Denis Mihaqlovic Dubnikov, 30, pleaded guilty to laundering the proceeds of malware attacks, in which his group would encrypt the data on their victims’ computers, rendering them inaccessible until a ransom was paid in the form of cryptocurrency.
Although now no longer widely used, Ryuk is described by the U.S. Cybersecurity and Infrastructure Security Agency as a particularly potent malware, which can “shut down or uninstall security applications on the victim systems that might prevent the ransomware from executing.”
Ryuk can also attack storage devices connected to the targeted computer, regardless if they are linked physically or remotely via a network connection.
According to the indictment against Dubnikov, he and his band, comprised of 13 other co-conspirators, directed their victims to pay ransoms in bitcoin; at the height of their scheme in August 2021, each bitcoin held a value of over US$45,000.
Once infected, the victim’s computer would display the message: “Gentlemen!...We've easily penetrated your network. You should thank the Lord for being hacked by serious people not some stupid schoolboys or dangerous punks….Now your files are crypted with the strongest millitary algorithms.”
The message would go on to provide instructions on how to pay the ransom; victims would have two weeks to do so until their files were permanently deleted.
Authorities noted the conspiracy to be highly successful. In July 2019 alone, Dubnikov cashed in 35 bitcoin for approximately $400,000.
Altogether, the group laundered no less than $70 million in ransom proceeds.
Dubnikov’s guilty plea follows his arrest in the Netherlands back in November 2021 and subsequent extradition to the U.S. nine months later.
In the U.S., conspiracy to commit money laundering carries a potential sentence of up to 20 years in federal prison as well as a fine of $500,000. Dubnikov is set to be sentenced on April 11 later this year.