Get all your news in one place.
100’s of premium titles.
One app.
Start reading
TechRadar
TechRadar
Sead Fadilpašić

Ransomware gang dismantled by Europol after string of raids across Ukraine

Ransomware attack on a computer.

An international team of law enforcement agents, spearheaded by Europol, arrested five individuals allegedly involved in multiple ransomware attacks.

As part of the arrests, the police also raided multiple properties and confiscated computers, cars, bank cards, SIM cards, various items of electronic media, and roughly $110,000 in cryptocurrencies.

According to TechCrunch, those arrested were part of a cyber gang performing attacks from within Ukraine, with the groups leader (32) also being arrested during the raids.


Years-long investigation

While neither the group, nor the individuals, were named, the police did state that they used LockerGoga, MegaCortex, Hive, and Dharma ransomware variants, with more than 1,800 people worldwide being affected by the attacks.

The police accuse them of encrypting more than 250 servers belonging to large corporations and extorting “several hundred million euros” from their victims.

There were more than 20 agents involved in the investigation, including those in Norway, France, Germany, the United States, and Ukraine - where the arrests were made.

According to Europol, the arrests were a continuation of a 2021 investigation that resulted in the arrest of 12 individuals in Ukraine and Switzerland with these arrests directly contributing to the discovery of the individuals arrested in Ukraine.

Ransomware is currently one of the most disruptive forms of cybercrime out there. The majority of SMBs and enterprises out there have either experienced a ransomware attack in the last couple of years or are expecting to suffer one in the coming months. 

In the attack, the threat actors would first sneak their way past the company’s defenses (either via a stolen/leaked credential, dropping malware via a zero-day vulnerability in different hardware and software, or similar), map out the endpoints on the network, and scan for cloud services. 

Then, they would exfiltrate sensitive data and deploy a decryptor which would lock the company out of all of its digital assets. Finally, the threat actors would demand payment in cryptocurrency, in exchange for the decryption key and for not leaking the stolen data.

More from TechRadar Pro

Sign up to read this article
Read news from 100’s of titles, curated specifically for you.
Already a member? Sign in here
Related Stories
Top stories on inkl right now
One subscription that gives you access to news from hundreds of sites
Already a member? Sign in here
Our Picks
Fourteen days free
Download the app
One app. One membership.
100+ trusted global sources.