Yanluowang initial access broker to plead guilty to ransomware attacks

**Executive summary:** A Russian national admitted to serving as an initial access broker for the Yanluowang ransomware operation that targeted at least eight U.S. companies between July 2021 and November 2022; investigators recovered chat logs, stolen data, victim credentials, and blockchain traces linking ransom payments (~$1.5M) to the defendant, who faces multiple criminal charges, extradition consequences, and over $9.1M in restitution.