Hackers Behind High-Profile Ransomware Attacks on 71 Countries Arrested

Hackers launched ransomware attacks to extort money from the following two entities by encrypting their data and demanding a ransom payment for its release:-

  • Individuals
  • Organizations

Here, cryptocurrency payments’ financial motivation and relative anonymity make them an attractive method for hackers.

Recently, with the help of international collaboration, law enforcement agencies successfully arrested the hackers behind high-profile ransomware attacks on 71 countries.

Document
Free Webinar

Live API Attack Simulation Webinar

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked. The session will cover: an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Hackers Arrested

Amid Russia’s military aggression, the following law enforcement agencies united to dismantle the Ukraine-based ransomware operations:-

  • Global law enforcement
  • Europol
  • Eurojust
Law enforcement agencies (Source – Europol)

Joint global effort arrests ransomware ringleader in Kyiv, and the Europol-led operation with international investigators from the following countries to assist Ukrainian police:-

  • Norway
  • France
  • Germany
  • The US

The virtual command post of Europol in the Netherlands analyzes seized data, follows up on 2021 arrests, and identifies suspects in the latest Kyiv action.

Roles & TTPs

Here below, we have mentioned all the varied roles:-

  • Network compromise
  • Crypto payment laundering

Here below, we have mentioned all the techniques that the threat actors use:-

Besides this, security analysts managed to discover that threat actors have encrypted more than 250 servers and also observed notable significant losses surpassing hundreds of millions of euros.

Ransomware used

The suspected network behind global ransomware attacks targeted large corporations in 71 countries using the following ransomware:-

  • LockerGoga
  • MegaCortex
  • HIVE
  • Dharma

A joint investigation team formed by France, Norway, the UK, and Ukraine, backed by Eurojust. Europol’s EC3 facilitates cybercrime action; forensic analysis aids decryption tools for LockerGoga and MegaCortex ransomware.

Participating Agencies

Here below, we have mentioned all the law enforcement agencies that have participated:- 

  • Norway: National Criminal Investigation Service
  • France: Public Prosecutor’s Office of Paris, National Police
  • Netherlands: National Police, National Public Prosecution Service
  • Ukraine: Prosecutor General’s Office, National Police of Ukraine
  • Germany: Public Prosecutor’s Office of Stuttgart, Police Headquarters Reutlingen CID Esslingen
  • Switzerland: Swiss Federal Office of Police, Polizei Basel-Landschaft, Public Prosecutor’s Office of the canton of Zurich, Zurich Cantonal Police
  • United States: United States Secret Service (USSS), Federal Bureau of Investigation (FBI)
  • Europol: European Cybercrime Centre (EC3)
  • Eurojust

Experience how StorageGuard eliminates the security blind spots in your storage systems by trying a 14-day free trial.

Tushar Subhra

Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Recent Posts

Hackers Exploiting DNS Poisoning to Compromise Active Directory Environments

A groundbreaking technique for Kerberos relaying over HTTP, leveraging multicast poisoning, has been recently detailed…

1 hour ago

New Android Malware Exploiting Wedding Invitations to Steal Victims WhatsApp Messages

Since mid-2024, cybersecurity researchers have been monitoring a sophisticated Android malware campaign dubbed "Tria Stealer,"…

1 hour ago

500 Million Proton VPN & Pass Users at Risk Due to Memory Protection Vulnerability

Proton, the globally recognized provider of privacy-focused services such as Proton VPN and Proton Pass,…

2 hours ago

Arcus Media Ransomware Strikes: Files Locked, Backups Erased, and Remote Access Disabled

The cybersecurity landscape faces increasing challenges as Arcus Media ransomware emerges as a highly sophisticated…

2 hours ago

Hackers Impersonate Top Tax Firm with 40,000 Phishing Messages to Steal Credentials

Proofpoint researchers have identified a marked increase in phishing campaigns and malicious domain registrations designed…

2 hours ago

Cybercriminals Exploit Public-Facing IIS, Apache, and SQL Servers to Breach Gov & Telecom Systems

A recent investigation by Unit 42 of Palo Alto Networks has uncovered a sophisticated, state-sponsored…

2 hours ago