Ransomware Hackers Arrested in Ukraine for Cyber Attack on Over 100 Companies

The latest development in the fight against ransomware incidents is the announcement by law enforcement agencies of the arrest of two “prolific ransomware hackers” in Ukraine who are accused of carrying out a string of deliberate cyber attack against major industrial targets in Europe and North America since at least April 2020.

Table of Contents

Officials from the French National Gendarmerie, the Ukrainian National Police, and the U.S. Federal Bureau of Investigation (FBI) participated in the joint drill on September 28 along with representatives from the European Cybercrime Centre of Europol and the Cyber Fusion Centre of INTERPOL.

How was the Attack Executed?

The suspects allegedly carried out the attacks through phishing emails that contained ransomware, and then encrypted victims’ data. Police said three suspects received ransom payments in cryptocurrency, which is common in such extortion attacks, in exchange for restoring victims’ data access.

Before encrypting their files, the hackers would use malware to infect these businesses and steal confidential data, according to a press release from Europol on Monday. “They would then go on to demand a ransom payment of several million euros in exchange for a decryption key, threatening to leak the stolen data on the dark web if their demands were not met.”

In addition to the two arrests, the international police investigation saw a total of seven property raids, which resulted in the confiscation of $375,000 in cash, two expensive cars worth €217,000 ($251,543) each, and $1.3 million worth of cryptocurrency assets.

Arrested Suspects Linked to Ransomware Hackers Gang, Clop

According to the Ukrainian National Police, the suspects are linked to a gang that has staged ransomware attacks against more than 100 different companies, resulting in damages of up to $150 million, and are believed to have demanded large sums ranging anywhere between €5 and €70 million as part of their extortion spree. The syndicate’s name has not been made public.

A 25-year-old Ukrainian national who was one of the two people detained is accused of installing “virus software” by hacking into remote working programs. The hacks were staged through social engineering campaigns that sent spam emails with malicious content to corporate email inboxes, the agency added.

The development comes over three months after the Ukrainian authorities took steps to arrest members of the Clop ransomware gang and disrupt the infrastructure the group employed in attacks targeting victims worldwide dating all the way back to 2019.