Law enforcement agencies have announced the arrest of two
“prolific ransomware operators” in Ukraine who allegedly conducted
a string of targeted attacks against large industrial entities in
Europe and North America since at least April 2020, marking the
latest step in combating ransomware incidents.
The joint exercise was undertaken on September 28 by officials
from the French National Gendarmerie, the Ukrainian National
Police, and the U.S. Federal Bureau of Investigation (FBI),
alongside participation from the Europol’s European Cybercrime
Centre and the INTERPOL’s Cyber Fusion Centre.
“The criminals would deploy malware and steal sensitive data
from these companies, before encrypting their files,” Europol
said[1]
in a press statement on Monday. “They would then proceed to offer a
decryption key in return for a ransom payment of several millions
of euros, threatening to leak the stolen data on the dark web
should their demands not be met.”
Besides the two arrests, the international police operation
witnessed a total of seven property raids, leading to the seizure
of $375,000 in cash and two luxury vehicles costing €217,000
($251,543), as well as the freezing of cryptocurrency assets worth
$1.3 million.
The suspects are believed to have demanded hefty sums ranging
anywhere between €5 to €70 million as part of their extortion
spree, and are connected to a gang that’s staged ransomware attacks
against more than 100 different companies, causing damages upwards
of $150 million, according to the Ukrainian National Police. The
identity[2]
of the syndicate has not been disclosed.
One of the two arrestees, a 25-year-old Ukrainian national,
allegedly deployed “virus software” by breaking into remote working
programs, with the intrusions staged through social engineering
campaigns that delivered spam messages containing malicious content
to corporate email inboxes, the agency added[3].
The development comes over three months after the Ukrainian
authorities took steps to arrest members of the Clop ransomware
gang[4] and disrupt the
infrastructure the group employed in attacks targeting victims
worldwide dating all the way back to 2019.