In a remarkable tale of international cybercrime, espionage, and legal intrigue, Russian national Andrei Vladimirovich Tarasov-known online as “Aels” and “Lavander,”-has resurfaced in Russia after narrowly escaping extradition to the United States from Germany.
Tarasov, 33, was at the center of a sweeping U.S. indictment that accused him and two alleged accomplices of orchestrating one of the most prolific global malware and data theft operations of the last decade.
The Cybercrime Scheme
Tarasov, along with Maksim Silnikau (a Belarusian-Ukrainian dual national) and Volodymyr Kadariya of Belarus, was indicted in New Jersey in June 2023 on charges of conspiracy to commit wire fraud, computer fraud and abuse, and multiple counts of wire fraud.
Prosecutors allege the trio ran a sophisticated operation from 2013 to 2022, infecting millions of computers worldwide through malicious online advertisements-so-called “malvertisements”-and selling stolen data and access to other criminals.
Their weapon of choice was the notorious Angler exploit kit, a tool that at its peak accounted for 40% of all exploit kit attacks globally and generated an estimated $34 million annually.
The Angler kit allowed the group to quickly identify software vulnerabilities on victims’ computers and silently install malware, including early ransomware strains.
Once infected, the compromised machines’ data-such as login credentials and financial information-were sold on cybercrime forums, fueling further waves of fraud and extortion.
Arrest and Legal Drama in Germany
Tarasov’s cybercriminal activities caught up with him in July 2023 when Berlin police arrested him at the request of U.S. authorities.
He spent six months in Moabit Prison, a pretrial and extradition facility, while the U.S. pressed for his extradition.
During his detention, Tarasov claimed to have cooperated with the FBI, providing information on other hackers, including a high-profile member of the Conti ransomware group, in part due to his opposition to Russia’s war in Ukraine and personal losses suffered in the conflict.
Despite this, Tarasov refused further cooperation, especially after U.S. authorities continued to pursue his extradition.
In a dramatic turn, the Berlin General State Prosecution Office determined the U.S. charges were insufficiently concrete, and the Superior Court of Justice affirmed his release in January 2024.
Tarasov immediately vanished from Germany, later turning up in Russia country that does not extradite its citizens.
A Return to the Underground
Tarasov’s escape was confirmed by cybercrime sources, who tracked his journey from Germany to Russia via Poland and the Kaliningrad border.
On underground forums, Tarasov, using his “Lavander” persona, recounted his release and subsequent flight, expressing surprise at his good fortune and hinting at further troubles with Russian authorities upon his return.
Despite his legal ordeal, Tarasov remains active in cybercrime circles. His GitHub profile features recent projects related to mass emailing and spam, and he continues to participate in Telegram channels dedicated to spamming and hacking.
He openly discusses his experiences, legal battles, and regrets, warning others about the risks of engaging with U.S. law enforcement and reflecting on the personal costs of his choices.
A Divisive Figure
Tarasov’s anti-Russian government views and support for Ukraine have made him a controversial figure even among fellow cybercriminals.
Some have criticized his political stance and questioned whether to support him financially during his legal troubles, while others have urged the community to avoid political infighting.
Ongoing Impact
While Tarasov remains on the U.S. Secret Service’s Most Wanted list, his case highlights the challenges of prosecuting transnational cybercrime, especially when suspects find sanctuary in countries unwilling to extradite.
Meanwhile, the cybercrime models he helped pioneer- exploit kits and ransomware-as-a-service-continue to fuel a global wave of digital extortion and data theft, underscoring the enduring threat posed by actors like Tarasov.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant updates
%20(1).webp?fit=1600,900&ssl=1&description=Tarasov, 33, was at the center of a sweeping U.S. indictment that accused him and two alleged accomplices of orchestrating one of the most prolific global malware){kind=link}