Russian Hacker Pleads Guilty to Money Laundering Linked to Ryuk Ransomware

Feb 08, 2023Ravie LakshmananCryptocurrency / Endpoint Security

A Russian national on February 7, 2023, pleaded guilty in the
U.S. to money laundering charges and for attempting to conceal the
source of funds obtained in connection with Ryuk ransomware
attacks.

Denis Mihaqlovic Dubnikov, 30, was arrested^[1]
in Amsterdam in November 2021 before he was extradited from the
Netherlands in August 2022. He is awaiting sentencing on April 11,
2023.

“Between at least August 2018 and August 2021, Dubnikov and his
co-conspirators laundered the proceeds of Ryuk ransomware attacks
on individuals and organizations throughout the United States and
abroad,” the Department of Justice (DoJ) said^[2].

Dubnikov and his accomplices are said to have engaged in various
criminal schemes designed to obscure the trail of the ill-gotten
proceeds.

According to DoJ, a chunk of the 250 Bitcoin ransom paid by a
U.S. company in July 2019 after a Ryuk attack was sent to Dubnikov
in exchange for about $400,000. The crypto was subsequently
converted to Tether and transferred to a co-conspirator, who then
exchanged it for the Chinese Renminbi.

In all, the parties involved in the criminal enterprise are
estimated to have laundered at least $150 million^[3]
in ransom payments.

Dubnikov is also the co-founder of Coyote Crypto and Eggchange,
with the latter headquartered in Federation Tower East (or Vostok),
a supertall skyscraper known to harbor several cryptocurrency
businesses^[4] with ties to money
laundering associated with ransomware operations.

According to Chainalysis, Eggchange received^[5]
over $34 million worth of cryptocurrency from darknet markets,
scams, fraud shops, and ransomware operators between 2019 and
2021.

Ryuk^[6], which first emerged on
the threat landscape in 2018, is attributed to a threat actor
tracked as Wizard Spider^[7]
and has compromised governments, academia, healthcare,
manufacturing, and technology organizations.

Often delivered through first-stage malware such as TrickBot^[8]
or BazarBackdoor^[9], Ryuk is also a
precursor to the Conti ransomware^[10], which shuttered its
operations in May 2022 and splintered into smaller units.