In a significant development for cybersecurity, four members of the notorious REvil ransomware group have been sentenced to prison in Russia, marking a rare instance of Russian cybercriminals facing justice for their crimes. The individuals—Artem Zaets, Alexei Malozemov, Daniil Puzyrevsky, and Ruslan Khansvyarov—were found guilty of charges related to the illegal circulation of means of payment, with Puzyrevsky and Khansvyarov also convicted for using and distributing malware.

Zaets received a 4.5-year sentence, while Malozemov was sentenced to five years. Khansvyarov and Puzyrevsky faced longer terms of 5.5 and 6 years, respectively. These convictions come after a larger investigation where 14 members of the group were initially detained. Reports indicate that eight of them were charged for their involvement, while four others are currently being prosecuted under separate charges related to unlawful access to computer information.

REvil gained notoriety as one of the most prolific ransomware operations before it was dismantled following a crackdown by Russia’s Federal Security Service (FSB). This takedown marked an unprecedented effort to combat cybercrime within the country.

The timing of these sentences is noteworthy, especially following the U.S. sentencing of Ukrainian national Yaroslav Vasinskyi, who received 13 years for conducting over 2,500 REvil attacks and demanding ransoms exceeding $700 million. Additionally, these Russian convictions come on the heels of an investigation into two organizations, Cryptex and UAPS, which were sanctioned by the U.S. for their roles in facilitating money laundering for cybercriminals.

This case reflects a growing trend of accountability within Russia’s approach to cybercrime, although such convictions remain rare, highlighting the complexities of enforcing cybersecurity laws in a global context.