Ransomware negotiator jailed for 8.5 years after exploiting stolen children’s health records and making millions
A Latvian national has to serve a prison sentence for his role as a negotiator for one of the most notorious ransomware groups in the world. He accounts for $56 million in losses and 53 companies falling victims to his crime.
Deniss Zolotarjovs, a 35-year-old man from Latvia, was arrested in December 2023 and transferred to the United States in August 2024. A year later, in July 2025, he pleaded guilty to money laundering and wire fraud.
According to the US Attorney’s Office in the Southern District of Ohio, Zolotarjovs was involved in a ransomware conspiracy scheme from June 2021 through March 2023.
In this short period of time, a ransomware extortion group known as Karakurt, TommyLeaks, and SchoolBoys Ransomware caused more than $56 million in losses, with at least 53 victims to its name.
The Attorney’s Office alleges that Zolotarjovs played a key role in the extortion scheme. Online chats show that he was personally involved in negotiating with victims and strategizing on the extortion threats with coconspirators.
Although Zolotarjovs didn’t actively participate in cyberattacks, his role was to analyze the data that was stolen and advise on ransom negotiations. For this task, he received a 10% cut of the ransom payments. He was paid in cryptocurrency, which was then moved through multiple wallets before the funds were ultimately exchanged for Russian rubles.
For these crimes, Zolotarjovs has been sentenced to imprisonment for 102 months in federal court, or 8.5 years.
“With this sentence, a cruel, ruthless, and dangerous international cybercriminal is now behind bars,” Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division, said in a statement.
According to him, Zolotarjovs helped his ransomware gang profit from hacks of dozens of companies. He was also responsible for taking down a 911 system. The suspect also used stolen children’s health information to increase his leverage to extort victim payments.
“The Criminal Division will continue to investigate and prosecute international hackers and extortionists from around the world, no matter where they live or operate,” Duva concludes.
Unlock more exclusive Cybernews content on YouTube.
