Europol on Friday declared the takedown of the infrastructure related with Ragnar Locker ransomware, along with the arrest of a “crucial target” in France.
“In an motion carried out amongst 16 and 20 Oct, searches were being done in Czechia, Spain, and Latvia,” the company reported. “The primary perpetrator, suspected of currently being a developer of the Ragnar group, has been introduced in front of the examining magistrates of the Paris Judicial Court.”
5 other accomplices involved with the ransomware gang are said to have been interviewed in Spain and Latvia, with the servers and the facts leak portal seized in the Netherlands, Germany, and Sweden.
The work is the latest coordinated training involving authorities from Czechia, France, Germany, Italy, Japan, Latvia, the Netherlands, Spain, Sweden, Ukraine, and the U.S. Two suspects involved with the ransomware crew were being earlier arrested from Ukraine in 2021. A yr afterwards, a different member was apprehended in Canada.
Ragnar Locker, which first emerged in December 2019, is acknowledged for a string of attacks focusing on critical infrastructure entities throughout the globe. According to Eurojust, the group has committed assaults from 168 international companies around the globe due to the fact 2020.
“The Ragnar Locker group was acknowledged to hire a double extortion tactic, demanding extortionate payments for decryption equipment as perfectly as for the non-launch of the sensitive details stolen,” Europol explained.
Ukraine’s Cyber Law enforcement stated it carried out raids at one particular of the suspected members’ premises in Kyiv, confiscating laptops, mobile phones and digital media.
The legislation enforcement action coincides with the Ukrainian Cyber Alliance (UCA) infiltrating and shutting down the leak web page run by the Trigona ransomware team and wiping out 10 of the servers, but not just before exfiltrating the details stored in them. There is proof to counsel that the Trigona actors utilized Atlassian Confluence for their actions.
Just as the dismantling of Hive and Ragnar Locker represents ongoing endeavours to deal with the ransomware menace, so are the initiatives carried out by risk actors to evolve and rebrand beneath new names. Hive, for instance, has resurfaced as Hunters Intercontinental.
The progress comes as India’s Central Bureau of Investigation, centered on details shared by Amazon and Microsoft, explained it raided 76 spots across 11 states in a nationwide crackdown aimed at dismantling infrastructure made use of to aid cyber-enabled economical crimes this kind of as tech assistance cons and cryptocurrency fraud.
The training, codenamed Operation Chakra-II, led to the seizure of 32 cell telephones, 48 laptops/difficult disks, pictures of two servers, 33 SIM playing cards, and pen drives, as perfectly as a dump of 15 email accounts.
It also follows the extradition of Sandu Diaconu, a 31-yr-previous Moldovan national, from the U.K. to the U.S. to confront rates related to his job as the administrator of E-Root Marketplace, a internet site that offered accessibility to a lot more than 350,000 compromised computer system qualifications throughout the world for ransomware attacks, unauthorized wire transfers, and tax fraud.
The website, which went operational in January 2015, was taken down in 2020 and Diaconu was arrested in the U.K. in Might 2021 when seeking to flee the state.
“The E-Root Marketplace operated throughout a commonly dispersed network and took measures to cover the identities of its directors, buyers, and sellers,” the U.S. Office of Justice (DoJ) reported this week.
“Potential buyers could search for compromised personal computer credentials on E-Root, these kinds of as RDP and SSH entry, by desired criteria these kinds of as selling price, geographic place, internet support supplier, and working program.”
In a relevant law enforcement motion, Marquis Hooper, a former U.S. Navy IT supervisor, was sentenced to five a long time and five months in jail for illegally acquiring 9,000 U.S. citizens’ individually identifiable details (PII) and advertising it on the dark web for $160,000 in bitcoin.
Identified this short article fascinating? Adhere to us on Twitter and LinkedIn to go through more exclusive material we submit.
Some parts of this article are sourced from:
thehackernews.com
Okta’s Support System Breach Exposes Customer Data to Unidentified Threat Actors