Malware Mastermind Andrei Tarasov Evades US Extradition Returns to Russia

In a significant setback for US cybercrime enforcement efforts, Russian hacker Andrei Tarasov has evaded extradition to the United States and successfully returned to his homeland, intelligence sources confirm.

Tarasov, 33, known in cybercriminal circles by the aliases “Aels” and, more recently, “Lavander,” was arrested in Berlin on July 18, 2023, as part of a coordinated international operation that also captured his alleged accomplice Maksim Silnikau in Spain.

The Russian national spent six months in Berlin’s Moabit Prison awaiting potential extradition to face serious cybercrime charges in the US.

According to US indictments, Tarasov, Silnikau, and Volodymyr Kadariya allegedly orchestrated a sophisticated “malvertising” operation between 2013 and 2022 that infected millions of computers worldwide.

The group reportedly deployed the notorious Angler exploit kit, which quickly probed computers for vulnerabilities before silently delivering malware.

Malware Mastermind Evades US Extradition

US authorities claim Tarasov developed a specialized traffic distribution system for $2,500 that helped circumvent security measures.

“As alleged, Silnikau, Kadariya, Tarasov, and conspirators used multiple strategies to profit from their widespread hacking and wire fraud,” stated the US Department of Justice in documents released after Silnikau’s extradition from Poland in August 2024.

However, in a surprising development, the Higher Regional Court of Berlin ordered Tarasov’s release in January 2024 after determining the US charges were insufficiently concrete to warrant extradition.

Following his release, Tarasov traveled by car to Poland and then into Russia’s Kaliningrad region before eventually reaching Moscow, reads Intel741 report.

“I’m stuck in Russia, beginning from the zero. And I still owe my lawyer,” Tarasov wrote on May 5, 2025, in a cybercrime forum where he remains active. What makes Tarasov’s case particularly intriguing is his previously documented anti-Russian stance.

In past forum posts, he harshly criticized the Russian government, once writing: “Nothing is left from the ‘great’ country I grew up in except for a bunch of clowns and the battle against America”.

Intelligence sources indicate he may have previously received asylum in Ukraine, citing political persecution in Russia. Despite escaping US prosecution, Tarasov’s return to Russia has not been without challenges.

In a recent forum post, he cryptically mentioned: “Over the following nine months I learned that there were places no better than prison, but that’s a whole ‘nother story”.

Meanwhile, Tarasov’s alleged co-conspirator Silnikau faces prosecution in the US for the malvertising operation and for allegedly creating the Ransom Cartel ransomware strain.

The UK’s National Crime Agency has further linked men to “pioneering both the exploit kit and ransomware-as-a-service models”.

Tarasov remains on the US Secret Service’s Most Wanted list, and authorities are offering substantial rewards for information leading to the capture of individuals involved in these cybercrime networks.

However, due to Russia’s policy of not extraditing its citizens, Tarasov appears to have successfully evaded US prosecution for now.

Vulnerability Attack Simulation on How Hackers Rapidly Probe Websites for Entry Points – Free Webinar