Person

Aleksandr Viktorovich Ryzhenkov

Sanctioned entity

Born 26 May 1993 (33 years old),Russia. Named in 4 sanctions listings.

Screen this subject

Summary

The Director Disqualification Sanction was imposed on 09/04/2025.

Second-in-command of Evil Corp and Lockbit affiliate

Ryzhenkov is believed to reside in Russia, possibly Moscow.

Aleksandr Ryzhenkov is wanted for his alleged involvement in ransomware attacks and money laundering activities. It is alleged that, through the use and deployment of BitPaymer ransomware, Ryzhenkov left electronic notes in the form of a text file on victims’ computers. The notes included email addresses for the victims and provided a virtual currency address to use to pay the ransom. Ryzhenkov is known to be a close associate of

Sanctions and listings4

  • Listed
    1 Oct 2024

    Cyber-Related Sanctions - CYBER2

    Office of Foreign Assets ControlUS OFAC Specially Designated Nationals (SDN) ListUnited States

    CYBER2 and block

    Executive Order 13694 (Cyber)

    Programme US-CYBReference 50631treasury.govofac.treasury.gov

  • Effective
    1 Oct 2024

    UK sanctions relating to cyber activity - The Cyber (Sanctions) (EU Exit) Regulations 2020

    UK; Foreign, Commonwealth & Development OfficeUK FCDO Sanctions ListUnited Kingdom

    Asset freeze, travel ban and director disqualification sanction

    Aleksandr Viktorovich RYZHENKOV is a member of Evil Corp, and has been involved in relevant cyber activity, including being responsible for, engaging in and providing support for malicious cyber activity that resulted in the unauthorised access and exfiltration of sensitive data from UK infrastructure and networks. He has also provided technical assistance that could contribute to relevant cyber activity. Aleksandr RYZHENKOV was a senior member and manager of Evil Corp, and was involved in the development and deployment of ransomware that was used by Evil Corp to carry out its relevant cyber activity. Additionally, Aleksandr RYZHENKOV is linked to the deployment of LockBit ransomware and is associated with UNC2165 (an evolution of Evil Corp affiliated actors). Evil Corp's malicious cyber activity involved a concerted effort to compromise UK health, government and public sector institutions, and commercial technology companies, for financial gain, which undermined or was intended to undermine the integrity, prosperity and security of the United Kingdom and its allies.

    Aleksandr Viktorovich RYZHENKOV is a member of Evil Corp, and has been involved in relevant cyber activity, including being responsible for, engaging in and providing support for malicious cyber activity that resulted in the unauthorised access and exfiltration of sensitive data from UK infrastructure and networks. He has also provided technical assistance that could contribute to relevant cyber activity. Aleksandr RYZHENKOV was a senior member and manager of Evil Corp, and was involved in the development and deployment of ransomware that was used by Evil Corp to carry out its relevant cyber activity. Additionally, Aleksandr RYZHENKOV is linked to the deployment of LockBit ransomware and is associated with UNC2165 (an evolution of Evil Corp affiliated actors). Evil Corp's malicious cyber activity involved a concerted effort to compromise UK health, government and public sector institutions, and commercial technology companies, for financial gain, which undermined or was intended to undermine the integrity, prosperity and security of the United Kingdom and its allies.

    Programme GB-CYBReference 16593Reference CYB0062Last updated 9 Apr 2025gov.ukgov.uk

  • Significant Cyber Incidents Sanctions Regime - Autonomous (Thematic - Cyber)

    Department of Foreign Affairs and TradeAustralian Sanctions Consolidated ListAustralia

    Travel ban and targeted financial sanction

    Autonomous Sanctions (Designated Persons and Entities and Declared Persons – Thematic Sanctions) Amendment (No. 5) Instrument 2024

    Programme AU-CYBLast updated 2 Oct 2024dfat.gov.audfat.gov.au

  • Listed
    10 Oct 2024
    Effective
    1 Oct 2024

    Reciprocal

    OFACUS SAM Procurement ExclusionsUnited StatesActive

    Prohibition/Restriction

    Redacted for Security Reasons

    sam.gov

Connections1

Other links1

  • DRIDEX GANGSanctionedDebarred
    Linked to
    "Providing support to"RussiaMoldova

Identifiers2

IdentifierNumberIssued by
Passport643501126
Passport643501126Russia

Other names18

Also known as5

Jim MorrisonАлександр Викторович РЫЖЕНКОВAleksandr Viktorovich RYZHENKOVRYZHENKOV, Aleksandr ViktorovichALEKSANDR RYZHENKOV

Weak aliases13

Spellings the source flags as too generic to establish a match on their own.

mx1rBeverleyMrakobekGLizardkingSanya MaloyGuesterBeverlyJ.d.m0rr1s0nKotoselSasha MaloyAnonyminemCherdakmudak

This page shows the public record as its publishers state it. A name here is not by itself a finding: whether a record refers to a particular person or company is what screening decides. Read the full notice.