On October 1, 2024, the U.S. Justice Department unsealed an indictment charging Russian national Aleksandr Viktorovich Ryzhenkov (Александр Викторович Рыженков) with using the BitPaymer ransomware variant to attack victims in Texas and across the United States. Ryzhenkov allegedly accessed sensitive data from computer networks and held it for ransom.
According to the indictment, filed in the Northern District of Texas, Ryzhenkov and his conspirators began their activities in at least June 2017. They allegedly infiltrated victims' systems through phishing campaigns, malware, and exploiting vulnerabilities in hardware and software. The ransomware encrypted files and left electronic notes demanding ransom in exchange for a decryption key and a promise not to leak the data online.
The attackers reportedly demanded millions of dollars from their victims, who were paralyzed by the ransomware attacks. Ryzhenkov is believed to still be in Russia, and the FBI has issued a wanted poster for him.
In conjunction with the unsealing of the indictment, the U.S. Department of the Treasury added Ryzhenkov to its list of specially designated nationals, effectively blocking any property or interests he may have in the United States and prohibiting financial institutions from engaging in transactions with him.
Deputy Attorney General Lisa Monaco emphasized the Department’s commitment to combating ransomware, stating that Ryzhenkov and his conspirators stole sensitive data from innocent Americans and extorted them. U.S. Attorney Leigha Simonton for the Northern District of Texas highlighted the devastating impact of ransomware attacks, which can cripple companies quickly, even if ransoms are paid.
FBI Deputy Director Paul Abbate reinforced the message that cybercriminals will face severe consequences and will be held accountable. The FBI Dallas Field Office is leading the investigation into the case.
