On September 28, 2021, a law enforcement action coordinated by Europol and INTERPOL led to the arrest of two prolific ransomware operators in Ukraine, known for their extortionate ransom demands (between €5 to €70 million). They had been suspected of committing a string of targeted attacks against very large industrial groups in Europe and North America, beginning in April 2020.
The French National Gendarmerie (Gendarmerie Nationale), the Ukrainian National Police (Національна поліція України) and the United States Federal Bureau of Investigation (FBI) were also involved in the case.
Results of the action day
- 2 arrests and 7 property searches
- Seizure of US$ 375 000 in cash
- Seizure of two luxury vehicles worth €217 000
- Asset freezing of $1.3 million in cryptocurrencies
How they did it
The criminals would deploy malware and steal sensitive data from these companies, before encrypting their files. They would then proceed to offer a decryption key in return for a ransom payment of several millions of euros, threatening to leak the stolen data on the dark web should their demands not be met.
How the law enforcement operation was conducted
Close cooperation between the involved law enforcement authorities, supported by Europol’s Joint Cybercrime Action Taskforce (J-CAT), led to the identification in Ukraine of these two individuals.
Six investigators from the French Gendarmerie, four from the US FBI, a prosecutor from the French Prosecution Office of Paris, two specialists from Europol’s European Cybercrime Centre (EC3) and one INTERPOL officer were deployed to Ukraine to jointly conduct investigative measures with the National Police.
The following law enforcement authorities took part in this investigation:
- France: National Cybercrime Centre of the National Gendarmerie (C3N)
- Ukraine: Cyber Police Department of the National Police of Ukraine
- United States: Atlanta Field Office of the Federal Bureau of Investigation
- Europol: European Cybercrime Centre (EC3)
- INTERPOL : Cyber Fusion Centre
This operation was carried out in the framework of the European Multidisciplinary Platform Against Criminal Threats (EMPACT).
Original Europol news release
Ransomware gang arrested in Ukraine with Europol’s support. News release. October 4, 2021. Europol
Why it matters
Close collaboration was the key to success. Europol supported the investigation from the onset, bringing together all the involved countries to establish a joint strategy. Its cybercrime specialists organised 12 coordination meetings to prepare for the action day, alongside providing analytical, malware, forensic and crypto-tracing support. A virtual command post was set up by Europol to ensure seamless coordination between all the authorities involved.
