Scammer transformed ads into malware

A prolific malvertising scammer has made his first appearance in court after being extradited to the US from Poland.

The Belarussian and Ukrainian national Maksim Silnikau, also known as Maksym Silnikov, has appeared in court to face charges of computer hacking and wire fraud.

At different points in his cybercrime career, Silnikau was known by his various online monikers, including “JP Morgan,” “xxx,” and “lansky,” as alleged in the unsealed court documents.

Silnikau has been charged with cybercrime related to malvertising, specifically distributing the Angler Exploit Kit, other malware, and online scams to millions of internet users, the Department of Justice said.

The cybercriminals operated from October 2013 until March 2022. However, Silnikau is being charged with additional crimes in the Eastern District of Virginia for his role as the founder and administrator of the Ransom Cartel ransomware strain, which began operating in May 2021.

Alongside Silnikau are his two co-conspirators, Volodymyr Kadariya and Andrei Tarasov, who are also being charged with cybercriminal activities.

According to the unsealed indictment, “Silnikau, Kadariya, Tarasov, and others in Ukraine and elsewhere used malvertising and other means to deliver malware, scareware, and online scams to millions of unsuspecting internet users in the United States and elsewhere.”

Malvertising is an attack that involves inserting malicious code into legitimate online advertising networks with the intent to defraud victims.

These attacks appeared legitimate but redirected victims who interacted with the advertisement to malicious websites. This scheme forced millions of internet users to access malicious content without their knowledge and attempted to defraud legitimate US-based advertisement companies.

“For years, the conspirators tricked advertising companies into delivering their malvertising campaigns by using dozens of online personas and fictitious entities to pose as legitimate advertising companies. They also developed and used sophisticated technologies and computer code to refine their malvertisements, malware, and computer infrastructure so as to conceal the malicious nature of their advertising,” said the Department of Justice.

Notably, Silnikau and others involved adopted a major role in disseminating the Angler Exploit Kit, which focused on web-based vulnerabilities in Internet browsers and plug-ins.

“At times during the scheme, the Angler Exploit Kit was a leading vehicle through which cybercriminals delivered malware onto compromised electronic devices,” The Department of Justice continued.

The criminals also distributed scareware ads, which showed false messages warning users that their computer had a virus or other issues. Scareware is a tactic that scares users into clicking on spoofed or infected websites or downloading malicious software.

In this case, this scareware tactic tried to fool victims into purchasing or downloading dangerous software, requesting victims to provide remote access to the device or asking them to disclose personally identifiable or financial information.

As alleged in the unsealed court documents, these cybercriminals used various strategies to profit from their far-reaching hacking and wire fraud schemes.

This included using accounts on predominantly Russian cybercrime forums to sell access to victims’ compromised devices, information stolen from victims, and records such as banking information and login credentials.