The U.S. Department of State has announced a reward of up to $2.5 million for information leading to the arrest or conviction of Volodymyr Kadariya, a Belarusian national suspected of playing a significant role in an extensive malware distribution network. Kadariya, 38, is known by several aliases, including “Stalin,” “Eseb,” and “baxus,” and is accused of disseminating the Angler Exploit Kit and other malicious software to millions of unsuspecting victims through online advertisements.
Kadariya’s activities reportedly spanned from October 2013 to March 2022, during which time the Angler Exploit Kit emerged as one of the most prominent tools used by cybercriminals to infect compromised devices. According to the U.S. Department of State, at the height of its usage, Angler was responsible for 40% of all exploit kit infections, targeting approximately 100,000 devices and generating an estimated annual revenue of $34 million, as reported by the British National Crime Agency (NCA).
In June, Kadariya was indicted on charges of financial and computer fraud. The malvertising campaigns he was allegedly involved in were designed to appear legitimate but often redirected victims to malicious websites intent on defrauding them or compromising their devices with malware. These deceptive ads lured victims into purchasing or downloading harmful software, granting remote access to their devices, or disclosing sensitive personal or financial information.
The indictment also alleges that Kadariya and his associates profited by selling access to compromised devices on Russian cybercrime forums. Additionally, they are accused of selling stolen information, including banking details and login credentials, which were recorded in logs for further exploitation.
In a related development, Kadariya’s co-conspirator, Maksim Silnikau, a Belarusian-Ukrainian national, was arrested and extradited to the U.S. earlier in August. Silnikau is known for leading two long-running cybercrime schemes and is credited with creating the first-ever ransomware-as-a-service model, known as Reveton. This model allowed even low-skilled criminals to launch ransomware attacks for a fee. Silnikau is also believed to have been involved with the Angler Exploit Kit.
If convicted, Kadariya, Silnikau, and a third associate, Andrei Tarasov, could face substantial prison sentences, including a maximum of 27 years for wire fraud conspiracy, 10 years for computer fraud conspiracy, and 20 years for each wire fraud count.
