A new indictment alleges a Russian citizen was extradited this week from the Netherlands in Portland laundered more than $400,000 worth of cryptocurrency mined from ransomware attacks in the United States in July 2019.

Denis Mihaqlovic Dubnikov, 29, pleaded not guilty through his attorney to one count of conspiracy to commit money laundering in his first appearance in federal court Wednesday afternoon.

U.S. Magistrate Judge Jolie A. Russo authorized Dubnikov’s release on GPS monitoring pending trial. A five-day trial has been tentatively set for October 4.

According to the indictment, Dubnikov and his alleged accomplices laundered payments extracted from victims of so-called Ryuk ransomware attacks. In total, the conspiracy allegedly laundered more than $70 million in ransom proceeds worldwide, according to the indictment.

Ryuk attempts to delete all backup files present on a computer or network and then begins to encrypt the files, prosecutors say. A “ransom note” is also placed on the computer system when the files are encrypted, providing email addresses usually through a foreign web provider that victims can use to contact people deploying the ransomware. The alleged Ryuk actors also provide a bitcoin wallet address that victims are told to use to pay a ransom to have their files decrypted, according to the indictment.

The indictment included this sample ransomware note.

The ransomware plot attacked thousands of victims worldwide, including thousands in the United States and several in Oregon, according to the indictment. The heavily redacted indictment does not identify the victims of Dubnikov’s alleged crime.

Victims were from private industry, state and local municipalities, local school districts, critical infrastructure, hospitals and other health care services and providers. Victims paid approximately $150 million to recover files, according to the indictment.

In a known example, Ryuk ransomware affected Sky Lakes Medical Center in Klamath Falls. Paul Stewart, president and CEO of Sky Lakes, said at the time that the center was refusing to pay any extortion and had to cut some elective and outpatient services as systems were down, according to The Associated Press.

–Maxine Bernstein

Email [email protected]; 503-221-8212

Follow on Twitter @maxoregonian

Our journalism needs your support. Please subscribe today at OregonLive.com/subscribe