Counterintelligence & Tradecraft — 2026-05-05

Karakurt Ransomware Negotiator Sentenced to 8.5 Years, Linked to Conti and Six Extortion Brands

Latvian national Deniss Zolotarjovs, 35, of Moscow, received 102 months in federal prison in the Southern District of Ohio for conspiring to commit money laundering and wire fraud as a member of a Russian ransomware organization that operated under at least six brands including Conti, Karakurt, Royal, TommyLeaks, SchoolBoys, and Akira. The FBI linked him to documented losses exceeding $56.5 million from 13 American victims during his active participation from June 2021 to August 2023; the DOJ estimates total losses for that period likely reached the hundreds of millions. Zolotarjovs served as a cold-case extortion negotiator who analyzed stolen data and exploited access to sensitive personal information, including leveraging children's health records from a pediatric healthcare company to pressure victims. He was arrested in Georgia in December 2023 and contested extradition before being transferred to US custody in August 2024, pleading guilty in July 2025.

Analysis
Zolotarjovs's conviction is the first to establish human continuity across the Conti-to-Karakurt-to-Royal-Akira rebranding chain in federal court, converting a liability-limiting practice Russian operators depend on into a prosecutable pattern. His extradition, a Latvian national transferred from a NATO partner, confirms law enforcement is systematically targeting the accessible, non-Russian tier of franchise structures headquartered beyond Western extradition reach. The conviction may have reached only that margin: core developers and infrastructure operators remain in Russia, beyond extradition reach. DOJ has demonstrated it can map organizational continuity across rebranding events, and additional US or allied disruption actions against Russia-linked ransomware infrastructure are likely within the next six months.
4 sources
  1. Member of Prolific Russian Ransomware Group Sentenced to Prison - Department of Justice
  2. Karakurt extortion gang 'cold case' negotiator gets 8.5 years in prison - BleepingComputer
  3. Latvian national involved with Karakurt and other ransomware gangs sentenced for his role in ransomware organization - DataBreaches.Net
  4. Ransomware negotiator sentenced in Cincinnati for millions of dollars in attacks - Local 12 (WKRC Cincinnati)

View in full brief →

UNCLASSIFIED // OPEN SOURCE