Karakurt ransomware gang linked to Russian government databases

A U.S. court has sentenced Latvian hacker Deniss Zolotarjovs to more than eight years in prison following his conviction for carrying out ransomware attacks. The U.S. Department of Justice (DOJ) accused Zolotarjovs of working for Karakurt, which prosecutors describe as a notorious Russian ransomware gang. According to U.S. prosecutors, the group relied on access to Russian government databases and law enforcement connections to intimidate its victims. The DOJ asserted that Karakurt was led by former leaders of the Akira and Conti ransomware gangs, who were sanctioned by the U.S. Treasury for their alleged links to Russian intelligence. Zolotarjovs was arrested in the country of Georgia in 2023 and extradited to the United States in August 2024, where he later pleaded guilty.

The scale of the gang’s operations was extensive. The DOJ reported that the Karakurt gang targeted more than 54 companies, extracting at least $15 million in ransom payments from its victims. Prosecutors asserted that the group targeted U.S. government entities and stole children’s health information. Within the organization, Zolotarjovs was responsible for escalating pressure on victims who resisted the gang’s ransom demands. Karakurt does not appear to be an active ransomware gang, as some cybercriminal operations change owners and names, sometimes to evade sanctions.

The case highlights the broader geopolitical environment surrounding cybercrime. Security researchers have reported that the Russian government shields ransomware gangs and malicious hackers from Western law enforcement, including by refusing to extradite citizens accused of cyberattacks. U.S. officials have stated that Russia has become a “safe haven” for cybercriminals, citing the threat from ransomware as a major national security challenge facing the United States. The DOJ also asserted that Karakurt “fueled corruption” within the Russian government. These ties to officials allowed the gang’s leaders to avoid paying taxes to the state, and the gang regularly paid bribes to officials who exempted members from compulsory Russian military service.

Why it matters

The sentencing reveals how ransomware gangs operate not just as criminal enterprises, but as entities that leverage state-level access and corruption to intimidate victims, complicating the geopolitical landscape for cybersecurity.