This week, police and judicial authorities from eleven countries dismantled one of the most dangerous ransomware gangs. The action, coordinated internationally by Europol and Eurojust, was directed against the Ragnar Locker ransomware group. The group has been responsible for several high-profile attacks on critical infrastructure around the world.
As part of an operation between 16 and 20 October, searches were carried out in the Czech Republic, Spain and Latvia. The ransomware group's “main target” was arrested in Paris, France, on October 16, and his home in the Czech Republic was searched. In the following days, five suspects were interrogated in Spain and Latvia. At the end of the week of action, the main perpetrator, suspected of being a promoter of the Ragnar group, was presented to the investigating judges of the Paris regional court.
Ransomware infrastructure has also been seized in countries including the Netherlands, Germany and Sweden. The website for publishing data associated with the group was closed in Sweden. However, dismantling the infrastructure may not be enough to put an end to the group's activities.
Ragnar Locker has been active since December 2019 and targets devices running the Windows operating system. The group employs a two-pronged extortion strategy, demanding payment for decryption tools and threatening to make stolen sensitive data public.
While this is a significant victory for law enforcement agencies, the group may be able to quickly set up other servers to replace the ones that were seized. Additionally, organizations affected by a ransomware attack may now have lost a method for negotiating with the group.
This operation highlights the importance of international cooperation in combating cybercrime. Still, the future of this ransomware group remains uncertain. What is clear is that the fight against cybercrime is an ongoing battle that requires coordinated efforts at a global level.
