81 months out of a possible 53 years is a slap on the wrist that signals DOJ is still trading lenient sentencing for upstream intelligence on RaaS operators — Volkov's Yanluowang access brokering touched $24M in BTC ransom demands across seven targets, but the real play here is flipping IABs to map the affiliate network. This fits a clear 2026 pattern: DOJ is systematically prosecuting the initial access broker layer (see the Albashiti case hitting 50 corporate networks, ex-BlackCat incident responders turning affiliate), treating IABs as the weakest link in ransomware-as-a-service supply chains rather than going after operators directly. The Rome arrest and extradition pipeline also shows that the "hack from Russia, stay untouchable" model is eroding fast — if you're an IAB listing corporate VPN access on Exploit or XSS forums and transacting in BTC without serious OPSEC, the attack surface on you is now the biggest vulnerability in the chain.