DETROIT — The leader of a Russian cybercriminal group was sentenced to two years in federal prison Monday for conspiring with an organization that locked companies out of computers until executives paid more than $14.1 million.

The extortion scheme involving Illya Angelov and his criminal organization, known by the FBI as Mario Kart, is described in a federal case that remained a secret for more than two years until U.S. District Judge Nancy Edmunds unsealed the docket March 17 in Detroit.

The scheme ran from 2017-21 and victimized 72 companies in 31 states and across the region, including businesses in Detroit, Rochester Hills and Saginaw. Prosecutors said Angelov and co-conspirators built a network of compromised computers — called a botnet — that distributed malware-infected files attached to spam emails.

"Angelov and his co-manager then monetized this botnet by selling access to individual compromised computers ... ," Assistant U.S. Attorney Timothy Wyse wrote in a sentencing memorandum. "This access was sold to other criminal groups, who typically engaged in ransomware extortion schemes: locking victims out of their computer networks and demanding extortion payments to restore access."

Angelov pleaded guilty, in secret, in October to one count of conspiracy to commit wire fraud. Prosecutors want him to spend 61 months in prison, a significant break from advisory sentencing guidelines calling for more than 12 years.

He also was ordered to pay a $100,000 fine and a $1.6 million money judgment.

Angelov's lawyer, Fedor Kozlov, did not respond immediately to a message seeking comment Monday, and his sentencing memo is under seal.

"(Angelov's) sentencing memorandum discloses information that could reasonably expose (him) or others to retaliation or harm if publicly disclosed," Kozlov and a second lawyer, Arkady Bukh, wrote in a court filing.

The court records describe a scheme that was lucrative and prolific, sending 700,000 emails a day to computers around the world and infecting approximately 3,000 computers daily. The documents also chronicle a rare instance of a criminal willingly traveling from overseas to the U.S. to plead guilty and face a certain prison sentence.

The scheme operated before the peak of so-called ransomware extortion payments. Such payments reached a high of $1.25 billion in 2023, according to the 2025 Crypto Crime Report, by the data group Chainalysis.

How prosecutors identified Mario Kart malware scheme leader

Angelov's group included software coders who developed programs to distribute spam emails and malware so advanced it could evade virus-detection software, prosecutors said.

"The Mario Kart malware provided a backdoor through which software could be uploaded to victims’ computers," Wyse wrote. "Instead of directly exploiting this access, the Mario Kart group sold it to customers — other cybercriminal groups. These customers typically used the backdoor access to distribute ransomware, encrypting victims’ data and demanding extortion payments to decrypt it."

Angelov was sentenced four years after an associate, Vyacheslav Igorevich Penchukov, was arrested in Switzerland and later extradited to the U.S. He was a member of a group that negotiated a $1 million payment to Angelov and a second individual for access to Mario Kart.

"Crucially, he was aware of Angelov’s identity," the prosecutor wrote.

A few days after Penchukov's arrest, Angelov contacted U.S. authorities and eventually negotiated his surrender.

"Angelov’s decision to voluntarily travel to the U.S. to face charges should be considered in his sentencing ... ," Wyse wrote. "Yet, Angelov’s decision was a calculated one, and that it was not completely altruistic. It is also important to recognize that, at the time of Angelov’s ultimate travel and surrender, he was living in the United Kingdom, a country from which the U.S. could have sought his extradition."

Angelov also is scheduled to be sentenced five months after a member of Mario Kart, Vitlalii Alexandrovich Balint, was sentenced in federal court in Detroit to 20 months in prison. Balint provided "essential coding" to Mario Kart.

"While Balint’s role in the Mario Kart was significant, he was Angelov’s subordinate," Wyse wrote. "Given the differential of the two individuals’ guidelines’ ranges and relative culpability, a sentence less than the 61 months that the government requests would produce an unwarranted disparity between the two — even considering that Balint was extradited to the United States as opposed to voluntarily traveling, as Angelov did."

_____

©2026 The Detroit News. Visit detroitnews.com. Distributed by Tribune Content Agency, LLC.