Aleksandr Viktorovich Ryzhenkov
Sanctioned entityBorn 26 May 1993 (33 years old),Russia. Named in 4 sanctions listings.
Summary
The Director Disqualification Sanction was imposed on 09/04/2025.
Second-in-command of Evil Corp and Lockbit affiliate
Ryzhenkov is believed to reside in Russia, possibly Moscow.
Aleksandr Ryzhenkov is wanted for his alleged involvement in ransomware attacks and money laundering activities. It is alleged that, through the use and deployment of BitPaymer ransomware, Ryzhenkov left electronic notes in the form of a text file on victims’ computers. The notes included email addresses for the victims and provided a virtual currency address to use to pay the ransom. Ryzhenkov is known to be a close associate of
Sanctions and listings4
- Listed
- 1 Oct 2024
Cyber-Related Sanctions - CYBER2
Office of Foreign Assets ControlUS OFAC Specially Designated Nationals (SDN) ListUnited States
CYBER2 and block
Executive Order 13694 (Cyber)
Programme US-CYBReference 50631treasury.govofac.treasury.gov
- Effective
- 1 Oct 2024
UK sanctions relating to cyber activity - The Cyber (Sanctions) (EU Exit) Regulations 2020
UK; Foreign, Commonwealth & Development OfficeUK FCDO Sanctions ListUnited Kingdom
Asset freeze, travel ban and director disqualification sanction
Aleksandr Viktorovich RYZHENKOV is a member of Evil Corp, and has been involved in relevant cyber activity, including being responsible for, engaging in and providing support for malicious cyber activity that resulted in the unauthorised access and exfiltration of sensitive data from UK infrastructure and networks. He has also provided technical assistance that could contribute to relevant cyber activity. Aleksandr RYZHENKOV was a senior member and manager of Evil Corp, and was involved in the development and deployment of ransomware that was used by Evil Corp to carry out its relevant cyber activity. Additionally, Aleksandr RYZHENKOV is linked to the deployment of LockBit ransomware and is associated with UNC2165 (an evolution of Evil Corp affiliated actors). Evil Corp's malicious cyber activity involved a concerted effort to compromise UK health, government and public sector institutions, and commercial technology companies, for financial gain, which undermined or was intended to undermine the integrity, prosperity and security of the United Kingdom and its allies.
Aleksandr Viktorovich RYZHENKOV is a member of Evil Corp, and has been involved in relevant cyber activity, including being responsible for, engaging in and providing support for malicious cyber activity that resulted in the unauthorised access and exfiltration of sensitive data from UK infrastructure and networks. He has also provided technical assistance that could contribute to relevant cyber activity. Aleksandr RYZHENKOV was a senior member and manager of Evil Corp, and was involved in the development and deployment of ransomware that was used by Evil Corp to carry out its relevant cyber activity. Additionally, Aleksandr RYZHENKOV is linked to the deployment of LockBit ransomware and is associated with UNC2165 (an evolution of Evil Corp affiliated actors). Evil Corp's malicious cyber activity involved a concerted effort to compromise UK health, government and public sector institutions, and commercial technology companies, for financial gain, which undermined or was intended to undermine the integrity, prosperity and security of the United Kingdom and its allies.
Programme GB-CYBReference 16593Reference CYB0062Last updated 9 Apr 2025gov.ukgov.uk
Significant Cyber Incidents Sanctions Regime - Autonomous (Thematic - Cyber)
Department of Foreign Affairs and TradeAustralian Sanctions Consolidated ListAustralia
Travel ban and targeted financial sanction
Autonomous Sanctions (Designated Persons and Entities and Declared Persons – Thematic Sanctions) Amendment (No. 5) Instrument 2024
Programme AU-CYBLast updated 2 Oct 2024dfat.gov.audfat.gov.au
- Listed
- 10 Oct 2024
- Effective
- 1 Oct 2024
Reciprocal
OFACUS SAM Procurement ExclusionsUnited StatesActive
Prohibition/Restriction
Redacted for Security Reasons
Connections1
Other links1
- DRIDEX GANGSanctionedDebarredLinked to"Providing support to"RussiaMoldova
Identifiers2
| Identifier | Number | Issued by |
|---|---|---|
| Passport | 643501126 | |
| Passport | 643501126 | Russia |
Other names18
Also known as5
Weak aliases13
Spellings the source flags as too generic to establish a match on their own.
This page shows the public record as its publishers state it. A name here is not by itself a finding: whether a record refers to a particular person or company is what screening decides. Read the full notice.