US prosecutors allege Karakurt ransomware gang exploited Russian state databases and law enforcement ties
The Justice Department accuses the group of fueling corruption within Russia to intimidate victims and disrupt critical US infrastructure, including 911 systems.
U.S. prosecutors have accused the Karakurt ransomware gang of leveraging access to Russian government databases and law enforcement connections to intimidate victims and evade taxes. According to the Justice Department, these state ties allowed gang leaders to avoid compulsory military service and facilitated a broader scheme of corruption within the Russian government.
Latvian hacker Deniss Zolotarjovs was sentenced to more than eight years in prison for his role in the operation. He was arrested in Georgia in 2023 and extradited to the United States in August 2024, where he subsequently pleaded guilty to charges related to the gang's activities.
The gang, which is alleged to be led by former heads of the Akira and Conti ransomware operations, targeted U.S. entities and extorted more than $15 million from over 54 companies. Prosecutors stated that the group relied on its access to Russian state resources to escalate pressure on victims who resisted ransom demands.
Specific allegations include the disruption of 911 emergency dispatch systems and the theft of children's health information. The DOJ contends that the gang "fueled corruption" by paying bribes to officials to secure exemptions from military service and tax breaks, effectively using state apparatus to shield its operations.
This case underscores ongoing concerns that Russia acts as a safe haven for cybercriminals, a view held by U.S. officials who cite ransomware as a top national security challenge. Security researchers have long accused the Russian government of shielding malicious hackers from Western law enforcement, including by refusing extradition requests.
The Russian Foreign Ministry did not respond to requests for comment regarding these specific accusations. While the Karakurt gang does not appear to be currently active, the DOJ notes that such groups often change owners and names to evade sanctions.
