Moscow Man Charged in Extortion of Conti Ransomware Gang via Federal Security Service Impersonation
Published
Key Takeaways
- Suspect Charged: A Moscow resident, Ruslan Satuchin, has been formally charged with attempting to extort the Conti ransomware gang.
- Alleged Impersonation: Satuchin is accused of posing as an officer of Russia’s Federal Security Service (FSB) to demand payment in exchange for protection from prosecution.
- Notorious Target: The Conti ransomware group was one of the most prolific cybercriminal organizations before it officially disbanded in 2022.
Russian authorities have charged a Moscow man with attempting to extort the infamous Conti ransomware group by falsely representing his position and authority. The suspect, Ruslan Satuchin, allegedly impersonated an officer of the Federal Security Service (FSB) to demand a significant payment from Conti members.Â
Conti Extortion Allegations
The scheme began in September 2022, when the Russian man contacted a gang member, claiming he could leverage his supposed influence to shield them from criminal prosecution for a large sum of money, reported the Russian outlet RBC, citing sources familiar with the investigation.
The criminal case against Satuchin and "unidentified individuals" was formally opened in September 2025, and he is currently being held in pre-trial detention. Satuchin, who denies the allegations, faces up to 10 years in prison and a fine of up to one million rubles if convicted.Â
This case is notable as it involves one of the most destructive ransomware groups being targeted by a traditional extortion scheme from within its own operating region.
Conti Ransomware Legacy
The Conti ransomware group was a dominant force in global cybercrime, responsible for high-profile attacks against entities worldwide. The group officially ceased operations in 2022 following internal fractures, notably after a major leak of their internal chat logs and source code.
Despite the brand's dissolution, security researchers have traced its former members to new ransomware operations, including Akira and BlackBasta.Â
In October 2025, a Conti suspect was extradited from Ireland to the U.S. to face charges, and Conti and Trickbot ransomware operators were exposed in a massive data leak in June 2025. In May 2025, researchers observed LockBit and Conti TTPs leveraged by DragonForce in ransomware attacks.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular