LATVIAN EXTORTED GETS 8.5 YEARS FOR KARAKURT ROLE
INDUSTRY DESK■ 1 MIN READ
TUE, MAY 5, 2026■ AI-SUMMARIZED FROM 1 SOURCE ▸ TIMELINE
A Latvian national extradited to the U.S. has been sentenced to 8.5 years in prison for negotiating ransoms as a "cold case" operator for the Russian Karakurt extortion gang.
The defendant served as a negotiator for Karakurt, facilitating extortion payments from victims whose data the gang threatened to expose. Karakurt, also known as the BlackCat variant operators, has targeted hundreds of organizations globally through data theft and encryption attacks.
The extradition and conviction represent a notable enforcement action against major ransomware infrastructure. U.S. authorities have prioritized dismantling extortion networks following waves of attacks on critical infrastructure and healthcare systems.
Karakurt emerged as a significant threat in 2021, distinguishing itself by stealing data before deploying ransomware, giving victims multiple pressure points. The gang's negotiators communicated directly with victims to demand payments in cryptocurrency.
The prosecution underscores ongoing international cooperation against cybercriminal networks. Latvia's cooperation in the extradition reflects broader efforts by European nations to address ransomware operations operating from or through their territories.
■ MORE FROM THE SECURITY DESK
Cybercriminals have transformed DDoS attacks into a polished, commercialized service complete with pricing tiers, customer support, and reseller programs. The DDoS-as-a-Service market has evolved from basic tools into sophisticated attack platforms.
16H AGO— Industry Desk
Microsoft faced backlash after threatening a security researcher with criminal investigation, reigniting debate over software vulnerability disclosure practices and corporate responsibility.
16H AGO— Security Desk
Google is deploying Device Bound Session Credentials (DBSC) to all Chrome users, a security feature designed to prevent account takeovers by protecting session cookies from theft.
16H AGO— Industry Desk
Dutch authorities have dismantled a major botnet comprising 17 million infected devices and seized over 200 servers hosting the operation at a local provider.
16H AGO— Security Desk