIN, Monster Libra, ATK236, and G0127.

Angelov's group built a network of compromised computers (a "botnet") through distribution of malware-infected files attached to spam emails. Angelov and his co-manager then monetized this botnet by selling access to individual compromised computers ("bots"). This access was sold to other criminal groups, who typically engaged in ransomware extortion schemes: locking victims out of their computer networks and demanding extortion payments - commonly in cryptocurrency - to restore access.

The FBI has identified over 70 U.S. corporations that were infected with ransomware by one organization linked to Angelov's group, resulting in over $14 million in extortion payments. Another group that distributed ransomware paid Angelov's group over a million dollars for access to the Mario Kart botnet.

"Foreigner cybercriminals like this defendant target American citizens and corporations. Their methods grow in sophistication. But their motive remains the same - to rip-off and harm us. We are grateful to the FBI and our other partners for their continued vigilance," said U.S. Attorney Gorgon.

"May this sentencing serve as a strong message to cyber criminals who believe they can hide behind screens and false identities: you cannot escape the FBI's reach. You will be held accountable," said Special Agent in Charge Jennifer Runyan of the FBI Detroit Field Office. "This successful investigation reflects the FBI's ongoing commitment to identifying, tracking, and dismantling the criminal networks that financially exploit individuals and U.S. corporations. I would like to thank the FBI Detroit Cyber Task Force for their exceptional work in this investigation and to the U.S. Attorney's Office for ensuring justice was achieved."

This case was investigated by the FBI Detroit Cyber Task Force. The Department of Justice's Office of International Affairs provided critical assistance in this investigation. The case was prosecuted by Assistant United States Attorney Timothy Wyse.