Russian initial access broker who fed ransomware crews gets 81 months in US prison
Aleksei Volkov sentenced after enabling attacks that cost victims millions
A Russian national who sold the keys to corporate networks faces nearly seven years in a US prison after prosecutors tied his handiwork to a string of ransomware attacks costing victims millions of dollars.
Aleksei Volkov, 26, was sentenced to 81 months behind bars for his role as an initial access broker, a behind-the-scenes operator who breaks into company systems then sells that foothold to other criminals. He was extradited from Italy to the US to face the charges, part of a broader push by authorities to pursue enablers of cybercrime rather than just the crews that carry out the attacks.
Prosecutors say Volkov broke into company networks and sold that access on criminal forums, effectively handing over ready-made entry points to ransomware groups and other extortion outfits. One of those buyers was the Yanluowang gang, which used the footholds to launch attacks against organizations in the US and elsewhere.
REG AD
The activity affected multiple victims. Court filings say Volkov helped enable intrusions into at least seven US organizations, with ransomware crews moving in after access had been secured. By that stage, the hardest part of the job – getting inside – was already achieved.
REG AD
Case documents lay out how the business operated. Volkov obtained and sold access to compromised networks, sometimes charging a flat fee and other times taking a cut of any ransom paid. In one instance, he received roughly 20 percent of a $500,000 payout; in another, about 16 percent of a $1 million ransom.
Prosecutors say the attacks tied to his activity resulted in around $9 million in actual losses and more than $24 million in intended losses.
In November 2025, Volkov pleaded guilty to charges including conspiracy to commit computer fraud, bringing the case to a close after months of proceedings. As part of his sentence, he has also been ordered to pay restitution to victims.
The case is another example of how the ransomware economy now runs on specialization. Volkov's role was to obtain access and sell it on, leaving others to handle the encryption, data theft, and negotiations. He never deployed malware himself, but made sure others didn't have to start from scratch.
Volkov may have kept his distance from the actual attacks, but not far enough to escape the fallout. ®