NEWS  Security  November 28, 2023  Reading time: 2 Minute(s)

Max (RS editor)

In a meticulously coordinated law enforcement initiative, key figures allegedly spearheading various ransomware operations have been apprehended in Ukraine. Europol, in an official statement today, disclosed that a total of 30 locations in Kyiv, Cherkasy, Rivne, and Vinnytsia were subjected to searches on November 21, leading to the arrest of the 32-year-old mastermind at the helm. Additionally, four of the principal collaborators working closely with the ringleader were also taken into custody.

This significant breakthrough transpires more than two years after a dozen individuals were detained in connection with the same criminal enterprise. The accused have been predominantly associated with the notorious LockerGoga, MegaCortex, and Dharma ransomware families, with their criminal activities spanning over 1,800 victims across 71 countries since 2019. Notably, they stand accused of deploying the now-defunct Hive ransomware against prominent organizations.

The modus operandi employed by the cybercriminals involved several tactics, including brute-force attacks, SQL injections, and the dissemination of phishing emails containing malicious attachments to pilfer usernames and passwords. Once infiltrating IT networks, the perpetrators navigated stealthily, deploying additional malware and post-exploitation tools like TrickBot, Cobalt Strike, and PowerShell Empire, ultimately delivering the file-encrypting malware.

 UKRAINE CYBER POLICE 

Certain co-conspirators within the cybercrime network are suspected to have overseen the laundering of cryptocurrency payments, which victims made in desperation to decrypt their files. Europol revealed that the investigation determined the encryption of over 250 servers belonging to major corporations, resulting in staggering losses exceeding several hundreds of millions of euros.

This collaborative effort saw the participation of authorities from France, Germany, the Netherlands, Norway, Switzerland, Ukraine, and the United States. This revelation follows closely on the heels of Europol's recent announcement of the dismantling of a prolific voice phishing gang, orchestrated by Czech and Ukrainian police, believed to have illicitly gained millions by duping victims into transferring funds from their 'compromised' bank accounts to 'safe' accounts under the criminals' control.

Furthermore, this development comes merely a month after Europol unveiled the joint efforts of law enforcement and judicial authorities from eleven countries in dismantling the infrastructure associated with the Ragnar Locker ransomware, culminating in the arrest of a "key target" in France. The collective actions against these cybercriminal networks underscore the ongoing commitment of international law enforcement agencies to curb the rising tide of digital threats.

 IMAGES BY EUROPOL / UKRAINE CYBER POLICE