Russian citizen Aleksei Volkov was recently sentenced in the US to over six years in prison for acting as an initial access broker and facilitating ransomware attacks that caused over $9 million in actual losses and over $24 million in intended losses, according to the DOJ’s Office of Public Affairs statement on March 23, 2026.

 

What happened

Aleksei Volkov, a 26-year-old Russian citizen from St. Petersburg, was sentenced in the Southern District of Indiana to 81 months in prison for his role in facilitating ransomware attacks across the United States. Volkov operated as an “initial access broker,” illegally gaining entry into corporate networks and selling that access to cybercriminal groups, including the Yanluowang ransomware group.

His activities facilitated dozens of ransomware attacks, resulting in actual losses of more than $9 million and intended losses exceeding $24 million. After being indicted in both Indiana and Pennsylvania, Volkov was arrested in Rome, Italy, and extradited to the US, where he pleaded guilty to multiple charges, including access device fraud, identity theft, and conspiracy to commit computer fraud and money laundering.

 

Going deeper

  • Initial access brokerage: Volkov identified vulnerabilities in corporate systems and sold unauthorized access to other attackers.
  • Ransomware deployment: His co-conspirators used that access to install malware that encrypted the victim's data.
  • Double extortion tactics: Victims were pressured to pay ransom to regain access and prevent public data leaks.
  • Cryptocurrency payments: Ransoms (sometimes in the tens of millions) were demanded in crypto and distributed among conspirators, showing the division of labor in modern cybercrime operations.

 

What was said

According to the DOJ’s press release, Volkov admitted that he and his co-conspirators “hacked into numerous victims’ computer networks, stole their data, deployed ransomware, demanded payment in cryptocurrency to exchange for restoring access to the data, and divided the ransom payments among themselves.”

The DOJ also stated that victims faced demands “sometimes in the tens of millions of dollars” and that in some cases, stolen data was published on leak sites when ransoms were not paid.

Officials from the Justice Department and FBI, including Assistant Attorney General A. Tysen Duva and representatives from FBI field offices in Indianapolis and Philadelphia, confirmed the investigation and prosecution.

 

By the numbers

  • An 81-month prison sentence to be served
  • $9.17 million in confirmed victim losses
  • Over $24 million in intended losses

 

In the know

An initial access broker (IAB) is a specialized cybercriminal who enters vulnerable systems and sells stolen credentials on the dark web. They do not execute the full attack. Their role has become common in ransomware operations, allowing attackers to outsource early-stage intrusion so that they can scale their operation faster.

Groups like Yanluowang use IABs to efficiently identify vulnerable targets, making ransomware campaigns faster and more extensive. IABs lower the barrier to entry for cybercriminals and increase the frequency of attacks.

These brokers use high-value entry points like domain administrator access, which grants control over an organization’s entire network, as well as access to control panels containing sensitive information. Additionally, exposed services such as remote desktop protocol (RDP) and poorly secured virtual private networks (VPNs) have become common and easily exploitable targets for attackers.

 

Why it matters

Ransomware is a highly organized, multi-actor operation with networks of specialists, including access brokers, malware developers, and negotiators, each contributing to the overall operation.

Cases like this show that organizations must stop attacks early, especially at the access stage. Organizations must, therefore, have proactive security measures in place, like vulnerability management, network monitoring, and employee awareness, to reduce risk before attackers ever get in.

Learn more: HIPAA Compliant Email: The Definitive Guide (2026 Update)

 

FAQs

What is ransomware?

Ransomware is malicious software that encrypts a victim's data, with attackers demanding payment to restore access or prevent data leaks.

 

What kind of data is at risk in a ransomware attack?

Ransomware attacks can expose protected health information (PHI), including medical records, treatment history, billing information, insurance details, and personally identifiable data such as names, addresses, and Social Security numbers.

 

Does a ransomware attack count as a HIPAA violation?

Yes. If protected health information (PHI) is accessed, encrypted, or disclosed without authorization, it is a HIPAA breach. It may require media reporting and compliance obligations.

Go deeper: How to respond to a data breach