From: https://tinyurl.com/3muv2d3v (theregister.com)

===
           Europol shutters ransomware operation with kingpin arrests

A few low-level stragglers remain on the loose, but biggest fish have
been hooked

   Connor Jones
   Tue 28 Nov 2023 // 13:45 UTC

   International law enforcement investigators have made a number of
   high-profile arrests after tracking a major cybercrime group for more than
   four years.

   A joint investigation team (JIT), spearheaded by French authorities,
   formed in 2019 to bring down a ransomware group linked to major attacks
   across the world.

   Announcing the news today, Europol said that five individuals were
   arrested, including the 32-year-old leader of the group and four of its
   "most active accomplices."

   Thirty properties in Ukraine were raided on November 21 across the Kyiv,
   Cherkasy, Rivne, and Vinnytsia regions. A virtual command post was also
   established in Europol's Netherlands headquarters where data taken from
   the property raids was analyzed "immediately."

   Ukrainian National Police raid properties in search for the
   cybercriminals. Image courtesy of Europol.

   Ukrainian National Police raid properties in search of the cybercriminals.
   Image courtesy of Europol

   Europol said today in a press release that the arrests led to the
   "dismantlement" of the group.

   However, a spokesperson told The Register that "there are still a few
   members which are being sought after, but they're of lesser importance."

   The arrests follow 12 that were made in 2021, two years after the JIT was
   first assembled. Members of the same group were arrested in Ukraine and
   Switzerland, and key electronic devices were seized for forensic analysis,
   along with $52,000 in cash and five luxury vehicles.

   The seizure of the electronic devices and their subsequent analysis led to
   the identification of the key members arrested last week.

   Europol said "a number of operational sprints [had] been organized,"
   heavily involving the Norwegian authorities over the past two years to
   analyze the devices.

   Asked why the arrests have come so long after the initial seizure, a
   spokesperson told The Register that it takes time to gather enough
   evidence to prosecute cybercriminals.

   "As always with investigations as well, there's a strategy to try, we
   might have identified these members, but we were continuing to build the
   picture," they said.

   "Whenever you do all the forensic work, you uncover other leads, but open
   up the investigation that feeds into other existing investigations. That's
   why we were only able to do the second round of actions now."

   Also contributing to the two-year delay was the war in Ukraine starting in
   2022, shortly after the seizures were made. Europol believes this didn't
   slow investigations down at all, but the operation had to be reorganized.

  Who's been cuffed?

   The names of those arrested have not been released and the ransomware
   group itself doesn't behave like LockBit, AlphV/BlackCat or Rhysida. The
   cybercriminals were well-resourced and used multiple different strains to
   attack their targets.

   These included LockerGoga, MegaCortex, Hive, and Dharma. Europol said the
   group had attacked more than 250 servers belonging to organizations in 71
   countries, netting the group hundreds of millions of euros in the process.

   The group isn't tracked with a moniker, as many repeat offenders are, but
   it is responsible for major historical attacks, perhaps most notably the
   ransomware incident at Norsk Hydro.

   It was also responsible for the attack on French consultancy Altran, which
   is now known as Capgemini Engineering following a 2019 acquisition.

   The spokesperson said the arrested cybercriminals were not core members of
   any of the organizations behind the ransomware strains they used. However,
   they were on the radar of law enforcement for their involvement in
   numerous other incidents under separate investigations.

   Members all had different roles within the group. Some were responsible
   for the actual intrusion into victims' systems, while others specialized
   in areas such as money laundering - a branch of ransomware operations
   that's also under close examination by global authorities.

   "Those responsible for breaking into networks did so through techniques
   including brute force attacks, SQL injections, and sending phishing emails
   with malicious attachments in order to steal usernames and passwords,"
   Europol said.

   "Once inside the networks, the attackers remained undetected and gained
   additional access using tools including TrickBot malware, Cobalt Strike,
   and PowerShell Empire, in order to compromise as many systems as possible
   before triggering ransomware attacks." (R)
===

-- Sean

... Eyes hurt from excess screen time?  There's a nap for that.
--- MultiMail/Win v0.52
 * Origin: Outpost BBS * Johnson City, TN (618:618/1)