Russian basketball player arrested in France over alleged ransomware ties

A Russian professional basketball player has been arrested in France at the request of the United States, which accused him of being involved in a ransomware group that allegedly targeted hundreds of American companies and federal institutions.

Daniil Kasatkin, 26, was detained in June at Paris’s Charles de Gaulle Airport shortly after arriving in the country with his fiancée, according to local media reports. He is currently being held in extradition custody, with a U.S. warrant reportedly issued against him. Kasatkin previously studied and played basketball in the U.S.

The unnamed ransomware network Kasatkin is suspected of being part of is believed to have targeted nearly 900 entities between 2020 and 2022. Local media, citing court proceedings in Paris, reported that Kasatkin allegedly helped negotiate ransom payments, though the extent of the damage caused by the attacks has not been disclosed.

The U.S. Department of Justice has not made any official statements about Kasatkin’s arrest and did not respond to a request for comment at the time of publication.

Kasatkin denies all allegations. His lawyer, Frédéric Bélot, told reporters that the athlete is “stunned” by the accusations and insisted Kasatkin lacks any technical expertise. “He bought a second-hand computer. He did absolutely nothing,” Bélot said. “He’s useless with computers and can’t even install an application.”

Bélot had proposed judicial supervision and bail, arguing that Kasatkin’s physical condition was deteriorating in custody and jeopardizing his career. “He has no chair in his cell, no access to a room or a sports field,” Bélot said. Kasatkin, who said he does not feel safe in prison because of Russia’s conflict with Ukraine, claimed to have lost six kilograms while in detention. According to local reports, a Paris court has rejected a bail request.

Kasatkin previously played for Moscow’s MBA basketball club in the VTB United League. The club, which announced his departure on July 3, said it was “shocked” by the arrest and described him as a “responsible, professional young athlete.” Kasatkin played 172 matches over four seasons with MBA and won two Russian Cup bronze medals.

The Russian Foreign Ministry said its embassy in Paris is providing assistance but has not yet been granted consular access to Kasatkin. “Our diplomats have requested permission from the local authorities to visit him, but we have not received a response yet,” ministry spokesperson Maria Zakharova told local media.

According to a Russian Telegram channel focused on sports news, U.S. authorities had been tracking Kasatkin since early 2025, and the arrest warrant was issued just one day before his arrival in France. Kasatkin has been allowed to contact his fiancée, Anna, who is currently in Paris and working with lawyers on his case. The couple had reportedly been planning to marry this year.

CybercrimeNewsNews Briefs
Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Daryna Antoniuk

is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.

 

Total
0
Shares
Previous Post

Qantas says 5.7 million affected by breach, leaked info not enough to access frequent flyer accounts

Next Post

Fake Gaming and AI Firms Push Malware on Cryptocurrency Users via Telegram and Discord

Related Posts

Hackers Breach Toptal GitHub, Publish 10 Malicious npm Packages With 5,000 Downloads

In what's the latest instance of a software supply chain attack, unknown threat actors managed to compromise Toptal's GitHub organization account and leveraged that access to publish 10 malicious packages to the npm registry. The packages contained code to exfiltrate GitHub authentication tokens and destroy victim systems, Socket said in a report published last week. In addition, 73 repositories
Read More

Storm-0501 Exploits Entra ID to Exfiltrate and Delete Azure Data in Hybrid Cloud Attacks

The financially motivated threat actor known as Storm-0501 has been observed refining its tactics to conduct data exfiltration and extortion attacks targeting cloud environments. "Unlike traditional on-premises ransomware, where the threat actor typically deploys malware to encrypt critical files across endpoints within the compromised network and then negotiates for a decryption key,
Read More

Scattered Spider Resurfaces With Financial Sector Attacks Despite Retirement Claims

Cybersecurity researchers have tied a fresh round of cyber attacks targeting financial services to the notorious cybercrime group known as Scattered Spider, casting doubt on their claims of going "dark." Threat intelligence firm ReliaQuest said it has observed indications that the threat actor has shifted their focus to the financial sector. This is supported by an increase in lookalike domains
Read More