- French police detained Daniil Kasatkin at the request of US authorities
- His lawyer says Kasatkin bought a used computer, and he is completely innocent
- Kasatkin was allegedly denied bail
A Russian professional basketball player has been arrested at an airport under suspicion of being a ransomware cybercriminal.
On June 21, 2025, French authorities arrested Daniil Kasatkin at Charles de Gaulle Airport in Paris. Kasatkin is a 26-year-old basketball professional, playing for MBA Moscow in Russian VTB United League.
He graduated from Pennsylvania State University in 2019, and was apparently arrested at the request of US authorities.
Russia demands consular access
Kasatkin’s lawyer, Frederic Belot, told French news agency AFP his client is basically PC-illiterate and that he could not have done any ransomware attacks:
“He bought a used computer. He did absolutely nothing wrong. He’s shocked,” Belot told AFP. “He’s useless with computers. He can’t even install an app. He didn’t touch anything on this computer. It was either hacked, or sold to him by a hacker who wanted to pass himself off as someone else.”
Speaking to Reuters, Belot seemingly acknowledged that the computer was used for cybercrime.
“Kasatkin simply used a second-hand computer he purchased without changing the system username. The account was undoubtedly hacked and was remotely controlled by cybercriminals without Mr. Kasatkin’s knowledge,” Belot said.
Following news of the arrest, Russia’s embassy in Paris demanded consular access to Kasatkin, Reuters also said. “The embassy is dealing with the situation related to the detention of Russian citizen Daniil Kasatkin in France,” the embassy said in a statement.
The embassy also slammed French authorities for being too slow: “This is not an isolated case when we are faced with a delay in the issue of consular access to a Russian citizen.”
The Times of India reports that the French court denied bail for Kasatkin, who is now facing extradition to the United States. The name of the ransomware group he was allegedly part of was not disclosed, but the same publication claims the group struck more than 900 organizations between 2020 and 2022.
Via TechCrunch
