Russian TA551 botnet co-manager gets 2 years over BitPaymer ransomware access

A US federal judge has sentenced Ilya Angelov, a co-manager of the spam botnet the FBI calls "Mario Kart" and researchers know as TA551 or Shathak, to 24 months in prison. His group sold access to infected machines, and the BitPaymer ransomware crew used that access to hit 72 US companies. The direct developer impact is small, but the case is a clear look at the initial-access economy behind most ransomware.

What happened

According to the US Attorney's Office for the Eastern District of Michigan, Judge Nancy Edmunds sentenced Angelov, 40, of Tolyatti, Russia, on 23 March 2026. He received 24 months in prison, a $100,000 fine and a $1.6 million money judgment after pleading guilty to managing the botnet. He went by "milan" and "okart" online.

Prosecutors say that from 2017 to 2021 Angelov and an unnamed co-manager ran a group that spread malware through spam attachments, built a botnet from infected machines, and sold access to other criminals, typically for ransomware. Reporting by The Record says the operation sent up to 700,000 messages a day and infected about 3,000 machines a day at its peak.

• BitPaymer: between August 2018 and December 2019, access from the botnet let the BitPaymer gang infect 72 US companies, leading to more than $14 million in extortion payments.
• IcedID: a group linked to IcedID paid more than $1 million for access in late 2019 or early 2020. The partnership lasted until about August 2021, according to the FBI.

The FBI Detroit Cyber Task Force led the investigation with Dutch and German authorities. The DOJ release does not say how Angelov came into US custody.

Who is affected

The victims were US corporations hit by BitPaymer and IcedID-linked ransomware through TA551 access. TA551 was among the most prolific malspam operations of its time. Mandiant documented its chain of password-protected archives, macro-enabled Word documents, the MOUSEISLAND downloader and PHOTOLOADER delivering IcedID, and other researchers tied it to Conti and Lockean ransomware distribution. Any organisation that received those spam waves was a potential target.

What it means for developers and engineering teams

The case shows that ransomware is usually a supply chain. One crew mass-produces footholds, another buys them and deploys encryption. Defending against the first stage is mostly about the techniques TA551 relied on: Office macros, password-protected archives that defeat attachment scanning, and loaders started by user clicks. Microsoft's default blocking of internet macros since 2022 has cut that path, and attackers have moved to LNK files, ISO/IMG containers and, more recently, ClickFix-style "paste this command" lures.

A two-year sentence for five years of enabling attacks that brought in more than $14 million is light. Combined with the rarity of Russian nationals reaching US courts at all, prosecution is not much of a deterrent here. Defence still carries most of the weight.

What to do now

• Keep Office macros blocked for files from the internet, and enforce it by Group Policy or Intune rather than relying on defaults.
• Quarantine or sandbox password-protected archives at the email gateway. Legitimate senders rarely need them.
• Block risky container and script attachments (ISO, IMG, VHD, LNK, HTA, JS) by default.
• Alert on Office or archive tools spawning powershell.exe, rundll32.exe, regsvr32.exe or mshta.exe.
• Assume one infected endpoint will be sold. Segment networks, use separate admin accounts, and keep offline, tested backups so a bought foothold doesn't turn into domain-wide encryption.

Sources

• US Attorney's Office, E.D. Michigan: Russian cybercriminal sentenced to prison for using botnet to steal millions from American businesses
• The Record: Russian botnet operator sentenced
• The Hacker News: Russian hacker sentenced to 2 years
• BleepingComputer: Russian man sentenced for operating botnet used in ransomware attacks