icloud[.]com

Russian hacker to plead guilty to aiding Yanluowang ransomware group A Russian national is set to plead guilty to several charges at the end of the month for his role as a participant in multiple Yanluowang ransomware attacks. Last week, federal prosecutors unsealed court documents for Aleksey Olegovich Volkov, a 25-year-old who was arrested in Rome two years ago. Court documents show evidence proving Volkov served as an initial access broker for the ransomware gang — breaking into the network of victims and then offering his access for a percentage of the ransom. The court documents were first spotted by reporter Seamus Hughes. The indictment lists at least eight victims, two of which paid hackers a total of about $1.5 million to unlock their systems. Volkov received a cut of more than $256,000. Prosecutors said he also earned thousands from offering other hackers access to the companies he had infiltrated. After his 2023 arrest in Rome, Volkov was extradited to the U.S. and on October 29, 2025 he agreed to a plea deal that will be signed at a federal court in Indiana on November 25 and his sentencing will take place at a later date. He is facing decades in prison on charges of hacking into computers, stealing information and attempting to extort companies. As part of the plea deal, Volkov agreed to pay more than $9 million in restitution to at least six of the victims. “The defendant admits being the [initial access broker] for the Yanluowang ransomware attacks against Victims 3 through 6, as well as other potential victims during the conspiracy, and knew that he was providing access to victim networks to his conspirators for the purpose of attacking them with ransomware,” the plea deal stated. “The defendant admits that he was paid a portion of the ransomware proceeds. The defendant admits that the conspirators divided the ransom payments amongst themselves, using numerous cryptocurrency transactions to conceal their identities and obfuscate the source of the funds.” chubaka.kor From July 2021 to November 2022, Volkov worked with members of the Yanluowang ransomware gang on several attacks targeting U.S.-based organizations. He helped the group with their initial access and also launched distributed denial-of-service (DDoS) attacks as well as other threatening tactics to force victims to pay ransoms. Some companies said executives received threatening calls from Yanluowang members demanding they pay ransoms. Victims included banks, telecommunications companies and engineering firms in Pennsylvania, California, Michigan, Illinois, Georgia and Ohio. The FBI was able to obtain a server that showed messages between a member of the ransomware gang and an account going by the name “chubaka.kor.” Many of the messages showed “chubaka.kor” offering the ransomware gang access to victim networks for a price. The FBI traced the ransom payments back to cryptocurrency addresses belonging to an account owned by “Alekseq Olegovi3 Volkov.” The cryptocurrency exchange confirmed that the account was verified with a Russian passport in the name of Aleksey Volkov with a birthdate of March 20, 2000. Using the email account tied to that cryptocurrency wallet, the FBI found a Twitter account which eventually led them to an Apple ID belonging to the email address alekseyvolkov4574@icloud[.]com. The FBI noted that they found evidence Volkov had also been communicating with members of the LockBit ransomware gang. Cybersecurity firm Symantec first discovered the Yanluowang group in October 2021, and it quickly got a reputation for the skill in which it targeted Western companies, such as Cisco and Walmart. The group disbanded at the end of 2022 when its leak site was hacked and the contents of one of the group’s discussion channels – some 2,700 messages sent between January and September 2022 – were uploaded to a website. Using the leaked chats, researchers and law enforcement confirmed a long-running suspicion — that despite the name, Yanluowang members were just masquerading as Chinese hackers. At least one member of the group was believed to be a member at the Russian Federation Ministry of Defense. Kaspersky researchers found a vulnerability in the Yanluowang encryption algorithm and released a free decrypter in 2022. Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

A Russian national will plead guilty to acting as an initial access broker (IAB) for Yanluowang ransomware attacks that targeted at least eight U.S. companies between July 2021 and November 2022. According to a plea agreement signed by the defendant on October 29, first spotted by Court Watch editor Seamus Hughes, Aleksey Olegovich Volkov (who used the "chubaka.kor" and "nets" aliases) breached corporate networks and sell that access to the ransomware group, which deployed ransomware to encrypt victims' data and sent ransom demands ranging from $300,000 to $15 million paid to be paid Bitcoin. FBI investigators obtained search warrants for a server linked to the operation, recovering chat logs, stolen data, victim network credentials, as well as evidence of Yanluowang email accounts used for ransom negotiations. They also traced Volkov's identity through Apple iCloud data (linked to an account using the alekseyvolkov4574@icloud[.]com Apple ID), cryptocurrency exchange records, and social media accounts (including a Twitter account associated with the qwerty4574@mail[.]ru email) linked to his phone number and Russian passport. The recovered chat logs showed Volkov negotiating deals with a co-conspirator known as "CC-1" and agreeing to receive a percentage of the ransom payments in exchange for providing credentials to the victims' networks. Following these attacks, Volkov collected a percentage of the resulting $1.5 million in ransom payments. While reviewing documents from Volkov's Apple account, investigators also found a screenshot of a chat between the defendant and a user named LockBit, suggesting a potential link to the notorious LockBit ransomware gang, according to an affidavit signed by FBI Special Agent Jeffrey Hunter. Volkov was linked to network breaches affecting a Philadelphia-based company, an engineering firm with 19 U.S. offices, a California company, a Michigan bank, an Illinois business, a Georgia company, an Ohio telecommunications provider, and a business in the Eastern District of Pennsylvania. Two of the victims paid a total of $1.5 million in ransoms, with blockchain analysis tracing portions of these payments to Bitcoin addresses Volkov provided to CC-1 in their chats, including $94,259 and $162,220 from two different Yanluowang attacks. Volkov is currently facing a maximum sentence of 53 years in prison for several charges, including unlawful transfer of a means of identification, trafficking in access information, access device fraud, aggravated identity theft, conspiracy to commit computer fraud, and conspiracy to commit money laundering. He will also be required to pay over $9.1 million ($9,167,198.19) in restitution to the victims of the Yanluowang attacks he was involved in. The Yanluowang ransomware operation was first spotted in October 2021 and has been linked to highly targeted attacks against companies worldwide. Volkov was arrested in Italy in January 2024, extradited to the United States that same year, and charged after Yanluowang stole non-sensitive files from a Cisco employee's Box folder in May 2022, but failed to encrypt its systems and collect a ransom. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report