Law enforcement agencies from Ukraine and Germany have dismantled operations of a Russian-affiliated hacker group responsible for hundreds of millions of euros in losses across Western organizations.
The investigation, conducted jointly by Ukrainian cyber police and German federal authorities, has resulted in the arrest of two operatives and placement of the alleged group organizer on Interpol’s international wanted list.
Investigation Uncovers Multi-National Cybercriminal Operation
The National Police of Ukraine’s Cyber Department, working with Germany’s Federal Criminal Police Office (BKA), identified two suspects operating within Ukraine who performed specialized functions within the ransomware consortium.
Cyber investigators and the Main Investigation Department, under the Prosecutor General’s Office’s Cyber Department, collaborated to halt the group’s activities.
The suspects operated as “hash crackers,” specialized cybercriminals who extract user credentials from protected systems using advanced software tools.
Their role within the broader attack chain was crucial: once password credentials were obtained, group members would gain unauthorized access to corporate networks and escalate compromised account privileges across interconnected systems.
Attack Methodology and Scope
The operational pattern followed a systematic approach to corporate exploitation. After obtaining employee authentication credentials, attackers penetrated the internal company infrastructure and expanded account permissions to gain deeper network access.
This privileged position enabled the group to compromise critical systems, exfiltrate confidential business data, and deploy ransomware that encrypted company files, rendering them inaccessible until victims paid ransom demands.
Between 2022 and 2025, this group targeted hundreds of organizations globally, with a primary focus on economically developed Western nations.
Foreign law enforcement agencies have classified the group among the most sophisticated and dangerous cybercriminal organizations active in recent years.
During authorized searches conducted in the Ivano-Frankivsk and Lviv regions, police recovered digital media and cryptocurrency assets that served as evidence of ongoing criminal operations.
The digital materials captured the technical infrastructure and financial proceeds from their ransomware attacks.
A Russian national identified as the group’s organizer and creator has been placed on Interpol’s international wanted list through coordinated efforts by Germany’s Federal Criminal Police Office and Frankfurt’s Central Service for Internet Crime.
Intelligence suggests the alleged organizer may also have connections to Conti, another notorious ransomware operation that plagued global organizations.
This investigation represents significant international cooperation involving law enforcement agencies from Ukraine, Germany, Switzerland, the Netherlands, and the United Kingdom.
The coordinated effort demonstrates the growing capacity of international bodies to investigate complex transnational cybercrime networks.
Prior investigative actions conducted in Kharkiv and surrounding regions targeted additional members of this group operating within Ukrainian territory.
The case underscores the persistent threat posed by organized ransomware operations and the critical importance of international collaboration in combating sophisticated cybercriminal infrastructure.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
%20(1).webp?fit=1600,900&ssl=1&description=The investigation, conducted jointly by Ukrainian cyber police and German federal authorities, has resulted in the arrest of two operatives){kind=link}