Ukrainian police have arrested a 28-year-old Russian hacker in Kiev on charges of working with ransomware operations Conti and LockBit . The man is said to have helped the hacking gangs make their malware undetectable by antivirus software . He is also said to have carried out at least one attack himself.
The man was arrested on April 18, 2024, as part of "Operation Endgame", which destroyed several botnets and their main operators.
As the Conti ransomware group had used some of these botnets for initial access to compromised systems, authorities found evidence that led them to the Russian hacker.
See also: LockBit ransomware: FBI recovered over 7,000 decryption keys
According to Ukrainian police, the arrested person was an expert in developing custom crypters for packing ransomware payloads into secure files, making them FUD (completely undetectable).
Police found that the man was selling his encryption services to both the Conti gang and LockBit, helping to significantly increase their chances of successful breaches.
Dutch police also confirmed at least one ransomware attack that the arrested individual himself organized in 2021, using the Conti payload. Therefore, he also acted as a collaborator for maximum profit.
See also: London Drugs: LockBit ransomware gang threatens to leak data
Authorities conducted searches, which led to the seizure of computers, cell phones, and handwritten notes for further examination.
The investigation into the developer's activities and his exact involvement in the Conti and LockBit ransomware attacks is ongoing.
The suspect faces up to 15 years in prison.
The arrest of the Russian hacker highlights the growing cooperation between international authorities to combat cybercrime. The international cybersecurity community can see this development as an important step towards strengthening cooperation and coordination between countries to address cyber threats.
See also: Phorpiex botnet sent millions of emails distributing LockBit Black ransomware
Additionally, the hacker's arrest could lead to revelations about the inner workings and strategies of ransomware groups like Conti and LockBit, which could help authorities and cybersecurity develop more effective defenses and improve their practices to prevent future attacks.
☁️ Keep safe copies with Proton Drive
Encrypted cloud storage from Proton — protect your files from ransomware, corruption, and data loss with end-to-end encryption.
- ✔ End-to-end encrypted files & backups
- ✔ Version history — recover files after ransomware
- ✔ Free space — sync across all devices
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Finally, this operation by the authorities may act as a deterrent to other cybercriminals, as it shows that authorities are capable of identifying and arresting individuals involved in illegal cyber activities, regardless of their geographical location. This may reduce the number of ransomware attacks and strengthen cybersecurity worldwide.
Source: www.bleepingcomputer.com
