Mario Kart Manager Sentenced for Botnet Attacks on US Corporations

A Russian national who managed Mario Kart was sentenced to 24 months in prison by a U.S. District Court. Ilya Angelov, 40, pled guilty to managing a sophisticated botnet network of compromised computers that facilitated devastating ransomware attacks against several dozen American businesses.

Between 2017 and 2021, Angelov, who went by the aliases “milan” and “okart,” co-managed a Russia-based cybercriminal syndicate designated by the FBI as Mario Kart ( also known as TA-551, Shathak, GOLD CABIN, Monster Libra, ATK236, and G0127), according to court records.

The Mario Kart group built its illicit network through a massive spam email campaign that could send 700,000 emails a day, distributing malware-infected attachments to compromise devices, possibly approximately 3,000 computers per day.

The operators monetized the botnet by selling direct access to these infected nodes to secondary cybercriminal gangs. These purchasing groups utilized the access to execute ransomware attacks, encrypting victim networks and demanding payments for network decryption keys.

Investigations led by the FBI cyber task force revealed that a ransomware organization linked to the Mario Kart botnet successfully extorted over $14 million from more than 70 U.S. corporations. Another threat group paid Angelov's syndicate over $1 million for access.

In the Mario Kart prosecution case, in addition to the 2-year prison term, the judge imposed a $100,000 fine and entered a $1.6 million money judgment against the defendant.

“ Foreign cybercriminals like this defendant target American citizens and corporations. Their methods grow in sophistication. But their motive remains the same – to rip off and harm us ,” said U.S. Attorney Gorgon.

Earlier this month, a Russian Phobos Ransomware admin pleaded guilty to wire fraud conspiracy