Silnikau: A dark legacy of ransomware and other cybercrimes

You can barely throw a stone without hitting the news that ‘elite’ cybercriminal “J.P. Morgan” has been extradited to the United States. This was a massive win for law enforcement, and it’s no surprise that it is so widely celebrated. But despite being a ‘kingpin’ of cybercrime, many people have never heard of this guy. Who is he, and why is he such a catch? How will the threat landscape change now that he's facing charges? Let’s discuss. 

The basics

J.P. Morgan is one of the many aliases of Maksim Silnikau, also known as Maksym Silnikov. Silnikau is a Belarusian-Ukrainian national who has been active in cybercrime since at least 2011. He spent time in underground forums, learning from other threat actors and growing his skills and experience with malicious software. His Reveton ransomware strain was initially observed in 2011 and emerged as a severe threat in 2012. Reveton was that annoying FBI Virus / Police Trojan that covered the screen with a fake law enforcement announcement about illegal content on the computer. Victims were advised to pay a “fine” to unlock their computers.

Reveton was considered a sophisticated piece of ransomware in 2012. It could customize messages based on IP address location, which made it look like the messages were from the victim’s local law enforcement. This wasn’t a perfect system, but it tricked many people into paying the fine. Reveton tapered off in 2014, but its influence remains. We’ll come back to that in a bit.

Silnikau did not invent malvertising, nor did he develop the Angler Exploit Kit (AEK), but in 2013 he was using both to distribute Reveton as widely as possible. Malvertising uses malicious code in digital advertisements to infect devices when a user views or clicks on the ad. Silnikau’s operations accelerated the growth of malvertising as an attack vector to the extent that researchers measured a 325% increase in malvertising by the start of 2014.

Malvertising was Silnikau’s preferred method of attack, and the Angler Exploit Kit was the perfect way to deploy Reveton as widely as possible while automating the chain of infection. Exploit kits like AEK scan systems for vulnerabilities and then deploy the appropriate exploit to infect the victim system. Like malvertising, the use of the Angler Exploit Kit grew rapidly when added to Silnikau's arsenal.

AEK was regularly updated to exploit the latest software vulnerabilities, and unpatched systems made AEK an effective tool. Silnikau infected millions of systems with exploit kits that delivered his ransomware. Reveton was pulling in approximately $400,000 per month in ransom during its peak activity.

The Angler Exploit Kit died off when its developers and operators were arrested in 2016. Silnikau’s malvertising operations continued through 2022, long after the demise of Reveton and AEK. His malvertising activities caused significant financial harm to many companies and individuals. 

Silnikau created the Ransom Cartel operation in 2021 to run concurrently with his malvertising operation. This strain of ransomware was linked to REvil ransomware through similarities in the source code. Ransom Cartel used double extortion, demanding a ransom for decryption and a promise not to release the information stolen from the victim. They even threatened to send the victim’s data to business associates, industry competitors, and whatever news outlets seemed relevant. Victims who cared about their business reputations were motivated to pay.

Silnikau was arrested in Spain on July 18, 2023, in a “coordinated day of action” carried out and supported by law enforcement agencies from the United Kingdom, Ukraine, Spain, Portugal, Germany, and Poland. The operational activity spanned multiple countries and had several favorable outcomes:

• 15 searches targeting several employees and group members

• The location and dismantling of the Ransom Cartel infrastructure

• Interviews of key suspects targeted in the search

• The seizure and examination of more than 50 terabytes of data related to group operations and its members

   

   

This day of action led to the extradition of Silnikau from Poland to the United States in August 2024. He and two co-conspirators face decades in prison if convicted of conspiracy to commit computer fraud, substantive wire fraud, and other charges. The District of New Jersey and the Eastern District of Virginia have issued indictments.

Ten years of hiding

The investigation that led to Silnikau’s capture started in 2015 as a collaborative effort between the U.K. National Crime Agency (NCA), the U.S. Secret Service, and the Federal Bureau of Investigation (FBI). Silnikau and his associates avoided capture for nearly a decade by using a variety of evasion techniques:

• Multiple online aliases: Aside from J.P. Morgan, Silnikau is known to have used ‘xxx’ and ‘lansky’ to conceal his identity. This wasn’t as simple as changing nicknames on a forum. Silnikau used multiple layers of obfuscation and created a complex web of identities, making it challenging for investigators to connect his activities to a single individual.

• Compartmentalization of Operations: Silnikau practiced extreme operational security with encrypted communications, decentralized command structures, and the use of intermediaries to limit direct communication between significant players. This limited the damage to his network if one piece of the operation was compromised.

• Cryptocurrency: Silnikau used Bitcoin for ransom payments and put these payments through multiple cryptocurrency mixing services to obfuscate the origin of the funds. In short, he was an early adopter of laundering cryptocurrency.

• Proxy Networks and Virtual Private Networks (VPNs): The infrastructure of Silkinau’s network was spread across multiple countries, which created several challenges for law enforcement. This dispersed infrastructure obscured his and his associates' locations and identities, allowing them to operate across multiple legal jurisdictions. It was difficult for any single agency to apprehend Silkinau, especially if he was conducting operations in countries with limited cybercrime enforcement.

Silnikau’s tactics worked well, and little is known about his early life and many criminal activities. Over the last decade, researchers have suspected his involvement in banking trojans, point-of-sale malware, and remote access trojans (RATs). That’s in addition to the credential stealers, ransomware, and exploit kits connected to him through forensic evidence.

Reveton

Reveton wasn’t the first ransomware to hit computers, but it was one of the first to foreshadow modern attacks. It was considered advanced malware due to its location awareness and the use of payment systems that were difficult to trace. It was regularly updated with new fixes and features and integrated with multiple exploit kits to expand the range of attacks. This resulted in a massive spike in Reveton infections when a new exploit was found.

Reveton ransomware is also known as a ‘Police Trojan’ and ‘scareware’ because it used the threat of law enforcement to scare victims. Reveton did not encrypt files or steal data. Its only method of extortion was to lock the system and display a message demanding a fine or ransom to unlock it. Today, most computer users would see this ridiculous screen and know it was a fraud:

This method was effective in 2013 because it hadn’t been seen before and because many companies and computer users were just getting started with the always-on internet. Law enforcement agencies analyzed the threat and published alerts and mitigation instructions. Awareness around Reveton grew, and Silnikau’s team realized that not every victim would pay a ransom. To ensure they could monetize an infection, Silnikau added a password-stealing component that operated in the background while the splash screen was displayed. This version of Reveton could “steal passwords for a comprehensive selection of file downloaders, remote control applications, FTP, poker, chat and e-mail clients, as well as passwords stored by browsers and in protected storage.” This Technet blog details the Reveton infection chain and the password-stealing component.

Ransomware-as-a-Service

Aside from the FBI-themed extortion splash screens, Reveton is notable for being the first Ransomware-as-a-Service (RaaS) operation. You likely recall that RaaS is a business model allowing threat actors to subscribe to ransomware services developed and managed by organized providers. RaaS has made cybercrime more accessible by removing infrastructure- and skill-related barriers. Malware, phishing, DDoS, and exploits are all available in ‘Crime-as-a-Service’ models. These services are supported by Botnets-for-Hire that send phishing emails or conduct DDoS attacks. These resources are available as subscriptions in the cybercrime ecosystem, and they all arrived alongside or after RaaS.

Reveton affiliates were recruited through criminal forums and other underground communication channels. The details of the payment scheme are unclear, but affiliates were getting a large share of the ransom. The RaaS business model and generous profit sharing helped Silnikau scale up Reveton operations, and it added a third method of monetization to the ransomware. 

The RaaS model has decentralized ransomware attack operations across the globe. This has complicated law enforcement efforts because so many threat actors can change locations quickly without much disruption to their operations. RaaS providers also manage negotiations and transactions with the victims on behalf of their subscribers/affiliates. This adds a layer of separation between the threat actor and the victim and may reduce the threat actor’s exposure to law enforcement.

An excellent example of this identity obfuscation can be found in the aftermath of the 2024 Change Healthcare attack. ALPHV claimed responsibility for the attack and collected the ransom. The public learned about “notchy” and his role in stealing the data after ALPHV took the full ransom and went dark. Notchy complained about this in the forums, which brought this internal conflict to the attention of researchers and security reporters. Shortly after that, human intelligence (HUMINT) sources determined there was a “high probability” that Notchy was associated with groups sponsored by the People’s Republic of China (PRC). ALPHV was a “Russian-speaking group” that appeared to have no ties to a nation-state. There’s no substantial evidence linking Notchy to the PRC, but the public probably wouldn’t have heard about Notchy or the possible PRC connection if ALPHV hadn’t gone dark.

Silnikau’s legacy

Silnikau did not build his empire alone. Business partners, subscribers, affiliates, and malware developers contributed to his operation. Some were arrested years ago, and some are expected to be arrested soon. If the evidence supports the charges, we may see these criminals put in jail for decades and hopefully prohibited from ever using the internet again. But how much does this change the threat landscape today? Silnikau was arrested over a year ago. Ransom Cartel was taken offline, and law enforcement gathered significant evidence that will hopefully lead to more prosecutions. It’s always good to capture a RaaS operator and dismantle his operation, but what does it mean to you today?

The world is covered in crime-as-a-service. Companies have lost billions of dollars to ransomware and system disruption, and almost everyone in the United States has had their credentials and sensitive data stolen multiple times. 

Silnikau’s criminal infrastructure and operations directly contributed to the growth of the cybercrime ecosystem. He pioneered RaaS as a business model and popularized malvertising as an attack surface. His success with the AEK demonstrated how to use exploits and ‘drive-by downloads’ to scale and automate attacks. His success made it possible for new threat actors to be successful. Some of them are now experienced cybercriminals controlling active ransomware groups.

Silnikau was among the first to recognize that passwords are money, and the Reveton era saw some of the most notable credential-enabled data breaches in history:

• Target was compromised in 2013 when attackers used credentials stolen from a third-party vendor that had direct access to Target’s network. This early supply chain attack exposed 40 million credit and debit card numbers and the personal information of 70 million Target customers.

• The 2014 Yahoo data breach resulted from a spear-phishing attack that captured credentials to the network. 500 million records were compromised, which was on the heels of the 2013 data breach that exposed all three billion Yahoo users.

• In 2014, threat actors used the stolen credentials of three corporate employees to gain access to eBay’s business network. This breach compromised 145 million accounts, including usernames, encrypted passwords, email addresses, and other personal information.

• The 2015 Anthem data breach exposed the sensitive information of almost 79 million individuals. It was later determined that an employee responded to a spear-phishing attack, which either “tricked a worker into unknowingly revealing a password or downloading malicious software.” Anthem discovered the breach when a system administrator noticed that his credentials were being used by someone else.

Stolen credentials have become an entire underground business since then, with threat actors specializing in different types of credentials like remote access credentials or Microsoft 365 access. Artificial intelligence (AI) has helped threat actors accelerate credential theft and has given them new ways to create large-scale attacks by combining usernames and passwords from multiple breaches.

Adding the password-stealer is an early example of a threat actor responding to improved defenses and security measures. It also made Reveton among the first to expand the monetization of a single attack. This is now the norm for cybercrime groups.

We should also consider the impact of Silnikau’s operational security. He employed advanced law enforcement evasion tactics, which continue to serve as models for other threat actors. Threat actors who have nothing to do with Silnikau are still learning from the example of his career in cybercrime. Like a comic book supervillain, Silnikau built a monster that doesn't need its creator to carry out its mission. 

It is likely that RaaS, malvertising, and the rest of Silnikau’s attacks would have emerged eventually through other threat actors. I can’t provide a dollar amount or an attack family tree demonstrating his direct impact on modern cybercrime, but we don’t need that anyway. All we need to do is look at the threat landscape as it is today. Silnikau’s monster is everywhere. 

Protect your business

Ransomware attacks have not stopped, and cybercriminals are getting good at using AI to accelerate and improve their attacks. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) Stop Ransomware website can help you prevent ransomware attacks. You should review this site for information on emergency communications, bad practices, and proper ransomware attack response. Also, make sure you’re following the standard best practices, such as regular data backups and timely patch management.

Barracuda offers complete ransomware protection and the industry’s most comprehensive cybersecurity platform. Visit our website to see how we defend email, network, applications, and data.