Ukraine Police Arrest Cyber Criminals Behind Clop Ransomware Attacks

Ukrainian law enforcement officials on Wednesday announced the
arrest of the Clop ransomware^[1]
gang, adding it disrupted the infrastructure employed in attacks
targeting victims worldwide since at least 2019.

As part of a joint operation between the National Police of
Ukraine and authorities from the Republic of Korea and the U.S.,
six defendants have been accused of running a double extortion
scheme wherein victims refusing to pay a ransom were threatened
with the leak of sensitive financial, customer, or personal data
stolen from them prior to encrypting the files.

The ransomware attacks amount to $500 million in monetary
damages, the National Police said^[2], noting that “law
enforcement has managed to shut down the infrastructure from which
the virus spreads and block channels for legalizing criminally
acquired cryptocurrencies.”

Law enforcement officers are said to have conducted 21 searches
in the Ukrainian capital and Kyiv region, including the homes of
the defendants and their cars, resulting in the seizure of computer
equipment, cars, and 5 million hryvnias ($184,679).

The alleged perpetrators face up to eight years in prison on
charges of unauthorized interference in the work of computers,
automated systems, computer networks or telecommunications
networks. It’s, however, not clear if the arrested individuals are
affiliates or core developers of the ransomware operation.

Since emerging on the scene in 2019, the Clop threat actor has
been linked to a number of high-profile attacks as that of
Accellion, Qualys, Software AG IT, ExecuPharm, Indiabulls, as well
as a number of universities like Maastricht University, Stanford
University Medical School, University of Maryland, and University
of California.

The development comes as another ransomware group by the name of
Avaddon shuttered operations and handed over the decryption keys
associated with 2,934 victims to Bleeping Computer^[3]
last week, likely in response to heightened scrutiny by law
enforcement and governments worldwide after a spate of attacks^[4]
against critical infrastructure.