Ransomware Attacks: Seven Hackers Arrested in Rare Global Rush

Published on : 11/09/2021 – 02:24

A rare crackdown in the world of ransomware has arrested seven hackers, including a 22-year-old Ukrainian implicated in the giant cyberattack against the Kaseya company in July, US and European authorities announced Monday (November 8th).

The operation – dubbed “Golddust” or “Quicksand” – involved 17 countries and targeted the Russian-speaking hacker group REvil, sometimes referred to as Sodinokibi, and the GandCrab ransomware group, Europol said in a statement.

Those arrested are suspected of having carried out “around 7,000 infections” around the world with software encrypting the data of their targets, and of having “demanded more than 200 million euros in ransoms” in exchange for the key decryption, added the European police agency.

Robotnik arrested

The main take of the operation is called Yaroslav Vasinsky, alias Robotnik. This Ukrainian is accused of having attacked the American computer company Kaseya on July 2, affecting a thousand of its customers, including the supermarket chain Coop in Sweden whose stores remained closed for several days.

The young man was arrested on October 8 in Poland at the request of the United States. “We have asked for him to be extradited under the treaty between our two countries,” US Justice Minister Merrick Garland said at a press conference.

Two other hackers, suspected of having claimed 5,000 victims and pocketing half a million euros in ransoms, were arrested in Romania on Thursday. Another was arrested in Kuwait and three in South Korea, according to Interpol.

The American justice also announced the seizure of 6.1 million dollars in cryptocurrency, corresponding to sums extorted by another member of the REvil group – the Russian Yevgeny Polianine, 28 years old – during 3,000 attacks carried out in the United States. , especially in August 2019 in Texas, said the minister. Indicted in the United States, he is probably in Russia, possibly in Barnaul in Siberia, according to a wanted notice published by the American federal police.

“Threat too great”

At the same time, and for the second time only, the American authorities announced sanctions against a cryptocurrency exchange called Chatex, suspected of having been used in ransomware attacks.

In addition, the State Department has offered rewards of up to $ 10 million for any information that would locate or identify the leaders of the REvil group.

Democratic President Joe Biden “praised” these efforts, assuring in a statement to have made cybersecurity one of his “priorities”. He recalled having discussed it in June in Geneva with Russian President Vladimir Putin, whose country is accused of offering a haven to hackers: “I had clearly said that the United States would act to hold these cybercriminals accountable, that’s what we did today. “

Interpol Secretary General Jürgen Stock, for his part, underlined the importance of international cooperation. “Ransomware has become too big a threat for any entity or sector to tackle on its own,” he said in a statement.

Ransomware attacks are an increasingly lucrative form of digital hostage-taking and their impact, estimated at billions of dollars by Interpol, continues to grow.

With AFP