Russian Cybercriminal Gets 2-Year Prison Sentence in US

Summary

Ilya Angelov, a member of the threat group TA-551 (also tracked as Mario Kart, Shathak, Gold Cabin, and ATK236), was sentenced to 24 months in federal prison for his role in administering a botnet used to distribute malware and facilitate ransomware attacks between 2017 and 2021. The cybercrime group distributed Emotet, IcedID, Qbot, and Ursnif malware via spam, compromising machines that were sold for ransomware deployment, resulting in attacks on over 70 US corporations and $14 million in ransom earnings. In addition to prison time, Angelov received a $100,000 fine and $1.6 million money judgment.

Full text

Russian cybercriminal Ilya Angelov, known online as ‘Milan’ and ‘Okart’, has been sentenced to two years in federal prison for his role in the administration of a botnet used to facilitate ransomware attacks, the DOJ announced on Tuesday. According to the DOJ, Angelov was part of a threat group tracked by the FBI as Mario Kart, and by the cybersecurity community as TA-551, Shathak, Gold Cabin, Monster Libra, G0127, and ATK236. The charges against Angelov stem from activities he engaged in between 2017 and 2021, during which his cybercrime group built a botnet by distributing malware via spam email attachments. They monetized the compromised machines by selling access for deploying ransomware. TA-551 was known to distribute malware such as Emotet, IcedID, Qbot, and Ursnif. The DOJ has mentioned ransomware attacks facilitated by the botnet against more than 70 US corporations, with the cybercriminals earning $14 million in ransom payments. Advertisement. Scroll to continue reading. Court documents show Angelov has been in custody since 2023 and has pleaded guilty to his role in the cybercrime operation. In addition to the 24-month prison sentence, he received a $100,000 fine and a $1.6 million money judgment, allowing the government to seize assets tied to his criminal proceeds. Angelov’s sentencing comes shortly after the DOJ announced that another Russian national, Aleksei Volkov, has been sentenced to 81 months in prison for his role in ransomware attacks. Related: Russian Ransomware Operator Pleads Guilty in US Related: Russian APT Exploits Zimbra Vulnerability Against Ukraine Related: US Sanctions Russian Exploit Broker Operation Zero Written By Eduard Kovacs Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering. More from Eduard Kovacs Stryker Says Malicious File Found During Probe Into Iran-Linked AttackM-Trends 2026: Initial Access Handoff Shrinks From Hours to 22 SecondsOracle Releases Emergency Patch for Critical Identity Manager VulnerabilityCritical Quest KACE Vulnerability Potentially Exploited in AttacksUS Confirms Handala Link to Iran Government Amid Takedown of Hackers’ SitesAisuru and Kimwolf DDoS Botnets Disrupted in International OperationMarquis Data Breach Affects 672,000 IndividualsCISA Warns of Attacks Exploiting Recent SharePoint Vulnerability Latest News AI Speeds Attacks, But Identity Remains Cybersecurity’s Weakest LinkiOS, macOS 26.4 Roll Out With Fresh Security PatchesFCC Bans New Routers Made Outside the US Over National Security RisksRSAC 2026 Conference Announcements Summary (Day 2)From Trivy to Broad OSS Compromise: TeamPCP Hits Docker Hub, VS Code, PyPIUS Prisons Russian Access Broker for Aiding Ransomware AttacksHackerOne Employee Data Exposed in Massive Navia BreachDoE Publishes 5-Year Energy Security Plan Trending Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Securing Fragile OT in an Exposed World March 10, 2026 Get a candid look at the current OT threat landscape as we move past "doom and gloom" to discuss the mechanics of modern OT exposure. Register Webinar: Why Automated Pentesting Alone Is Not Enough April 7, 2026 Join our live diagnostic session to expose hidden coverage gaps and shift from flawed tool-level evaluations to a comprehensive, program-level validation discipline. Register People on the MoveThe US Senate confirmed Markwayne Mullin as DHS Secretary.7AI has appointed Israel Barak as its first Chief Information Security Officer.Brian Harrell has been appointed Chief Security Officer at FirstEnergy.More People On The MoveExpert Insights Why Agentic AI Systems Need Better Governance – Lessons from OpenClaw Agentic AI platforms are shifting from passive recommendation tools to autonomous action-takers with real system access, (Etay Maor) The Human IOC: Why Security Professionals Struggle with Social Vetting Applying SOC-level rigor to the rumors, politics, and 'human intel' can make or break a security team. (Joshua Goldfarb) How to 10x Your Vulnerability Management Program in the Agentic Era The evolution of vulnerability management in the agentic era is characterized by continuous telemetry, contextual prioritization and the ultimate goal of agentic remediation. (Nadir Izrael) SIM Swaps Expose a Critical Flaw in Identity Security SIM swap attacks exploit misplaced trust in phone numbers and human processes to bypass authentication controls and seize high-value accounts. (Torsten George) Four Risks Boards Cannot Treat as Background Noise The goal isn’t about preventing every attack but about keeping the business running when attacks succeed. (Steve Durbin) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• malware — Emotet
• malware — IcedID
• malware — Qbot
• malware — Ursnif