www.europol.europa.eu Open in urlscan Pro
2a01:4f8:200:9127::11  Public Scan

Form analysis
3 forms found in the DOM

POST /newsroom/news/12-targeted-for-involvement-in-ransomware-attacks-against-critical-infrastructure

<form class="europol-language-switcher-form jsLanguageSwitcher-processed" action="/newsroom/news/12-targeted-for-involvement-in-ransomware-attacks-against-critical-infrastructure" method="post" id="europol-language-switcher-form--2"
  accept-charset="UTF-8">
  <div>
    <div class="form-item form-type-select form-item-language-select">
      <label for="edit-language-select--2">Europol in your language </label>
      <select class="europol-language-switcher-select form-select chosen-disable" id="edit-language-select--2" name="language_select">
        <option value="about-europol" selected="selected">en</option>
        <option value="bg/about-europol">bg</option>
        <option value="es/about-europol">es</option>
        <option value="cs/about-europol">cs</option>
        <option value="da/about-europol">da</option>
        <option value="de/about-europol">de</option>
        <option value="et/about-europol">et</option>
        <option value="el/about-europol">el</option>
        <option value="fr/about-europol">fr</option>
        <option value="ga/about-europol">ga</option>
        <option value="it/about-europol">it</option>
        <option value="lv/about-europol">lv</option>
        <option value="lt/about-europol">lt</option>
        <option value="hu/about-europol">hu</option>
        <option value="mt/about-europol">mt</option>
        <option value="nl/about-europol">nl</option>
        <option value="pl/about-europol">pl</option>
        <option value="pt/about-europol">pt</option>
        <option value="ro/about-europol">ro</option>
        <option value="sk/about-europol">sk</option>
        <option value="sl/about-europol">sl</option>
        <option value="fi/about-europol">fi</option>
        <option value="sv/about-europol">sv</option>
        <option value="hr/about-europol">hr</option>
      </select>
    </div>
    <button id="edit-submit--3" name="op" value="Go" type="submit" class="form-submit" style="display: none;">Go</button>
    <input type="hidden" name="form_build_id" value="form-83FXzdWTtAz_tUld8uLutQG7icwh_5LFqx-eM-cR-E8">
    <input type="hidden" name="form_id" value="europol_language_switcher_form">
  </div>
</form>

GET /search

<form action="/search" method="get" id="search-block-form" accept-charset="UTF-8">
  <div>
    <div class="container-inline">
      <h2 class="element-invisible">Search form</h2>
      <div class="row collapse">
        <div class="small-8 columns">
          <div class="form-item form-type-textfield form-item-t">
            <label class="element-invisible" for="edit-t">Search </label>
            <input title="Enter the terms you wish to search for." placeholder="Search the Europol website here" type="text" id="edit-t" name="t" value="" size="15" maxlength="128" class="form-text">
          </div>
        </div>
        <div class="small-4 columns"><button class="secondary button radius postfix expand form-submit" id="edit-submit" name="op" value="Search" type="submit">Search</button>
        </div>
      </div>
    </div>
  </div>
</form>

POST /newsroom/news/12-targeted-for-involvement-in-ransomware-attacks-against-critical-infrastructure

<form class="europol-language-switcher-form jsLanguageSwitcher-processed" action="/newsroom/news/12-targeted-for-involvement-in-ransomware-attacks-against-critical-infrastructure" method="post" id="europol-language-switcher-form"
  accept-charset="UTF-8">
  <div>
    <div class="form-item form-type-select form-item-language-select">
      <label for="edit-language-select">Europol in your language </label>
      <select class="europol-language-switcher-select form-select chosen-disable" id="edit-language-select" name="language_select">
        <option value="about-europol" selected="selected">en</option>
        <option value="bg/about-europol">bg</option>
        <option value="es/about-europol">es</option>
        <option value="cs/about-europol">cs</option>
        <option value="da/about-europol">da</option>
        <option value="de/about-europol">de</option>
        <option value="et/about-europol">et</option>
        <option value="el/about-europol">el</option>
        <option value="fr/about-europol">fr</option>
        <option value="ga/about-europol">ga</option>
        <option value="it/about-europol">it</option>
        <option value="lv/about-europol">lv</option>
        <option value="lt/about-europol">lt</option>
        <option value="hu/about-europol">hu</option>
        <option value="mt/about-europol">mt</option>
        <option value="nl/about-europol">nl</option>
        <option value="pl/about-europol">pl</option>
        <option value="pt/about-europol">pt</option>
        <option value="ro/about-europol">ro</option>
        <option value="sk/about-europol">sk</option>
        <option value="sl/about-europol">sl</option>
        <option value="fi/about-europol">fi</option>
        <option value="sv/about-europol">sv</option>
        <option value="hr/about-europol">hr</option>
      </select>
    </div>
    <button id="edit-submit--2" name="op" value="Go" type="submit" class="form-submit" style="display: none;">Go</button>
    <input type="hidden" name="form_build_id" value="form-YO3jZXJUYCvDtmwGu--7Z1alnzis_yjLFgkf0UwJGNs">
    <input type="hidden" name="form_id" value="europol_language_switcher_form">
  </div>
</form>

Text Content

Skip to main content


 * EUROPOL

 * Menu
 * Search

 * About Europol
   
   * BACK
   
   * About Europol
   * Governance & Accountability
   * Data Protection & Transparency
   * Our Thinking
   * Finance & Budget
   * Statistics & Data
   * European Cybercrime Centre - EC3
   * European Migrant Smuggling Centre - EMSC
   * European Counter Terrorism Centre - ECTC
     
     * BACK
     
     * European Counter Terrorism Centre - ECTC
     * ECTC Advisory Network on terrorism and propaganda conference
   * European Financial and Economic Crime Centre - EFECC
     
     * BACK
     
     * European Financial and Economic Crime Centre - EFECC
     * Intellectual Property Crime Coordinated Coalition - IPC3
   * Financial Intelligence Units - FIU.net
     
     * BACK
     
     * Financial Intelligence Units - FIU.net
     * EU FIUs Points of Contact
   * EU Internet Referal Unit (EU IRU)
   * Europol History
 * Activities & Services
   
   * BACK
   
   * Activities & Services
   * Services & Support
     
     * BACK
     
     * Services & Support
     * Operational coordination & support
       
       * BACK
       
       * Operational coordination & support
       * Operational Centre
     * Information Exchange
       
       * BACK
       
       * Information Exchange
       * Secure Information Exchange Network Application (SIENA)
       * Europol Information System (EIS)
       * Europol Platform for Experts (EPE)
     * Strategic Analysis
     * Intelligence Analysis
       
       * BACK
       
       * Intelligence Analysis
       * Cyber Intelligence
     * Forensics
     * Training and Capacity Building
     * Joint Cybercrime Action Taskforce (J-CAT)
   * Europol in Action
     
     * BACK
     
     * Europol in Action
     * Operations
     * Europol’s 20 most noteworthy operations
   * Main Reports
     
     * BACK
     
     * Main Reports
     * EU Terrorism Situation & Trend Report (Te-Sat)
     * Serious and Organised Crime Threat Assessment (SOCTA)
     * Internet Organised Crime Threat Assessment (IOCTA)
     * Europol in Brief (Annual Review)
   * Public Awareness and Prevention Guides
   * Intelligence Notifications - Early Warning Notifications
   * Joint Investigation Teams - JITs
   * Stop Child Abuse – Trace an Object
   * Innovation Lab
   * Europol Excellence Award in Innovation award
   * SIRIUS project
   * Eastern Partnership project (EaP)
   * Europol Photo Competition
     
     * BACK
     
     * Europol Photo Competition
     * Photo competition winners
   * Justice and Home Affairs (JHA) agencies‘ network
   * COVID-19
   * Grants
     
     * BACK
     
     * Grants
     * Principles for Europol Participation to Grant projects
     * Requests for Europol participation in grants awarded by other entities
 * Crime Areas & Trends
   
   * BACK
   
   * Crime Areas & Trends
   * Crime Areas
     
     * BACK
     
     * Crime Areas
     * Trafficking in Human Beings
     * Facilitation of Illegal Immigration
     * Terrorism
     * Drug Trafficking
       
       * BACK
       
       * Drug Trafficking
       * Synthetic Drugs
       * Cannabis
       * Cocaine and heroin
       * Other Drugs
     * Cybercrime
       
       * BACK
       
       * Cybercrime
       * High-Tech crime
       * Social engineering
     * Child Sexual Exploitation
       
       * BACK
       
       * Child Sexual Exploitation
       * Online sexual coercion and extortion of children
     * Forgery of money and means of payment
       
       * BACK
       
       * Forgery of money and means of payment
       * Payment Fraud
       * Euro Counterfeiting
       * Money Muling
     * Economic Crime
       
       * BACK
       
       * Economic Crime
       * MTIC (Missing Trader Intra Community) fraud
       * Excise fraud
       * Money Laundering
     * Illicit firearms trafficking
     * Environmental Crime
       
       * BACK
       
       * Environmental Crime
       * Illicit trafficking in endangered animal species
       * Illicit trafficking in endangered plant species and varieties
     * Organised property crime
     * Forgery of Administrative Documents and Trafficking therein
     * Intellectual property crime
       
       * BACK
       
       * Intellectual property crime
       * Counterfeiting and Product Piracy
     * Corruption
       
       * BACK
       
       * Corruption
       * Sports Corruption
     * Maritime Piracy
     * Trafficking in Stolen Vehicles
     * Illicit Tobacco Trade
     * Outlaw Motorcycle Gangs
     * Mobile Organised Crime Groups
     * Mafia-Structured Organised Crime Groups (OCG)
     * Illicit Trafficking in Cultural Goods, Including Antiquities and Works of
       Art
     * Illicit Trafficking in Hormonal Substances and Other Growth Promoters
     * Crime Connected with Nuclear and Radioactive Substances
     * Illicit Trade in Human Organs and Tissue
     * Kidnapping, Illegal Restraint and Hostage Taking
     * Genocide, crimes against humanity and war crimes
     * Racism and Xenophobia
   * EU Policy Cycle - EMPACT
   * Trends and Routes
   * Europol Analysis Projects
 * Partners & Agreements
   
   * BACK
   
   * Partners & Agreements
   * Member States
     
     * BACK
     
     * Member States
     * Austria
     * Belgium
     * Bulgaria
     * Croatia
     * Cyprus
     * Czech Republic
     * Denmark
     * Estonia
     * Finland
     * France
     * Germany
     * Greece
     * Hungary
     * Ireland
     * Italy
     * Latvia
     * Lithuania
     * Luxembourg
     * Malta
     * Netherlands
     * Poland
     * Portugal
     * Romania
     * Slovakia
     * Slovenia
     * Spain
     * Sweden
   * Operational Agreements
   * Strategic Agreements
   * Working Arrangements
   * EU Most Wanted
   * No More Ransom
   * Police2Peer
 * Careers & Procurement
   
   * BACK
   
   * Careers & Procurement
   * Open Vacancies
     
     * BACK
     
     * Open Vacancies
     * Vacancies status
     * Reserve List
     * Candidate Home page - Login
   * How to apply
     
     * BACK
     
     * How to apply
     * Seconded National Expert posts
     * Europol National Units of the European Member States
   * Why Europol?
     
     * BACK
     
     * Why Europol?
     * What we offer
       
       * BACK
       
       * What we offer
       * Salaries
     * Living in The Hague
     * Childcare and Education in the Netherlands
     * Meet our people
   * Internships
     
     * BACK
     
     * Internships
     * Information about internships
     * Meet our interns!
   * Work with us - Procurement
     
     * BACK
     
     * Work with us - Procurement
     * Ongoing Procurement Procedures
     * Closed Procurement Procedures
     * Remedies and how to complain
 * Newsroom
   
   * BACK
   
   * Newsroom
   * Image gallery
   * Creative production support
   * Contact our media team
 * Publications & Documents
   
   * BACK
   
   * Publications & Documents
   * Public Access to Europol documents
   * Request access to Europol documents
   * Public Register of Documents

Europol in your language enbgescsdadeetelfrgaitlvlthumtnlplptroskslfisvhr
Go
Search


SEARCH FORM

Search
Search
 * Facebook
 * Twitter
 * Youtube
 * LinkedIn
 * Instagram
 * RSS

Europol in your language enbgescsdadeetelfrgaitlvlthumtnlplptroskslfisvhr
Go
 * Events
 * FAQ
 * Contact us
 * Report a Crime
 * Sitemap


Europol
 * About Europol
    * Governance & Accountability
    * Data Protection & Transparency
    * Our Thinking
    * Finance & Budget
    * Statistics & Data
    * European Cybercrime Centre - EC3
    * European Migrant Smuggling Centre - EMSC
    * European Counter Terrorism Centre - ECTC
       * ECTC Advisory Network on terrorism and propaganda conference
   
    * European Financial and Economic Crime Centre - EFECC
       * Intellectual Property Crime Coordinated Coalition - IPC3
   
    * Financial Intelligence Units - FIU.net
       * EU FIUs Points of Contact
   
    * EU Internet Referal Unit (EU IRU)
    * Europol History

 * Activities & Services
    * Services & Support
       * Operational coordination & support
          * Operational Centre
      
       * Information Exchange
          * Secure Information Exchange Network Application (SIENA)
          * Europol Information System (EIS)
          * Europol Platform for Experts (EPE)
      
       * Strategic Analysis
       * Intelligence Analysis
          * Cyber Intelligence
      
       * Forensics
       * Training and Capacity Building
       * Joint Cybercrime Action Taskforce (J-CAT)
   
    * Europol in Action
       * Operations
       * Europol’s 20 most noteworthy operations
   
    * Main Reports
       * EU Terrorism Situation & Trend Report (Te-Sat)
       * Serious and Organised Crime Threat Assessment (SOCTA)
       * Internet Organised Crime Threat Assessment (IOCTA)
       * Europol in Brief (Annual Review)
   
    * Public Awareness and Prevention Guides
    * Intelligence Notifications - Early Warning Notifications
    * Joint Investigation Teams - JITs
    * Stop Child Abuse – Trace an Object
    * Innovation Lab
    * Europol Excellence Award in Innovation award
    * SIRIUS project
    * Eastern Partnership project (EaP)
    * Europol Photo Competition
       * Photo competition winners
   
    * Justice and Home Affairs (JHA) agencies‘ network
    * COVID-19
    * Grants
       * Principles for Europol Participation to Grant projects
       * Requests for Europol participation in grants awarded by other entities

 * Crime Areas & Trends
    * Crime Areas
       * Trafficking in Human Beings
       * Facilitation of Illegal Immigration
       * Terrorism
       * Drug Trafficking
          * Synthetic Drugs
          * Cannabis
          * Cocaine and heroin
          * Other Drugs
      
       * Cybercrime
          * High-Tech crime
          * Social engineering
      
       * Child Sexual Exploitation
          * Online sexual coercion and extortion of children
      
       * Forgery of money and means of payment
          * Payment Fraud
          * Euro Counterfeiting
          * Money Muling
      
       * Economic Crime
          * MTIC (Missing Trader Intra Community) fraud
          * Excise fraud
          * Money Laundering
      
       * Illicit firearms trafficking
       * Environmental Crime
          * Illicit trafficking in endangered animal species
          * Illicit trafficking in endangered plant species and varieties
      
       * Organised property crime
       * Forgery of Administrative Documents and Trafficking therein
       * Intellectual property crime
          * Counterfeiting and Product Piracy
      
       * Corruption
          * Sports Corruption
      
       * Maritime Piracy
       * Trafficking in Stolen Vehicles
       * Illicit Tobacco Trade
       * Outlaw Motorcycle Gangs
       * Mobile Organised Crime Groups
       * Mafia-Structured Organised Crime Groups (OCG)
       * Illicit Trafficking in Cultural Goods, Including Antiquities and Works
         of Art
       * Illicit Trafficking in Hormonal Substances and Other Growth Promoters
       * Crime Connected with Nuclear and Radioactive Substances
       * Illicit Trade in Human Organs and Tissue
       * Kidnapping, Illegal Restraint and Hostage Taking
       * Genocide, crimes against humanity and war crimes
       * Racism and Xenophobia
   
    * EU Policy Cycle - EMPACT
    * Trends and Routes
    * Europol Analysis Projects

 * Partners & Agreements
    * Member States
       * Austria
       * Belgium
       * Bulgaria
       * Croatia
       * Cyprus
       * Czech Republic
       * Denmark
       * Estonia
       * Finland
       * France
       * Germany
       * Greece
       * Hungary
       * Ireland
       * Italy
       * Latvia
       * Lithuania
       * Luxembourg
       * Malta
       * Netherlands
       * Poland
       * Portugal
       * Romania
       * Slovakia
       * Slovenia
       * Spain
       * Sweden
   
    * Operational Agreements
    * Strategic Agreements
    * Working Arrangements
    * EU Most Wanted
    * No More Ransom
    * Police2Peer

 * Careers & Procurement
    * Open Vacancies
       * Vacancies status
       * Reserve List
       * Candidate Home page - Login
   
    * How to apply
       * Seconded National Expert posts
       * Europol National Units of the European Member States
   
    * Why Europol?
       * What we offer
          * Salaries
      
       * Living in The Hague
       * Childcare and Education in the Netherlands
       * Meet our people
   
    * Internships
       * Information about internships
       * Meet our interns!
   
    * Work with us - Procurement
       * Ongoing Procurement Procedures
       * Closed Procurement Procedures
       * Remedies and how to complain

 * Newsroom
    * Image gallery
    * Creative production support
    * Contact our media team

 * Publications & Documents
    * Public Access to Europol documents
    * Request access to Europol documents
    * Public Register of Documents


YOU ARE HERE

 * Home
 * Newsroom
 * 12 targeted for involvement in ransomware attacks against critical
   infrastructure


AUTOMATED TRANSLATION

▼


12 TARGETED FOR INVOLVEMENT IN RANSOMWARE ATTACKS AGAINST CRITICAL
INFRASTRUCTURE

29 October 2021
Press Release
Press Release/News
PrintPDF
 * E-mail
 * Facebook
 * Twitter
 * LinkedIn

This News/Press release is about Cybercrime

View all crime areas

These cyber actors represented a dangerous combination of aggressive disruption
and high-stake targets

A total of 12 individuals wreaking havoc across the world with ransomware
attacks against critical infrastructure have been targeted as the result of a
law enforcement and judicial operation involving eight countries. 

These attacks are believed to have affected over 1 800 victims in 71 countries.
These cyber actors are known for specifically targeting large corporations,
effectively bringing their business to a standstill.

The actions took place in the early hours of 26 October in Ukraine and
Switzerland. Most of these suspects are considered high-value targets because
they are being investigated in multiple high-profile cases in different
jurisdictions. 

As the result of the action day, over USD 52 000 in cash was seized, alongside 5
luxury vehicles. A number of electronic devices are currently being forensically
examined to secure evidence and identify new investigative leads. 


THE TICKING TIME BOMB OF UNDETECTED MALWARE

The targeted suspects all had different roles in these professional, highly
organised criminal organisations. Some of these criminals were dealing with the
penetration effort, using multiple mechanisms to compromise IT networks,
including brute force attacks, SQL injections, stolen credentials and phishing
emails with malicious attachments. 

Once on the network, some of these cyber actors would focus on moving laterally,
deploying malware such as Trickbot, or post-exploitation frameworks such as
Cobalt Strike or PowerShell Empire, to stay undetected and gain further access.

The criminals would then lay undetected in the compromised systems, sometimes
for months, probing for more weaknesses in the IT networks before moving on to
monetising the infection by deploying a ransomware. These cyber actors are known
to have deployed LockerGoga, MegaCortex and Dharma ransomware, among others. 

The effects of the ransomware attacks were devastating as the criminals had had
the time to explore the IT networks undetected. A ransom note was then presented
to the victim, which demanded the victim pay the attackers in Bitcoin in
exchange for decryption keys. 

A number of the individuals interrogated are suspected of being in charge of
laundering the ransom payments: they would funnel the Bitcoin ransom payments
through mixing services, before cashing out the ill-gotten gains. 


INTERNATIONAL COOPERATION 

International cooperation coordinated by Europol and Eurojust was central in
identifying these threat actors as the victims were located in different
geographical locations around the world.

Initiated by the French authorities, a joint investigation team (JIT) was set up
in September 2019 between Norway, France, the United Kingdom and Ukraine with
financial support of Eurojust and assistance of both Agencies. The partners in
the JIT have since been working closely together, in parallel with the
independent investigations of the Dutch and U.S. authorities, to uncover the
actual magnitude and complexity of the criminal activities of these cyber actors
to establish a joint strategy.

Eurojust established a coordination centre to facilitate cross-border judicial
cooperation during the action day. In preparation of this, seven coordination
meetings were held. 

Europol’s European Cybercrime Centre (EC3) hosted operational meetings, provided
digital forensic, cryptocurrency and malware support and facilitated the
information exchange in the framework of the Joint Cybercrime Action Taskforce
(J-CAT) hosted at Europol’s headquarters in The Hague. 

More than 50 foreign investigators, including six Europol specialists, were
deployed to Ukraine for the action day to assist the National Police with
conducting jointly investigative measures. A Ukrainian cyber police officer was
also seconded to Europol for two months to prepare for the action day. 

This operation was carried out in the framework of the European
Multidisciplinary Platform Against Criminal Threats (EMPACT).

The following authorities took part in this operation: 

 * Norway: National Criminal Investigation Service (Kripos)
 * France: Public Prosecutor’s Office of Paris, National Police (Police
   Nationale - OCLCTIC)
 * Netherlands: National Police (Politie), National Public Prosecution Service
   (Landelijk Parket, Openbaar Ministerie)
 * Ukraine: Prosecutor General’s Office (Офіс Генерального прокурора), National
   Police of Ukraine (Національна поліція України)
 * United Kingdom: Police Scotland, National Crime Agency (NCA)
 * Germany: Police Headquarters Reutlingen (Polizeipräsidium Reutlingen)
 * Switzerland: Federal Police (fedpol), Polizei Basel-Landschaft
 * United States: United States Secret Service (USSS), Federal Bureau of
   Investigations (FBI) 
 * Europol: European Cybercrime Centre (EC3)
 * Eurojust 

 

In 2017 the Council of the EU decided to continue the EU Policy Cycle for the
2018 - 2021 period. It aims to tackle the most significant threats posed by
organised and serious international crime to the EU. This is achieved by
improving and strengthening cooperation between the relevant services of EU
Member States, institutions and agencies, as well as non-EU countries and
organisations, including the private sector where relevant. Cybercrime is one of
the priorities for the Policy Cycle. From 2022, the mechanism becomes permanent
under the name EMPACT 2022+.

 

Crime areas
Cybercrime
Target groups
General Public
Law Enforcement
Academia
Professor
Students
Researcher
Press/Journalists
Other
Entities
European Cybercrime Center (EC3)
Organisations
Eurojust
Support & Services
Operational coordination
Operational support
Information exchange


GET IN TOUCH

Tel.:  +31 70 302 5000

For more information, general inquiries and details about visiting Europol,
please refer to our Contact Us section.

 * Facebook
 * Twitter
 * Youtube
 * LinkedIn
 * Instagram
 * RSS


SEE ALSO

 * Events
 * FAQ
 * Contact us
 * Report a Crime
 * Legal notice
 * Cookies
 * Right of access
 * Records of processing activities
 * Processing of personal data
 * Justice and Home Affairs (JHA) agencies‘ network


SUBSCRIBE TOOUR E-MAIL ALERTS

Subscribe to receive an Email when we publish a press release, document, vacancy
or internship.

Manage your e-mail alerts subscriptions

  European Union Agency for Law Enforcement Cooperation  -  Making Europe Safer

 A body of the European Union

© 2021 Europol.


ORIGINALTEXT


Bessere Übersetzung vorschlagen

--------------------------------------------------------------------------------





We use cookies on Europol's website to support technical features that enhance
your user experience. For more information, see our cookie policy.

You can enable and disable cookies by selecting the options below.

More information
 * Mandatory cookies
 * Analytics (Anonymous)

OK, I agree No, thanks OK, I agree