Cyber Crime

Two ransomware operators were arrested in Kyiv with EUROPOL’s support

Two ransomware operators arrested in Kyiv, Ukraine, that are suspected to have attacked more than 100 companies causing more than $150M in damages.

A joint international law enforcement operation led to the arrest of the ransomware operators in Kyiv, Ukraine on September 28.

The operation was conducted by the Ukrainian National Police, with the support of Europol, the FBI, Interpol, and French Gendarmerie.

“On 28 September, a coordinated strike between the French National Gendarmerie (Gendarmerie Nationale), the Ukrainian National Police (Національна поліція України) and the United States Federal Bureau of Investigation (FBI), with the coordination of Europol and INTERPOL, has led to the arrest in Ukraine of two prolific ransomware operators known for their extortionate ransom demands (between €5 to €70 million).” reads the press release published by the Europol.

The police made 7 property searches and seized US$ 375 000 in cash, two luxury vehicles worth €217 000. The authorities also froze $1.3 million in cryptocurrencies.

According to the Ukraine police, one of the two individuals is a 25-year-old man that is suspected to be a prominent member of the cybercrime gang.

At the time of this writing, the law enforcement agencies did not reveal the name of the ransomware gang.

According to Ukraine officials, the two crooks were responsible for attacks on more than 100 companies across the world and have caused more than $150 million in damages.

“According to police, the man had an accomplice who helped to withdraw money obtained by criminal means.” reads the press release published by the Ukrainian police. “With the involvement of a special unit of the TOR of the patrol police, searches were conducted at the place of residence of the defendant and in the homes of his relatives. As a result, computer equipment, mobile phones, vehicles and more than 360 thousand dollars in cash were seized. In addition, $ 1.3 million was blocked on the attacker’s cryptocurrencies.”

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″][adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, ransomware operators)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

Recent Posts

Fintech firm Figure disclosed data breach after employee phishing attack

Fintech firm Figure confirmed a data breach after hackers used social engineering to trick an…

20 hours ago

U.S. CISA adds a flaw in BeyondTrust RS and PRA to its Known Exploited Vulnerabilities catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a flaw in BeyondTrust RS and…

21 hours ago

Suspected Russian hackers deploy CANFAIL malware against Ukraine

A new alleged Russia-linked APT group targeted Ukrainian defense, government, and energy groups, with CANFAIL…

1 day ago

New threat actor UAT-9921 deploys VoidLink against enterprise sectors

A new threat actor, UAT-9921, uses the modular VoidLink framework to target technology and financial…

2 days ago

Attackers exploit BeyondTrust CVE-2026-1731 within hours of PoC release

Attackers quickly targeted BeyondTrust flaw CVE-2026-1731 after a PoC was released, enabling unauthenticated remote code…

2 days ago

Google: state-backed hackers exploit Gemini AI for cyber recon and attacks

Google says nation-state actors used Gemini AI for reconnaissance and attack support in cyber operations.…

2 days ago

This website uses cookies.